Vehicle guidance device for a vehicle and method for redundant, at least partially automatic guidance of the vehicle along a trajectory

Abstract

The present invention relates to a vehicle guidance device for a vehicle (1) for redundantly, at least partially automatically, guiding the vehicle (1) along a trajectory, wherein the vehicle guidance device (10) for this purpose has a first vehicle state determination device (14) for determining at least one first vehicle state variable characteristic of a vehicle state of the vehicle (1) on the basis of sensor data collected by means of at least one first sensor device (15) of the vehicle (1), and at least one second vehicle state determination device (24) for determining at least one second vehicle state variable characteristic of a vehicle state of the vehicle (1) on the basis of sensor data collected by means of at least one second sensor device (25) of the vehicle (1), wherein the at least one first sensor device (15) and the at least one second sensor device (25) are of different types.Furthermore, the invention relates to a vehicle with such a vehicle guidance device and to a method for at least partially automatically guiding a vehicle (1) along a trajectory.

Description

The present invention relates to a vehicle guidance device for a vehicle for the redundant, at least partially automatic guidance of the vehicle along a trajectory, comprising a first vehicle state ascertainment device for ascertaining at least one first vehicle state variable and at least one second vehicle state ascertainment device, which is at least partially different from the first vehicle state ascertainment device, for ascertaining at least one second vehicle state variable. The invention further relates to a vehicle equipped with such a vehicle guidance device and to a method for at least partially automatic guidance of a vehicle along a trajectory.An essential component for automatic or autonomous driving (for example of a vehicle) is the detection of the (vehicle) position and orientation. This enables the calculation of control commands which in turn enable the autonomous system to follow a calculated trajectory as accurately as possible. Since the system for calculating the trajectory must be designed redundantly in order to be tolerant to individual errors, the sensor system for detecting the (vehicle) position and alignment must also be redundant.Many sensors are already installed in current vehicles in order to correctly detect the alignment, the information of which partially overlaps without forming a true redundancy in the sense of a fault tolerance.DE 10 2019 008 091 A1 discloses a method for redundantly determining an own movement of a vehicle. For this purpose, when a malfunction of a primary sensor system is detected, an own movement of the vehicle is determined as a function of the data of a secondary sensor system by means of a SLAM algorithm. The primary sensor system is at least partially replaced by the secondary sensor system.DE 10 2013 220 526 A1 discloses a more fail-safe sensor architecture for driver assistance systems. In this case, a surroundings sensor having identically designed data transmission interfaces for the redundant transmission of raw sensor data is connected to each of the sensor data processing units via a respective associated data line.The systems known from the prior art have the disadvantage that comparatively high costs arise due to the redundancies. In addition, the redundant devices take up a large installation space and lead to a large energy and computing requirement.The present invention is based on the object of overcoming the disadvantages known from the prior art and of providing a secure system which occupies a smaller installation space and has a smaller energy and computing requirement.The object is achieved according to the invention by the subject matter of the independent claims. Advantageous embodiments and developments of the invention are the subject matter of the dependent claims.One solution to the underlying object thus consists in a vehicle guidance device for a vehicle for the redundant, at least partially automatic, preferably fully automatic, guidance of the vehicle along a trajectory, in particular for the longitudinal and / or transverse guidance of the vehicle. For this purpose, the vehicle guidance device has a first vehicle state ascertainment device for ascertaining at least one first vehicle state variable, which is characteristic of a vehicle state of the vehicle, preferably a vehicle position and / or a vehicle orientation, on the basis of sensor data recorded by means of at least one first sensor device of the vehicle. In addition, it comprises at least one second vehicle state determination device which is at least partially, preferably completely, different from the first vehicle state determination device for determining at least one second vehicle state variable which is characteristic of a vehicle state of the vehicle, preferably a vehicle position and / or a vehicle orientation, on the basis of sensor data recorded by means of at least one second sensor device of the vehicle. The vehicle guidance device is characterized in particular in that the at least one first sensor device and the at least one second sensor device are of different species.The vehicle guidance device is preferably provided and configured for fully automatic guidance of the vehicle along a trajectory. Redundantly equipped systems such as the vehicle guidance device are particularly suitable for fully automatic guidance of the vehicle, since even in the event of failure of one component, this failure can be compensated for by other components of the system.The vehicle state of the vehicle, which can be determined by the first vehicle state determination device and / or the second vehicle state determination device, is preferably a vehicle position and / or a vehicle orientation. These values have proven to be particularly suitable for calculating a trajectory along which the vehicle is to be guided.The first vehicle state determination means is preferably completely different from the second vehicle state determination means. This means, on the one hand, that in the event of a failure of one of these two vehicle state determination devices, the respective other can assume its function. Preferably, however, on the other hand, the second vehicle state determination device is different from the first vehicle state determination device in such a way that a different vehicle state can be determined or an identical vehicle state can be determined on the basis of a different measurement variable and / or a different sensor.For example, it is preferable that the first vehicle state determination device and the second vehicle state determination device have at least one sensor different from each other.For example, a sensor of the first vehicle state determination device is selected from a group comprising a rotation rate sensor, a wheel speed sensor, a steering angle sensor, an acceleration sensor, a radar sensor, an ultrasonic sensor, a laser sensor, a lidar (light detection and ranging) system, a surroundings sensor and / or a combination of sensors of the same or different type, whereas a sensor of the second vehicle state determination device is another sensor, which is likewise selected from a group comprising a rotation rate sensor, a wheel speed sensor, a steering angle sensor, an acceleration sensor, a radar sensor, an ultrasonic sensor, a laser sensor, a lidar system, a surroundings sensor and / or a combination of sensors of the same or different type.In this context, "another sensor" or "different sensor" is to be understood as a sensor which either measures a different value for calculating a vehicle state or determines an identical value for calculating a vehicle state on the basis of a different physical property.In a vehicle guidance device, the at least one first sensor device is preferably a wheel speed sensor and / or the at least one second sensor device is an acceleration sensor.It is thus conceivable, for example, for a sensor of the first vehicle state determination device to be an acceleration sensor which is used, for example, for determining the longitudinal acceleration and for a sensor of the second vehicle state determination device to be a (preferably a plurality of) wheel rotational speed sensor(s) for determining the vehicle speed. Both sensor types are basically suitable for calculating an identical vehicle state therefrom. For example, a longitudinal acceleration can likewise be calculated from a change in the rotational speed, as can be measured by an acceleration sensor. A transverse acceleration can also be calculated from a difference of the rotational speed of various wheel rotational speed sensors.In a preferred embodiment of the vehicle guidance device, the first vehicle state variable and the second vehicle state variable are each characteristic of the same vehicle state of the vehicle. As can be seen from the above example, a vehicle state of the vehicle, here the vehicle acceleration, can be calculated on the basis of the first vehicle state variable and the second vehicle state variable. Therefore, in order to determine a specific vehicle state, it is not necessary to implement a specific sensor for determining a specific vehicle state variable in duplicate, but another sensor for determining a different vehicle state variable can be used for calculating the vehicle state.Accordingly, doubling of the (identical) sensors is not necessary, but the determination of a vehicle state can be calculated on the basis of the vehicle state variables determined by different sensors. As a result, the high costs mentioned at the beginning can be avoided by redundancies and installation space can be saved. Likewise, in particular if the various sensors are provided in any case for determining specific (vehicle) parameters, the increased energy and computing requirement for operating the dual (identical) sensors can be saved.In a preferred embodiment of the vehicle guidance device, the at least one first sensor device is a yaw rate sensor for detecting a yaw rate of the vehicle and / or the at least one second sensor device is a steering angle sensor for detecting the steering angle of the vehicle. As explained above in another example, identical information about a vehicle state (for example, an orientation in a curve) can also be calculated from these two different sensor types. In an analogous manner, these two sensor types can therefore also replace one another when calculating this vehicle state (for example the orientation in a curve) and, in the event of a failure of one of these sensor devices, the vehicle can nevertheless be controlled reliably on the basis of the data of the other of these sensor devices.Preferably, the first sensor device is connected to a first energy supply device, so that the first sensor device can be supplied with energy by the first energy supply device. The second sensor device, on the other hand, is preferably connected to a second energy supply device, so that the second sensor device can be supplied with energy by the second energy supply device. It could also be possible here for the first energy supply device additionally also to be connected to the second sensor device for energy supply and for the second energy supply device additionally also to be connected to the first sensor device for energy supply. In an alternative embodiment to this, however, each of the first and second sensor devices is exclusively connected to one of the energy supply devices for energy supply. As a result, the systems can operate completely independently of one another and are not in any electrical connection.In a preferred embodiment, the vehicle guidance device comprises a first computer device and a second computer device, wherein both the first computer device and the second computer device are provided and configured for calculating and generating a control signal, wherein a data connection exists between the first computer device and the first sensor device and the first vehicle state variable is used for calculating the control signal by the first computer device and a data connection exists between the second computer device and the second sensor device and the second vehicle state variable is used for calculating the control signal by the second computer device. Preferably, a control signal is calculated by the first computer device and the second computer device, which control signal-although sensor data of the first sensor device on the one hand and sensor data of the second sensor device on the other hand form the basis-nevertheless uses a value of the same vehicle state as the calculation basis. If the sensors and the respectively assigned vehicle state determination devices respectively operate correctly, the determined values for the vehicle state (i.e. the first and the second vehicle state variable) should be identical and therefore also the control signal calculated on the basis thereof by the first or second computer device should be identical.The calculation of the control signal is thus preferably carried out redundantly by the first computer device and the second computer device.Preferably, a driving stabilization variable characteristic of a vehicle stability can be determined (by the first and / or second) computer device on the basis of the first vehicle state variable and the second vehicle state variable.In order to be able to continue to operate one of the two computer devices even in the event of failure of the power supply of the other computer device, the two computer devices are preferably supplied with energy by different energy supply devices via an energy supply line. Preferably, the first computer device is connected to a first energy supply device and a second computer device is connected to a second energy supply device. In order to increase the reliability, each of the two energy supply devices could also supply energy to each of the two computer devices. However, complete (electrical) isolation of the two computer devices from one another is often desired, so that the first computer device is connected only to the first of the two power supply devices mentioned and the second computer device is connected only to the second power supply device of the two power supply devices mentioned.In a preferred embodiment, the vehicle guidance device comprises a first trajectory calculation device and a second trajectory calculation device. Both the first trajectory calculation device and the second trajectory calculation device are provided and configured to calculate a trajectory on which the vehicle is intended to move in the future. Preferably, a data connection exists between the first computer device and the first trajectory calculation device and a data connection exists between the second computer device and the second trajectory calculation device. Thus, the first computer device can use the trajectory calculated by the first trajectory calculation device to calculate a control signal and the second computer device can use the trajectory calculated by the second trajectory calculation device to calculate a control signal.The trajectory calculation of each of the two trajectory calculation devices is preferably based on surroundings data which are detected by a surroundings sensor device. Preferably, each of the two trajectory calculation devices is assigned a separate environment sensor device, namely a first environment sensor device to the first trajectory calculation device and a second environment sensor device to the second trajectory calculation device. Thus, not only the trajectory calculation devices are formed redundantly, but also the environment sensor devices.In the event of a failure of a trajectory calculation device or of a surroundings sensor device, a trajectory can therefore furthermore be calculated and a control signal for safe guidance of the vehicle along the calculated trajectory can accordingly be calculated by the computer device assigned in each case to the trajectory calculation device.In order to be able to ensure this redundancy even in the event of a failure of the energy supply, the first trajectory calculation device is connected to a first energy supply device for supplying it with energy, and the second trajectory calculation device is connected to a second energy supply device for supplying it with energy.In a preferred embodiment of the vehicle guidance device, a first vehicle guidance system, which comprises at least the first sensor device, the first computer device and a first trajectory calculation device, is incorporated for energy supply into a first energy network, which is different from a second energy network for supplying a second vehicle guidance system, which comprises at least the second sensor device, the second computer device and a second trajectory calculation device.In particular, the first environment sensor device, the first trajectory calculation device, the first computer device, and the first sensor device are preferably connected to the first energy supply device and are supplied with energy by the first energy supply device. In contrast, the second trajectory calculation device, the second calculation device and the second sensor device are connected to the second energy supply device and are supplied with energy by the second energy supply device. This makes it possible to ensure that even in the event of a failure of one of the two energy supply devices, a calculation of a control signal is possible taking account of a sensor signal (or a vehicle state calculated therefrom) and a trajectory calculated taking account of environmental data.In a preferred embodiment of the vehicle guidance device, a first actuator, which is provided and configured to execute a control command output by the first computer device, is connected to the first energy supply device and can be supplied with energy by the latter. A second actuator, which is provided and configured to execute a control command output by the second computer device, is preferably connected to the second energy supply device and can be supplied with energy by the latter.The first actuator is preferably designed to be redundant to the second actuator. Both the first actuator and the second actuator can therefore execute a command for carrying out a movement of a component mechanically connected to these two actuators. The component connected to these two actuators is preferably selected from a group comprising a braking device, a steering device and a drive.The first actuator is preferably part of the first vehicle guide train, the second actuator is preferably part of the second vehicle guide train. This makes it possible to apply the action necessary for a safe driving maneuver to the mechanical component to be moved, even if one of the elements should fail from one of the two vehicle guide trains.Preferably, the first and the second computing device are connected to one another via a data connection. This preferably allows an exchange of data selected from a trajectory calculated by a trajectory calculation device, a first or second vehicle state variable, a control signal and data derived therefrom or correlated therewith. This makes it possible for one (or both) computer devices to compare the respective data (namely the data determined in the first vehicle guidance system and the data determined in the second vehicle guidance system in a correlated manner thereto) with one another and to perform a safety action if a maximum deviation tolerance value is exceeded.If, for example, it is determined during the above-described data comparison between the first and second computer devices that the first vehicle state variable (which are determined on the basis of sensor data collected by means of at least one first sensor device) is different from the second vehicle state variable (which are determined on the basis of sensor data collected by means of at least one second sensor device), this could be attributable to the fact that the first and the second sensor devices are not redundant and (largely) determine identical sensor data, but are different from the species and therefore necessarily determine different (basic) sensor data, which are used to calculate the respective vehicle state variable.In this case, it may occur that after a certain time and / or distance, the respective (basic) sensor data lead to the calculation of increasingly diverging vehicle state variables. If, for example, the first sensor device is a wheel speed sensor and the second sensor device is an acceleration sensor, vehicle state variables can be calculated from the (basic) sensor data of these sensors, which are characteristic of the same vehicle state, for example the current speed or longitudinal acceleration, of the vehicle.In order to prevent such a state, the calculated vehicle state variables are preferably matched to one another a plurality of times, preferably at rain intervals, in particular continuously, but particularly preferably in a state in which a vehicle state variable (for example the speed) is known and is preferably constant.If, for example, a speed value calculated as the integral of a longitudinal acceleration signal is used as redundancy to the (measured) speed signal, deviations are regularly to be expected. It is therefore proposed to compare these values regularly with one another. Such a comparison preferably takes place at a point in time at which the speed signal is (at least approximately) constant and an acceleration value falls below a limit value (preferably is very small). Preferably, in the case of a deviation of the two compared values from one another (and if there are no indications of a malfunction of the sensor device for determining the measured value), the calculated value is set equal to the measured value (v(a)=v). This makes it possible to ensure that the two speed values are regularly balanced and that the error which may occur remains low.Which value is adapted to the respective other value in the case of a high deviation could also be decided on the basis of a plausibility check. Such a plausibility check preferably comprises an observation of the values over a predefined period of time. If there are unpredictable or unexpected changes during such a period, this indicates implausible values. Thus, for example, a speed determined by a sensor device could be classified as not plausible if a (sudden) speed change occurs within the time period considered in the context of the plausibility check, which changes exceeds a limit value (for example, 12-16 m / s 2 preferably approximately 14 m / s 2). If there are no indications on a driving maneuver that could cause such a speed change, a determined speed can be classified as not plausible. Instructions on a driving maneuver that could cause such a speed change could be provided, for example, by other sensors, for example crash sensors, which could make an abrupt speed change clearable by the detection of a collision.Analogously, it is possible, for example at a known speed, to convert the steering angle and yaw rate into one another and to compare the values obtained with one another. Such a comparison and the subsequent adaptation of at least one datum for synchronization with the respective other sensor device is sufficient in most cases to prevent vehicle state variables which increasingly diverge from one another.In cases of a particularly large deviation of the determined vehicle state variables from one another, it may be necessary and / or advantageous for such synchronization to specifically put the vehicle into a state in which a vehicle state variable assumes a known value. For example, it could be advantageous for this purpose to briefly stop the vehicle (for example in a parking lot or shoulder) in order to coordinate the sensor data determined by the two sensors with one another. Thus, when the vehicle is at a standstill, both the wheel rotational speed sensor and the acceleration sensor should output a neutral value (for example zero) and the vehicle state variable (current speed or longitudinal acceleration) determined therefrom should likewise be known (for example likewise corresponding to a neutral value). This makes it possible to reset the difference and / or adjustment between the vehicle state variables determined by the first computer device and the second computer device.Furthermore, the object on which the invention is based is achieved by a vehicle which comprises a vehicle guidance device as described above.Such a vehicle may be, but is not limited to, a road vehicle. The vehicle is preferably selected from a group comprising a road vehicle, a flight taxi, an aircraft, a (flight) drone, a ship and another means of transportation or another type of vehicle, for example an air, water or rail vehicle.A vehicle may be a semi-autonomous, autonomous (for example, level 3 or 4 or 5 level of autonomy (the SAE J3016) standard) or a self-driving motor vehicle. Level 5 levels of autonomy here denote fully automatically driving vehicles. The vehicle is preferably an automatically driving vehicle starting from SAE Level 3. The vehicle may be controlled by a driver or may drive autonomously.The vehicle guidance device and / or the vehicle equipped therewith is preferably configured, suitable and / or intended to carry out the method described below and all method steps described in connection with the method individually or in combination with one another or individual method steps using the same. Conversely, the method for at least partially automatic guidance of a vehicle along a trajectory with all features described within the scope of the vehicle guidance device can be carried out individually or in combination with one another. In particular, the vehicle guidance device can be used to carry out the method described below.The present invention is furthermore directed to a method for the redundant, at least partially automatic, preferably fully automatic, guidance of the vehicle along a trajectory, in particular a longitudinal and / or transverse guidance of the vehicle along the trajectory. For this purpose, sensor data are ascertained by means of at least one first sensor device of the vehicle and, on the basis thereof, at least one first vehicle state variable which is characteristic of a vehicle state of the vehicle, preferably a vehicle position and / or a vehicle orientation, is ascertained by a first vehicle state ascertainment device. Furthermore, sensor data are determined by means of at least one second sensor device of the vehicle, which sensor device is different from the first sensor device in the species, and on the basis of which at least one second vehicle state variable, which is characteristic of a vehicle state of the vehicle, preferably a vehicle position and / or a vehicle orientation, is determined by a second vehicle state determination device. Because sensor data of two sensor devices of different types are used to determine the vehicle state of the vehicle, preferably the vehicle position and / or the vehicle orientation, this method is particularly robust and a large influence of external factors (which act only on the first or the second sensor device, for example) can be minimized.In a preferred method variant, the first vehicle state variable and the second vehicle state variable are each characteristic of the same vehicle state of the vehicle, and the first vehicle state variable or a value derived therefrom and the second vehicle state variable or a value derived therefrom are compared with one another at least at a predefined point in time. By comparing (also referred to below as a comparison) the first vehicle state variable or a value derived therefrom with the second vehicle state variable or a value derived therefrom, it can be achieved that deviations between these values are detected and thus an increasing divergence in the respectively determined vehicle state variables can be detected. As a result, an increasing deviation between the vehicle state variables determined on the basis of the data of the various sensor devices can be detected at an early stage and, for example, a recalibration can be carried out.Preferably, a control signal is calculated taking into account the first vehicle state variable or the second vehicle state variable, which control signal is output to an actuator. This actuator can convert a travel command into a movement of the vehicle, for example an acceleration, a braking operation or a steering operation.The calculation of the control signal is preferably carried out by a first computer device (taking into account the sensor data collected by the first sensor device of the vehicle) and by a second computer device (taking into account the sensor data collected by the second sensor device of the vehicle). Preferably, data are also additionally used in each case, which are provided by a first trajectory calculation device to the first computer device and are provided by a second trajectory calculation device to the second computer device.The first sensor device, the first computer device and the first trajectory calculation device preferably form a first vehicle guidance system which is connected to a first energy supply device. The second sensor device, the second computer device and the second trajectory calculation device preferably form a second vehicle guidance system, which is connected to a second energy supply device. Both vehicle guide trains can thus be supplied with energy independently of one another.Preferably, a comparison of the sensor information and / or vehicle state variables calculated therefrom takes place between two vehicle guidance trains at at least one defined transfer point, preferably at a plurality of transfer points. For example, at a transfer point, a vehicle state calculated by one vehicle guidance system or a control signal could be matched to the respective equivalent signal of the other vehicle guidance system. A plurality of transfer points can make it possible for the failure of a component of one of the vehicle guidance trains to be detected reliably even if an error occurs downstream of a first transfer point (for example during the calculation of a datum derived from sensor information).Each of the vehicle guidance trains preferably independently forms a longitudinal guidance sensor system or a trajectory control system, which enables autonomous or automatic driving of the vehicle. The preferably at least two vehicle guide trains thus form a redundant system-despite sensor devices of different species-which ensures that the vehicle is safe to drive and in particular preferably drives (partially) autonomously even in the event of a failure of a vehicle guide train (or a component of this vehicle guide train).The first sensor device and second sensor device, which are preferably already present for monitoring (different) vehicle functions, make it possible, if the first vehicle state variable calculated therefrom and the second vehicle state variable are each characteristic of the same vehicle state of the vehicle, to dispense with an additional sensor device which is redundant to the first sensor device or the second sensor device. Preferably, the different type of first or second sensor device provides the redundancy to the other of the first or second sensor device. The redundancy need only be present once. High costs can thus be avoided by identical (and thus also generic) sensor devices in the redundant system.Consequently, two sensor devices of different species and already provided in the vehicle (and preferably necessary or helpful for manual driving) are preferably used to calculate the first vehicle state variable and the second vehicle state variable, which are each characteristic of the same vehicle state of the vehicle. Preferably, at least two independent, but mutually communicating vehicle guidance trains (or trajectory regulations) are used for automatic driving. Each of the two sensors mentioned (different in the type) is now connected in each case to one of the two trajectory controllers in which the evaluation of the sensor information is then carried out. Each trajectory control with its associated sensor devices is preferably separately supplied with energy so that, in the event of a fault, a trajectory control with one of the sensor devices can still maintain the function necessary for safe (autonomous driving).In a preferred embodiment, at the start of travel (and at each subsequent suitable event, which could be for example vehicle speed equal to 0 or a constant value), the sensors and / or the sensor devices are matched to one another. This can be done, for example, by exchanging the current information. Subsequently, preferably in the first trajectory control, both the current speed and the longitudinal acceleration are determined from the sensor data (for example a wheel speed). In the second trajectory regulation, both the longitudinal acceleration is determined from the sensor data (for example acceleration data of an acceleration sensor) and the current speed is calculated. This can be done with the aid of the exchanged starting value and an integration.During operation (i.e., for example, during the travel of the vehicle), the ascertained values are preferably exchanged at least after specific times, preferably continuously, whereby the sensors and also their calculation algorithm can be checked for plausibility. Preferably, therefore, a (preferably repeated or continuous) mutual plausibility check of the sensor information and / or of the vehicle state determined therefrom takes place. If a deviation that exceeds a critical deviation value occurs, a safe state is preferably assumed. This could be done, for example, by bringing the vehicle to a standstill (for example, on the road shoulder). Preferably, for controlling such a safe state, the more trusted signal of the at least two vehicle guidance trains (or trajectory regulations) is used.Preferably, in the case that individual faults are diagnosed in the sensors, the calculation algorithms or the trajectory controls, the vehicle control is switched over to the still fault-free vehicle guidance system and thus a safe state is reached. Each individual sensor with its connected trajectory control (i.e. associated therewith) is thus preferably able to transfer the vehicle into a safe state, for example the position on the road edge.A vehicle guidance device as described above allows the realization of a redundant system, with only minimal redundancy of the individual components. At the same time, such a vehicle guidance device offers a high degree of technological diversification, which provides an increase in robustness and fault tolerance.Great flexibility is offered in the selection of sensors. Thus, a vehicle guidance device as described above allows a simple and cost-optimal solution to the sensor design. It is likewise possible to use components (for example sensors) which have already been tested (and possibly installed in previous series of vehicles).Since even in vehicle guide trains that supplement or replace each other in a redundant manner not every sensor has to be designed redundantly with a sensor of the same type, installation space can be saved in the vehicle. In addition, the energy consumption can be reduced compared to known systems, since no sensor of the same generic type has to be supplied with energy in each case.The present invention is further directed to a computer program or computer program product comprising program means, in particular a program code which represents or encodes at least some of the method steps of the method according to the invention and preferably one of the described preferred embodiments and is designed for execution by a processor device.The present invention is further directed to a data memory on which at least one embodiment of the computer program according to the invention or a preferred embodiment of the computer program is stored.The present invention is further directed to a signal which is preferably characteristic of a vehicle state, in particular abbly described (in particular abbly described (determined by a first vehicle state determination device and / or second vehicle state determination device) and / or a control signal, which is preferably generated as a function of the vehicle state variable and which transmits and / or determines and / or provides (for transmission and / or output) the above-described computer program.Further advantages and embodiments are evident from the attached drawing:The following shows: FIG. 1 shows a schematic illustration of a vehicle guidance device according to the invention according to a preferred embodiment.FIG. 1 shows a schematic illustration of a vehicle guidance device 10 according to the invention in accordance with a preferred embodiment. In the illustration shown, the vehicle guidance device 10 is part of a vehicle 1, which is indicated only schematically.The vehicle guidance device 10 comprises a first sensor device 15, which can also be referred to as a first vehicle orientation sensor system and which, in the example shown, comprises a wheel speed sensor 15, for example. The first sensor device 15 supplies a sensor datum which is the basis for the calculation of a first vehicle state variable characteristic of a vehicle state of the vehicle 1 by a first vehicle state determination device 14.Furthermore, the vehicle guidance device 10 comprises a second sensor device 25 (which can also be referred to analogously as a second vehicle orientation sensor system) and which, in the example shown, comprises, for example, an acceleration sensor 25. The second sensor device 25 supplies a sensor datum which forms the basis for calculating a second vehicle state variable characteristic of a vehicle state of the vehicle 1. This calculation is performed by a second vehicle state determination device 24.Each of the two sensor devices 15, 25 and / or vehicle state determination devices 14, 24 is connected to a computer device 16, 26. The first sensor device 15 and / or first vehicle state determination device 14 is in a data connection with a first computer device 16 and the second sensor device 25 and / or second vehicle state determination device 24 is in a data connection with a second computer device 26.In each of the two computer devices 16, 26, a control signal is calculated on the basis of the sensor device 15, 25 which is in a data connection with this computer device 16, 26 (if appropriate indirectly via the vehicle state determination device 14, 24) and is output to an actuator 17, 27 arranged downstream.Each of the two computer devices 16, 26, together with the respectively assigned sensor device 15, 25 and the respective vehicle state determination device 14, 24, is part of an energy network 2, 4 which is separated from the energy network 2, 4 of the respectively other of the two computer devices 16, 26. Thus, the first sensor device 15, the first vehicle state determination device 14 and the first computer device 16 are part of the first energy network 2, whereas the second sensor device 25, the second vehicle state determination device 24 and the second computer device 26 are part of the second energy network 4. This assignment to different energy grids 2, 4 can ensure that at least one of the two sensor devices 15, 25, the vehicle state determination devices 14, 24 and the computer device 16, 26 connected to them in each case is supplied with energy, even if the other of the two energy grids 2, 4 should fail.The components assigned to an energy network 2, 4 (for example first environment sensor system 12, first trajectory generator 13 (also referred to as first trajectory calculation device 13), first sensor device 15, first vehicle state determination devices 14, first computer device 16 and first actuator 17) which are used for driving the vehicle can be referred to as a (first) vehicle guidance system. Analogously to the above example, the second environment sensor system 22, second trajectory generator 23 (also referred to as second trajectory calculation device 23), second sensor device 25, second vehicle state determination device 24, second computer device 26 and second actuator 27 can be referred to as the second vehicle guidance system. Each of these two vehicle guide trains is assigned exactly to one and preferably only to one of the two energy networks 2, 4. This makes it possible to avoid interactions in the event of failure of one of the two energy networks 2, 4, but nevertheless to ensure the functionality of the other vehicle guidance system.The actuator 17, 27 can be, for example, a brake actuator, a drive actuator or a steering actuator. A first actuator 17 is preferably redundant to a second actuator 27. this means that both the first actuator 17 and the second actuator 27 can set an identical (mechanical) impulse, which initiates, for example, a braking operation, an acceleration operation or a steering operation.The two computer devices 16, 26 are in data communication via a data connection identified by the double arrow P. Preferably, a datum is also transmitted via this data connection P to each of the two computer devices 16, 26, which datum originates from the sensor device 15, 25 of the respective other energy network 2, 4 or was determined on the basis of a sensor datum determined by this sensor device 15, 25 (for example by the associated one of the vehicle state determination devices 14, 24 or the other one of the two computer devices 16, 26). As a result, each computer device 16, 26 is able to independently check whether the self-calculated control signal and / or the vehicle state variable calculated in this vehicle guidance system corresponds to that and / or that calculated in the other vehicle guidance system (for example by the other computer device 16, 26). If the deviation between the compared values exceeds a critical limit value, a safety protocol can be initiated.The applicant reserves the right to claim all the features disclosed in the application documents as essential to the invention, provided they are novel, individually or in combination, compared with the prior art. It is also pointed out that features have also been described in the figure, which features may be advantageous per se. The skilled person directly recognizes that a specific feature described in the figure can also be advantageous without the adoption of further features from this figure. Furthermore, the skilled person recognizes that advantages can also result from a combination of a plurality of features shown in the figure.List of reference characters1 Vehicle 2 First energy grid 4 Second energy grid 10 Vehicle guidance device 12 First environment sensor system 13 First trajectory generator, first trajectory calculation device 14 First vehicle state ascertainment device 15 First sensor device, wheel rotational speed sensor 16 First computer device 17 First actuator 22 Second environment sensor system 23 Second trajectory generator, second trajectory calculation device 24 Second vehicle state ascertainment device 25 Second sensor device, acceleration sensor 26 Second computer device 27 Second actuator P ArrowReferences included in the specificationThis list of documents cited by the applicant has been produced in an automated manner and is only included for the better information of the reader. The list is not part of the German patent application or utility model application. The DPMA does not take any adhesion for any faults or omissions.Patent Literature citedDE 10 2019 008 091 A1

[0004] DE 10 2013 220 526 A1

[0005]

Claims

Vehicle guidance device (10) for a vehicle (1) for the redundant, at least partially automatic, guidance of the vehicle (1) along a trajectory, wherein the vehicle guidance device (10) has, for this purpose, a first vehicle state determination device (14) for determining at least one first vehicle state variable characteristic of a vehicle state of the vehicle (1) on the basis of sensor data recorded by means of at least one first sensor device (15) of the vehicle (1), and at least one second vehicle state determination device (24) for determining at least one second vehicle state variable characteristic of a vehicle state of the vehicle (1) on the basis of sensor data recorded by means of at least one second sensor device (25) of the vehicle (1), characterized in that the at least one first sensor device (15) and the at least one second sensor device (25) are different in terms of the species.Vehicle guidance device (10) according to Claim 1, characterized in that the first vehicle state variable and the second vehicle state variable are each characteristic of the same vehicle state of the vehicle.Vehicle guidance device (10) according to one of the preceding claims, characterized in that it comprises a first computer device (16) and a second computer device (26), wherein both the first computer device (16) and the second computer device (26) are provided and configured for calculating and generating a control signal, wherein a data connection exists between the first computer device (16) and the first sensor device (15), and the first vehicle state variable is used for calculating the control signal by the first computer device (16), and a data connection exists between the second computer device (26) and the second sensor device (25), and the second vehicle state variable is used for calculating the control signal by the second computer device (26).Vehicle guidance device (10) according to one of the preceding claims, characterized in that a first vehicle guidance line, which comprises at least the first sensor device, the first computer device and a first trajectory calculation device, is integrated for the energy supply into a first energy network (2), which is different from a second energy network (4) for the supply of a second vehicle guidance line, which comprises at least the second sensor device, the second computer device and a second trajectory calculation device.Vehicle guiding device (10) according to one of the preceding claims, characterized in that the at least one first sensor device (15) is a wheel rotational speed sensor and / or the at least one second sensor device (25) is an acceleration sensor.Vehicle guidance device (10) according to one of the preceding claims, characterized in that the at least one first sensor device (15) is a yaw rate sensor for detecting a yaw rate of the vehicle and / or the at least one second sensor device (25) is a steering angle sensor for detecting the steering angle of the vehicle.Vehicle (1), in particular motor vehicle, comprising a vehicle guiding device (10) according to one of the preceding claims.Vehicle (1) according to the preceding claim, characterized in that the vehicle (1) has a vehicle stabilization device which is suitable and intended for ascertaining a driving stabilization variable which is characteristic of a vehicle stability on the basis of the first vehicle state variable and the second vehicle state variable.Method for at least partially automatic guidance of a vehicle (1) along a trajectory, wherein sensor data are determined by means of at least one first sensor device of the vehicle and on the basis of which at least one first vehicle state variable characteristic of a vehicle state of the vehicle is determined by a first vehicle state determination device, characterized in that sensor data are determined by means of at least one second sensor device of the vehicle, which sensor device is different from the first sensor device in the genus, and on the basis of which at least one second vehicle state variable characteristic of a vehicle state of the vehicle is determined by a second vehicle state determination device.Method according to Claim 9, characterized in that the first vehicle state variable and the second vehicle state variable are each characteristic of the same vehicle state of the vehicle, and the first vehicle state variable or a value derived therefrom and the second vehicle state variable or a value derived therefrom are compared with one another at least at a predefined point in time.

Images