Method for infrastructure-supported assistance of a motor vehicle

Abstract

The invention relates to a method for infrastructure-based assistance of a motor vehicle using at least two data processing units, comprising the following steps: Receiving identical environmental data representing the environment of the motor vehicle by the data processing units; calculating infrastructure assistance data for infrastructure-based assistance of the motor vehicle based on the received environmental data by the data processing units; comparing the infrastructure assistance data determined by each data processing unit with infrastructure assistance data determined by another of the at least two data processing units to calculate a comparison result; applying an identical hash function to the calculated comparison result by the data processing units to calculate a hash value.Sending the calculated hash value to the vehicle by the data processing units; sending the infrastructure assistance data determined by one of the data processing units to the vehicle. The invention relates to a method, a device, a system, a computer program and a machine-readable storage medium.

Description

[0001] The invention relates to a method for infrastructure-based assistance of a motor vehicle, a method for at least partially automated driving of a motor vehicle, a system for infrastructure-based assistance of a motor vehicle, a device for at least partially automated driving of a motor vehicle, a computer program and a machine-readable storage medium. State of the art

[0002] Disclosure document WO 2023 / 004184 A1 discloses a method for monitoring a road.

[0003] The patent application EP 3 674 920 A1 discloses a method for creating map data.

[0004] Disclosure WO 2022 / 081421 A1 discloses a method for data transfer within an infrastructure. Disclosure of the invention

[0005] The object underlying the invention is to provide a concept for the efficient infrastructure-based assistance of a motor vehicle.

[0006] The object underlying the invention is also to provide a concept for the efficient, at least partially automated, driving of a motor vehicle.

[0007] These problems are solved by means of the respective subject matter of the independent claims. Advantageous embodiments of the invention are the subject of dependent claims.

[0008] Following a first aspect, a method for infrastructure-based assistance of a motor vehicle using at least two data processing devices is provided, comprising the following steps: Received by the data processing facilities of the same environmental data, which represent an environment of the motor vehicle, Calculating infrastructure assistance data for infrastructure-supported assistance of the motor vehicle by the data processing units based on the respective received environmental data; comparing the infrastructure assistance data determined by the data processing units themselves with infrastructure assistance data determined by another of the at least two data processing units in order to calculate a comparison result in each case. Applying the same hash function by the Data processing facilities apply the calculated comparison result to calculate a hash value in each case, Sending the calculated hash value to the vehicle via the data processing facilities, Sending the infrastructure assistance data determined by one of the data processing facilities to the motor vehicle.

[0009] A second aspect involves providing a procedure for at least partially automated driving of a motor vehicle, comprising the following steps: Receiving a respective hash value from at least two data processing facilities, Receiving infrastructure assistance data from one of the data processing facilities, Specify that the received infrastructure assistance data may be used for at least partially automated driving of the motor vehicle, based on the received hash values.

[0010] A third aspect involves providing a system for infrastructure-based assistance of a motor vehicle, encompassing: at least two data processing devices, each configured to receive the same environmental data representing the environment of the motor vehicle, wherein the data processing facilities are each set up to calculate infrastructure assistance data for infrastructure-supported assistance of the motor vehicle based on the environmental data received in each case, wherein the data processing facilities are each set up to compare the infrastructure assistance data they themselves have collected with infrastructure assistance data collected by another of the at least two data processing facilities in order to calculate a comparison result in each case, wherein the data processing facilities are each set up to apply the same hash function to the respective calculated comparison result in order to calculate a hash value in each case, wherein the data processing facilities are each set up to send the calculated hash value to the motor vehicle, one of the data processing facilities is set up to send the self-determined infrastructure assistance data to the motor vehicle.

[0011] A fourth aspect involves providing a device for at least partially automated driving of a motor vehicle, comprising: a communication device which is set up to obtain a respective hash value from at least two data processing devices and To receive infrastructure assistance data from one of the data processing facilities, a processor facility which is configured to specify that the received infrastructure assistance data may be used for at least partially automated driving of the motor vehicle, based on the received hash values.

[0012] According to a fifth aspect, a computer program is provided which includes instructions which, when the computer program is executed by a computer, for example by the system according to the third aspect and / or by the device according to the fourth aspect, cause it to execute a procedure according to the first aspect and / or according to the second aspect.

[0013] According to a sixth aspect, a machine-readable storage medium is provided on which the computer program is stored according to the fifth aspect.

[0014] The invention is based on and includes the understanding that at least two data processing units, for example three data processing units, are used for infrastructure-based assistance of a motor vehicle. The same environmental data is provided to the data processing units, with this environmental data representing the environment of the motor vehicle. Based on this identical environmental data, each of the data processing units independently calculates infrastructure assistance data for infrastructure-based assistance of the motor vehicle. For example, it is provided that the data processing units transmit their respective calculated infrastructure assistance data to each other, at least partially, such that each data processing unit compares its own calculated infrastructure assistance data with the infrastructure assistance data calculated by another of the at least two data processing units.The infrastructure assistance data sent to the relevant data processing facilities is received by those facilities. This provides, for example, the technical advantage that the data processing facilities can compare their own collected infrastructure assistance data with the infrastructure assistance data collected by the other data processing facility(ies).

[0015] For example, it is provided that if there are three data processing facilities, the first data processing facility sends the self-determined infrastructure assistance data to the second and the third data processing facility, and that the second data processing facility does not send its self-determined infrastructure assistance data to the first and the third data processing facility, and that the third data processing facility sends the self-determined infrastructure assistance data to the first data processing facility.This allows the first data processing facility to compare its own infrastructure assistance data with the infrastructure assistance data determined by the third data processing facility, and allows the second data processing facility to compare its own infrastructure assistance data with the infrastructure assistance data determined by the first data processing facility, and allows the third data processing facility to compare its own infrastructure assistance data with the infrastructure assistance data determined by the first data processing facility.

[0016] The three data processing facilities are thus each configured in such a way as to send their respective infrastructure assistance data, at least partially, to each other, so that each data processing facility can compare its own infrastructure assistance data with infrastructure assistance data obtained by another of the at least two data processing facilities.

[0017] Furthermore, it is provided that the same hash function is applied by the data processing units to each calculated comparison result in order to calculate a hash value. The hash values ​​calculated by the data processing units are sent to the vehicle. It is further provided that one of the data processing units, and in particular only one of the data processing units, sends the infrastructure assistance data it has determined itself to the vehicle.

[0018] On the vehicle side, this infrastructure assistance data is received by one of the data processing units. The calculated hash values ​​are also received on the vehicle side.

[0019] If the data processing facilities have determined the same infrastructure assistance data based on the same environment data, all data processing facilities should also calculate or determine the same comparison result, so that the same hash value is calculated by each of the data processing facilities.

[0020] Therefore, if all data processing units have determined the same infrastructure assistance data based on the same environmental data, the hash values ​​received by the vehicle should also match. If the hash values ​​do not match, for example, because one of the hash values ​​differs from the others, it can be assumed on the vehicle side that at least one of the determined infrastructure assistance data differs from the others. Thus, it can be stipulated, for example, that the received infrastructure assistance data may not be used for at least partially automated driving of the vehicle.

[0021] The background is that at least partially automated driving of a motor vehicle places high demands on the reliability and integrity of the data to be used for this purpose. In this case, that data is the infrastructure assistance data.

[0022] Infrastructure assistance data includes, for example, an object list of objects in the vicinity of the vehicle. If, for example, one of the data processing units has detected an object that has not been detected by the other data processing units, the corresponding calculated object lists will differ.

[0023] On the vehicle side, it is currently impossible to determine which of the object lists is correct. For safety reasons, in such a case, it is intended, for example, that the vehicle will not use any of the object lists for at least partially automated driving. For instance, it may be stipulated that if the hash values ​​differ, the vehicle will operate with a limited, at least partially automated driving function compared to when all hash values ​​match. In other words, for example, the vehicle may be driven at a lower speed when the hash values ​​do not match than when they do. For example, the vehicle may not allow at least partially automated driving in a specific driving situation if the hash values ​​do not match.For example, only a certain maximum level of automation may be permitted on the vehicle side if the hash values ​​do not match. For instance, if the hash values ​​do not match, only semi-automated driving may be permitted, whereas if the hash values ​​match, highly automated driving, fully automated driving, or autonomous driving of the vehicle may be permitted.

[0024] This results in the particular technical advantage that the vehicle can be driven safely, at least partially automatically. The infrastructure can thus efficiently assist the vehicle, and in particular, it can assist the vehicle safely. In other words, the infrastructure can help or assist the vehicle so that it can drive safely, at least partially automatically, based on the infrastructure assistance data.

[0025] This can, for example, reduce the risk of an accident or collision involving the vehicle. Furthermore, it can increase the safety of other road users in the vicinity of the vehicle.

[0026] Infrastructure-based vehicle assistance means, in particular, that the vehicle is provided with infrastructure assistance data. Based on this data, the vehicle can, for example, derive instructions for action. The vehicle can, for example, decide for itself what to do based on this infrastructure assistance data.

[0027] Infrastructure assistance data includes, for example, one or more of the following data elements: control command for at least partially automated control of the lateral and / or longitudinal guidance of the motor vehicle, remote control command for at least partially automated remote control of the lateral and / or longitudinal guidance of the motor vehicle, release command to enable at least partially automated, and in particular fully automated, driving of the motor vehicle for a specific time within a specific road segment, target trajectory for the motor vehicle, target position for the motor vehicle, environmental data representing the environment of the motor vehicle, instructions on what the motor vehicle should do, where the instructions specify, for example, whether the motor vehicle may drive or must stop, an object list of objects in the environment of the motor vehicle, and information about objects in the environment of the motor vehicle.The information includes, for example: speed, location, direction of travel.

[0028] Assisted driving corresponds to automation level 1 according to the definition of the Federal Highway Research Institute (BASt). Partially automated driving corresponds to automation level 2 according to the BASt definition. Highly automated driving corresponds to automation level 3 according to the BASt definition. Fully automated driving corresponds to automation level 4 according to the BASt definition. Autonomous driving corresponds to automation level 5 according to SAE (J3016), where SAE stands for "Society of Automotive Engineers".

[0029] The phrase "at least partially automated driving" encompasses one or more of the following: assisted driving, semi-automated driving, highly automated driving, fully automated driving. The phrase "at least partially automated" therefore includes one or more of the following: assisted, semi-automated, highly automated, fully automated. At least partially automated driving of a motor vehicle includes at least partially automated control of the vehicle's lateral and / or longitudinal steering.

[0030] Assisted driving means that the driver of the vehicle is permanently responsible for either the lateral or longitudinal control of the vehicle. The other driving task (i.e., controlling the longitudinal or lateral movement of the vehicle) is performed automatically. This means that with assisted driving, either the lateral or longitudinal control of the vehicle is automatic.

[0031] Partially automated driving means that in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings) and / or for a certain period of time, the longitudinal and lateral control of the vehicle is automated. The driver does not need to manually control the vehicle's longitudinal and lateral steering. However, the driver must continuously monitor the automated control of the longitudinal and lateral steering in order to be able to intervene manually if necessary. The driver must be ready to take over full control of the vehicle at any time.

[0032] Highly automated driving means that for a certain period of time in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings), the longitudinal and lateral control of the vehicle is automated. The driver does not need to manually control the vehicle's longitudinal and lateral steering. The driver does not need to constantly monitor the automated control of longitudinal and lateral steering in order to intervene manually if necessary. If required, a takeover request is automatically issued to the driver to assume control of longitudinal and lateral steering, with a sufficient time buffer. Therefore, the driver must be potentially capable of taking over control of longitudinal and lateral steering.The limits of automatic control of lateral and longitudinal guidance are automatically detected. With highly automated guidance, it is not possible to automatically create a risk-minimizing state in every initial situation.

[0033] Fully automated driving means that in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings), the longitudinal and lateral control of the vehicle is automated. The driver does not need to manually control the vehicle's longitudinal and lateral movements. The driver does not need to monitor the automated control of longitudinal and lateral movements in order to intervene manually if necessary. Before the automated control of longitudinal and lateral movements ends, the driver is automatically prompted to take over the driving task (controlling the vehicle's longitudinal and lateral movements), with sufficient time to do so. If the driver does not take over the driving task, the system automatically returns to a low-risk state.The limits of automatic control of lateral and longitudinal guidance are automatically detected. In all situations, it is possible to automatically return to a system state with minimal risk.

[0034] Autonomous driving means that in all situations, and not just in one or more specific situations, the longitudinal and lateral guidance of the vehicle is automatically controlled. The driver is no longer needed as a backup. The vehicle can therefore drive without a driver.

[0035] The terms "assist" and "support" can be used synonymously.

[0036] The abbreviation “at least one” means “one or more”.

[0037] The vehicle is, for example, equipped to be driven at least partially automatically.

[0038] In one embodiment of the method according to the first aspect, it is provided that the data processing facilities are each implemented in their own availability zone.

[0039] This results, for example, in the technical advantage that the data processing facilities are implemented efficiently.

[0040] An availability zone is also referred to as an "availability zone" in English.

[0041] In one embodiment of the method according to the first aspect, it is provided that at least three data processing devices are used.

[0042] This results, for example, in the technical advantage that a particularly suitable number of data processing facilities can be used.

[0043] For example, exactly three data processing facilities are used.

[0044] In one embodiment of the method, it is provided that the at least third data processing unit is implemented in the availability zone of one of the two data processing units and is hardware-independent of one of the two data processing units, or is implemented in its own availability zone.

[0045] This results, for example, in the technical advantage that at least the third data processing facility can be implemented efficiently.

[0046] For example, in the case of two data processing facilities, it is planned that each of the data processing facilities is implemented in its own availability zone.

[0047] For example, in the case of two data processing facilities, it is provided that one of the data processing facilities is implemented in the availability zone of the other data processing facility, but is implemented independently of the other of the two data processing facilities in terms of hardware.

[0048] In one embodiment of the method according to the first aspect, it is provided that the respective calculation of the infrastructure assistance data is carried out using dissimilar binary code, each of which was created from the same source code.

[0049] This results, for example, in the technical advantage that the infrastructure assistance data can be calculated efficiently.

[0050] According to this embodiment, the binary code used by the data processing units to determine the infrastructure assistance data is at least partially dissimilar, meaning that at least one or more of the binary codes differ from each other. However, the source code on which the binary code used by the data processing units is based is the same. In other words, the same source code is provided or used as the basis for creating the binary code used by the data processing units to determine the infrastructure assistance data, with at least one, and in particular several or all, of the data processing units using a binary code that is dissimilar compared to the other binary codes.Such dissimilar binary code can be created, for example, by one or more specific compiler settings of a compiler, which are used to compile the binary code from the same source code.

[0051] This results in heterogeneity with regard to the binary code by which the data processing facilities determine the infrastructure assistance data, which is particularly advantageous from a security perspective.

[0052] In one embodiment of the method according to the first aspect, it is provided that a respective configuration of the data processing facilities is described by one or more configuration parameters, wherein the data processing facilities differ from each other in at least one of their configuration parameters.

[0053] This results, for example, in the technical advantage of diversity in data processing equipment, which is particularly beneficial from a security perspective. This is because systematic errors in one of the data processing equipment configurations can be detected, as such errors can lead to the generation of different infrastructure assistance data. In other words, a systematic error in a specific configuration could consistently produce an incorrect result, leading to a different hash value compared to the hash values ​​of data processing equipment that does not exhibit this systematic error due to a different configuration. In this case, the hash values ​​are different, allowing the vehicle to react accordingly, as described above.In other words, despite the presence of a systematic error in at least one of the data processing devices, a minimum level of safety can be achieved for at least partially automated driving of the motor vehicle.

[0054] In one embodiment of the method according to the first aspect, it is provided that one or more configuration parameters are each selected from the following group of configuration parameters: semiconductor mask set ID of a hardware component of the data processing device, generation of a hardware component of the data processing device, manufacturer of a hardware component of the data processing device, number of cores of a virtual machine implemented in the data processing device, memory size, in particular the memory size of a virtual machine implemented in the data processing device, type of a virtual machine implemented in the data processing device, a configuration of an operating system running in the data processing device, type of an operating system running in the data processing device.Kernel version of an operating system running in a cloud infrastructure data processing facility.

[0055] This results, for example, in the technical advantage that particularly suitable configuration parameters can be used.

[0056] In one embodiment of the method according to the second aspect, it is provided that it is stipulated that the received infrastructure assistance data may be used for at least partially automated driving of the motor vehicle if the hash values ​​match.

[0057] This results, for example, in the technical advantage of a particularly high level of safety with regard to at least partially automated driving of the motor vehicle.

[0058] In one embodiment of the method according to the second aspect, it is provided that the setting is carried out by a watchdog.

[0059] This results, for example, in the technical advantage that the setting process can be carried out efficiently. Furthermore, it results in the technical advantage that the setting process, which is a safety-critical step, is carried out by a trustworthy entity from a safety perspective, namely the watchdog.

[0060] Characteristics of the procedure according to the first aspect arise analogously from characteristics of the system according to the third aspect, and vice versa. Statements made in connection with the system according to the third aspect apply analogously to the procedure according to the first aspect, and vice versa.

[0061] Features of the method according to the second aspect result analogously from features of the device according to the fourth aspect and vice versa.

[0062] Statements made regarding the procedure according to the second aspect apply analogously to the device according to the fourth aspect and vice versa.

[0063] The procedure according to the second aspect includes, for example, at least partially automated driving of the motor vehicle based on the received infrastructure assistance data.

[0064] Statements made in connection with the procedure according to the first aspect apply analogously to the procedure according to the second aspect and vice versa.

[0065] The hash values ​​received according to the second aspect procedure are, for example, the hash values ​​calculated using the first aspect procedure.

[0066] For example, it is intended that features of the method according to the first aspect and features of the method according to the second aspect are implemented or provided for in a common embodiment. This means, for example, that in a common embodiment the method according to the first aspect and the method according to the second aspect are carried out.

[0067] The procedure according to the first aspect is, for example, a computer-implemented procedure.

[0068] The method according to the second aspect is, for example, a computer-implemented method.

[0069] The system, according to the third aspect, is, for example, programmed to execute the computer program.

[0070] The device according to the fourth aspect is, for example, programmed to execute the computer program.

[0071] The procedure according to the first aspect is carried out, for example, using the system according to the third aspect.

[0072] The procedure according to the second aspect is carried out, for example, using the device according to the fourth aspect.

[0073] For example, a motor vehicle is provided which includes the device according to the fourth aspect.

[0074] A data processing facility as described is, for example, implemented in a cloud infrastructure.

[0075] Statements made in connection with one data processing facility apply analogously to multiple data processing facilities and vice versa.

[0076] The embodiments and examples described here can be combined in any way, even if this is not explicitly described.

[0077] The invention is explained in more detail below with reference to preferred embodiments. These include: Fig. 1. A flowchart of a procedure according to the first aspect, Fig. 2 a flowchart of a procedure according to the second aspect, Fig. 3 a system according to the third aspect, Fig. 4 a device according to the fourth aspect, Fig. 5 a machine-readable storage medium according to the sixth aspect, Fig. 6 a first block diagram and Fig. 7 a second block diagram.

[0078] The same reference symbols can be used for identical features in the following.

[0079] Fig. Figure 1 shows a flowchart of a procedure for infrastructure-based assistance of a motor vehicle using at least two data processing units, comprising the following steps: Receiving 101 by the data processing units identical environmental data representing an environment of the motor vehicle; Calculating 103 by the data processing units infrastructure assistance data for infrastructure-based assistance of the motor vehicle based on the respective received environmental data; Comparing 105 by the data processing units their own self-calculated infrastructure assistance data with infrastructure assistance data calculated by another of the at least two data processing units to calculate a comparison result; Applying 107 an identical hash function by the data processing units to the respective calculated comparison result to calculate a hash value.Sending 109 of the calculated hash value to the vehicle via the data processing facilities,

[0080] Send 111 through one of the data processing facilities the infrastructure assistance data determined by the one data processing facility to the motor vehicle.

[0081] Fig. Figure 2 shows a flowchart of a procedure for at least partially automated driving of a motor vehicle, comprising the following steps: Receiving 201 of a respective hash value from at least two data processing facilities, Received 201 infrastructure assistance data from one of the data processing facilities, Specify in Article 205 that the received infrastructure assistance data may be used for at least partially automated driving of the motor vehicle, based on the received hash values.

[0082] Fig. Figure 3 shows a system 301 for infrastructure-based assistance of a motor vehicle, comprising: at least two data processing devices 303, 305, each configured to receive the same environmental data representing an environment of the motor vehicle, where data processing facilities 303 and 305 are each set up, To calculate infrastructure assistance data for infrastructure-supported assistance of the motor vehicle based on the respective received environmental data, where data processing facilities 303 and 305 are each set up, to compare the infrastructure assistance data collected by each individual with infrastructure assistance data collected by another of the at least two data processing facilities in order to calculate a comparison result in each case, where data processing facilities 303 and 305 are each set up, to apply the same hash function to each calculated comparison result in order to calculate a hash value in each case, where data processing facilities 303 and 305 are each set up, to send the calculated hash value to the vehicle, wherein one of the data processing facilities 303, 305 is set up to send the self-determined infrastructure assistance data to the motor vehicle.

[0083] Fig. Figure 4 shows a device 401 for at least partially automated driving of a motor vehicle, comprising: a 403 communication facility which is set up, a respective hash value from at least two data processing facilities and To receive infrastructure assistance data from one of the data processing facilities, a processor facility 405, which is configured to specify that the received infrastructure assistance data may be used for at least partially automated driving of the motor vehicle, based on the received hash values.

[0084] Sending and / or receiving, as described, includes, for example, sending and / or receiving via one or more communication networks, such as the internet. A communication network is, for example, a wired communication network, such as an Ethernet network, or a wireless communication network, such as a mobile network or a WLAN network.

[0085] Fig. Figure 5 shows a machine-readable storage medium 501 on which a computer program 503 is stored. The computer program 503 comprises instructions which, when executed by a computer, cause the computer program 503 to perform a procedure according to the first aspect and / or according to the second aspect.

[0086] Fig. Figure 6 shows a first block diagram 601, which illustrates the concepts described here by way of example.

[0087] From a source code 603, using various compiler options 605, a first binary code 607 and a second binary code 609 are created. The two binary codes 607 and 609 are therefore different, i.e., dissimilar.

[0088] Furthermore, a first availability zone 611, a second availability zone 613 and a third availability zone 615 are planned.

[0089] Each of the three availability zones 611, 613, and 615 contains a data processing facility. In the first availability zone, 611, a first data processing facility (617) is implemented. In the second availability zone, 613, a second data processing facility (619) is implemented. In the third availability zone, 615, a third data processing facility is implemented.

[0090] For example, it is intended that the third data processing unit 621 is not implemented in its own availability zone, but in one of the two availability zones 611 or 613, i.e., for example, in the first availability zone 611 or in the second availability zone 613. In this case, the third data processing unit 621 is hardware-independent of the data processing unit of the corresponding availability zone.

[0091] The first data processing unit 617 uses the first binary code 607 to determine infrastructure assistance data based on environment data representing the environment of a motor vehicle.

[0092] The second data processing unit 619 uses the second binary code 609 to determine infrastructure assistance data for the motor vehicle based on the same environment data as the first data processing unit 617.

[0093] The third data processing unit 621 uses the second binary code 609 to determine infrastructure assistance data for the motor vehicle based on the same environment data as the first and second data processing units 617, 619.

[0094] The first data processing unit 617 sends the self-determined infrastructure assistance data to the second data processing unit 619 and to the third data processing unit 621.

[0095] The second data processing unit 619 does not send its self-determined infrastructure assistance data to the first data processing unit 617, nor does it send it to the third data processing unit 621.

[0096] The third data processing unit 621 sends the self-determined infrastructure assistance data to the first data processing unit 617.

[0097] The infrastructure assistance data sent to the relevant data processing facilities is received by the relevant data processing facilities.

[0098] The first data processing unit 617 compares the infrastructure assistance data it has collected itself with the infrastructure assistance data collected by the third data processing unit 621.

[0099] The second data processing unit 619 compares the infrastructure assistance data it has collected itself with the infrastructure assistance data collected by the first data processing unit 617.

[0100] The third data processing unit 621 compares the infrastructure assistance data it has collected itself with the infrastructure assistance data collected by the first data processing unit 617.

[0101] This comparison is symbolically represented by a function block 623.

[0102] Based on the comparison, a comparison result is calculated. Each of the three data processing units 617, 619, and 621 then applies the same hash function to the comparison result to calculate a hash value. The calculated hash values ​​are then sent to a motor vehicle 625.

[0103] Specifically, the first data processing unit 617 sends a first hash value 627 to the motor vehicle 625.

[0104] The second data processing unit 619 sends a second hash value 629 to the motor vehicle 625.

[0105] The third data processing unit 621 sends a third hash value 631 to the motor vehicle 625.

[0106] On the vehicle side, the three hash values ​​627, 629, 631 are received and compared with each other by a watchdog 633.

[0107] It is further stipulated that one of the data processing units 617, 619, 621 will send the self-collected infrastructure assistance data to the motor vehicle 625. Fig. For example, in section 6, this is the first data processing unit 617, which sends the infrastructure assistance data 635 to the motor vehicle 625. It may also be provided that, additionally or instead, the second and / or third data processing unit 619, 621 send the respective infrastructure assistance data they have determined to the motor vehicle 625.

[0108] The watchdog 633 determines, based on the comparison of the received hash values ​​627, 629, 631, whether the received infrastructure assistance data 635 may be used for at least partially automated driving of the motor vehicle 625 or not.

[0109] According to function block 637, so-called "E2E monitoring" is performed. "E2E" stands for "end-to-end." "Monitoring" means "monitoring." Thus, "E2E monitoring" stands for "end-to-end monitoring."

[0110] E2E monitoring serves in particular to 1. to verify the correct transmission of the received infrastructure assistance data 635 from the respective data processing device to the motor vehicle 625, and / or 2. If the watchdog 633 returns "Ok" (since all hash values ​​match), the received and verified infrastructure assistance data 635 should be forwarded to the vehicle control unit for final implementation.

[0111] The received infrastructure assistance data 635 can therefore be used, for example, for one or more at least partially automated driving functions 639 of the motor vehicle 625.

[0112] Fig. Figure 7 shows a second block diagram 701, which illustrates the concepts described here by way of example.

[0113] The second block diagram 701 is based on the first block diagram 601 of the Fig. 6.

[0114] As an example of obtaining infrastructure assistance data, it is provided that the data processing units 617, 619, and 621, according to a function block 703, each perform a fusion of the received environmental data. This is provided, for example, when the environmental data includes environmental sensor data from multiple environmental sensors that have recorded the vehicle's surroundings. For example, video data can be fused with radar data and / or LiDAR data.

[0115] Based on the fusion, for example, an object list containing objects in the vicinity of the vehicle can be determined by the data processing units 617, 619, and 621. This object list is thus an example of infrastructure assistance data as described. This object list can then be sent, for example, from the first data processing unit 617 to the vehicle 625, whereby the watchdog 633 on the vehicle side determines whether or not these objects may be used for at least partially automated driving of the vehicle 625. This determination is carried out, as described, based on a comparison of the three hash values ​​627, 629, and 631.

[0116] In summary, the concepts described here are based on the premise that data, in this case infrastructure assistance data, originating from an infrastructure—specifically, data processing facilities implemented, for example, in a cloud infrastructure—can be reliably verified within the vehicle and, if the verification is successful, used for at least partially automated driving. It is specifically intended that the calculation or determination of the infrastructure assistance data be performed redundantly. This is achieved by using at least two, and preferably three, data processing facilities.

[0117] For example, it is planned that at least partially different binary code, created from the same source code, will be used to calculate the infrastructure assistance data.

[0118] Furthermore, it is planned, for example, that the data processing facilities will have at least partially different configurations.

[0119] The infrastructure assistance data collected is cross-compared by the data processing units, with each comparison result forming the basis for a hash calculation. In other words, the same hash function is applied by the data processing units to their own comparison result to calculate a hash value. These hash values ​​are then sent to the vehicle.

[0120] For example, the hash function is a checksum.

[0121] The vehicle is equipped with ASIL-qualified hardware against which incoming hash values ​​can be compared. If these values ​​are identical, the infrastructure assistance data received by the vehicle, particularly in parallel with the hash values, can be safely used for at least partially automated driving, i.e., for at least partially automated driving functions.

[0122] The abbreviation "ASIL" stands for "Automotive Safety Integrity Level," which can be translated into German as "automotive Sicherheitsintegritätslevel." "Automotive Safety Integrity Level" is a key component of the ISO 26262 standard. ASIL distinguishes between four different ASIL risk levels, designated ASIL-A, ASIL-B, ASIL-C, and ASIL-D. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] WO 2023 / 004184 A1

[0002] EP 3 674 920 A1

[0003] WO 2022 / 081421 A1

[0004]

Claims

[1] Method for infrastructure-based assistance of a motor vehicle (625) using at least two data processing devices, comprising the following steps: Received (101) by the data processing facilities of the same environment data, which represent an environment of the motor vehicle (625), Calculating (103) by the data processing facilities of infrastructure assistance data (635) for infrastructure-supported assistance of the motor vehicle (625) based on the respective received environmental data, Comparing (105) the infrastructure assistance data (635) obtained by the data processing facilities themselves with infrastructure assistance data (635) obtained by another of the at least two data processing facilities (635) in order to calculate a comparison result in each case, Applying (107) the same hash function by the data processing facilities to each calculated comparison result in order to calculate a hash value in each case, Sending (109) the calculated hash value to the motor vehicle (625) by the data processing facilities, Sending (111) the infrastructure assistance data (635) determined by one of the data processing units to the motor vehicle (625). [2] Method according to claim 1, wherein the data processing facilities are each implemented in a separate availability zone. [3] Method according to claim 1 or 2, wherein at least three data processing devices are used. [4] Method according to claim 3 with regard to the availability zones of the two data processing units as far as referenced back to claim 2, wherein the at least third data processing unit is implemented in the availability zone of one of the two data processing units and is hardware independent of one of the two data processing units or is implemented in its own availability zone. [5] Method according to any of the preceding claims, wherein the respective calculation of the infrastructure assistance data (635) is carried out using dissimilar binary code (607, 609) which was each created from the same source code (603). [6] Method according to one of the preceding claims, wherein a respective configuration of the data processing equipment is described by one or more configuration parameters, wherein the data processing equipment differs from each other in at least one of its configuration parameters. [7] Method according to claim 6, wherein one or more configuration parameters are selected from the following group of configuration parameters: semiconductor mask set ID of a hardware component of the data processing device, generation of a hardware component of the data processing device, manufacturer of a hardware component of the data processing device, number of cores of a virtual machine implemented in the data processing device, memory size, in particular memory size of a virtual machine implemented in the data processing device, type of a virtual machine implemented in the data processing device, a configuration of an operating system running in the data processing device, type of an operating system running in the data processing device, kernel version of an operating system running in the cloud infrastructure data processing device. [8] Methods for at least partially automated driving of a motor vehicle (625), comprising the following steps: Receiving (201) a respective hash value from at least two data processing facilities, Receiving (203) infrastructure assistance data (635) from one of the data processing facilities, Specify (205) that the received infrastructure assistance data (635) may be used for at least partially automated driving of the motor vehicle (625) based on the received hash values ​​(627, 629, 631). [9] Method according to claim 8, wherein it is specified that the received infrastructure assistance data (635) may be used for at least partially automated driving of the motor vehicle (625) if the hash values ​​(627, 629, 631) match. [10] Method according to claim 8 or 9, wherein the setting is carried out by a watchdog (633). [11] System (301) for infrastructure-based assistance of a motor vehicle (625), comprising: at least two data processing devices (303, 305), each configured to receive the same environment data representing an environment of the motor vehicle (625), where the data processing facilities (303, 305) are each set up, To calculate infrastructure assistance data (635) for infrastructure-supported assistance of the motor vehicle (625) based on the respective received environmental data, where the data processing facilities (303, 305) are each set up, to compare the infrastructure assistance data (635) determined by each individual with infrastructure assistance data (635) determined by another of the at least two data processing facilities (303, 305) in order to calculate a comparison result in each case, where the data processing facilities (303, 305) are each set up, to apply the same hash function to each calculated comparison result in order to calculate a hash value in each case, where the data processing facilities (303, 305) are each set up, to send the calculated hash value to the motor vehicle (625), wherein one of the data processing facilities (303, 305) is set up to send the self-determined infrastructure assistance data (635) to the motor vehicle (625). [12] Device (401) for at least partially automated driving of a motor vehicle (625), comprising: a communication device (403) which is set up to obtain a respective hash value from at least two data processing devices and To receive infrastructure assistance data (635) from one of the data processing facilities, a processor unit (405) which is configured to specify that the received infrastructure assistance data (635) may be used for at least partially automated driving of the motor vehicle (625) based on the received hash values ​​(627, 629, 631). [13] Computer program (503) comprising instructions which, when executed by a computer, cause the computer to execute a method according to any one of claims 1 to 10. [14] Machine-readable storage medium (501) on which the computer program (503) according to claim 13 is stored.

Images