Method and system for operating at least a partially automated motor vehicle in an infrastructure environment

Abstract

A method for operating a partially automated motor vehicle in an infrastructure environment, particularly a parking environment, is proposed. Operation is controlled and monitored by an external system. The method comprises at least the following steps: • Calculation of monitoring results for safety-relevant functions of the system by at least two parallel-operated safety servers and forwarding of the monitoring results to a control unit. The control unit compares the monitoring results. If the monitoring results are inconsistent, a fault message is triggered, which at least partially shuts down the system and, in particular, stops the at least partially automated vehicle. • Generating a random code by the control unit and storing the generated random code; • Retrieval of the random code by the security servers; • Generating a human-readable task using the random code and forwarding the task to an operator of the infrastructure environment; and • Input and forwarding of a solution to the task by the operator to the security servers and forwarding of results calculated in the security servers using the solution to the control unit; For each of the security servers, the control unit compares the result calculated by the respective security server with a response calculated using the random code. If all results are consistent with the answer calculated using the random code, the system resumes operation of the at least partially automated motor vehicle in the infrastructure environment. If at least one result is inconsistent with the answer calculated using the random code, the system remains switched off.

Description

[0001] The invention relates to a method and a system for operating an at least partially automated motor vehicle in an infrastructure environment. The invention further relates to a computer program. State of the art

[0002] In known methods or systems for “Automated Valet Parking” (AVP), a motor vehicle is guided safely from a first position to a second position on publicly accessible grounds without human intervention.

[0003] The patent application DE 10 2012 222 562 A1 discloses a system for managed parking areas for transferring a motor vehicle from a starting position to a destination position.

[0004] There are known AVP systems that are infrastructure-based. This means that the corresponding parking environments (e.g., parking garages) are equipped with a highly networked, distributed infrastructure system responsible for environmental perception, vehicle guidance, parking management, and security. Compatible AVP vehicles are equipped with a communication interface for data exchange with the infrastructure system. This enables the AVP vehicle to be guided and thus remotely controlled via the infrastructure system. For communication with end customers, the infrastructure is equipped, for example, with an interface connected to an AVP backend. Data (in the form of messages) can be sent and received to and from the infrastructure (AVP garage) via this interface. A message could, for example, contain a new parking request or system diagnostic data.

[0005] A garage management server can now perform non-security-relevant functions, such as receiving / rejecting new parking requests, path planning, vehicle management, parking space management, etc.

[0006] Secondly, safety-relevant functions are calculated in parallel on multiple (e.g., two) safety servers. These servers can detect anomalies in the system through monitoring functions. The monitoring results of each operating cycle can be sent from each safety server to a PLC (programmable logic controller). The PLC compares the results from the two safety servers and triggers a fault flag if the results are inconsistent. This fault flag causes a partial system shutdown, which stops all active vehicles and prevents any further driving requests until the flag is manually reset by a qualified operator.

[0007] Only after a reset can further driving orders be initiated by end customers. This is not ideal, as an operator must be present in the parking garage and may need physical access to a manual reset device (e.g., a reset button). Furthermore, this reset may be required every time a new software version is deployed to the AVP garage.

[0008] CN 111775954 A discloses an emergency handling procedure for the breakdown of a parking service vehicle. The system includes, among other things, the detection of a malfunction and the transmission of the fault information and the parking space location to a parking manager, who must then intervene manually.

[0009] KR 102560023 B1 discloses a self-diagnostic system for a parking control system that enables automatic recovery and timely notification of errors and failures by monitoring the control web server.

[0010] KR 101817219 B1 discloses an automatic fault detection system for a mechanical parking device for the rapid rectification of faults in mechanical parking devices, wherein the system includes, among other things, a programmable controller that is connected to each of the mechanical parking devices, analyzes captured data inputs from sensors and outputs a fault signal to an external logic controller. Disclosure of the invention

[0011] It can therefore be considered an object of the invention to provide a reliable and efficient method for operating an at least partially automated motor vehicle in an infrastructure environment, particularly in a parking environment, wherein the operation is controlled and monitored by an external system. According to the invention, in particular, it can be avoided that a manual reset is required in the event of a malfunction.

[0012] It can be considered a further object of the invention to provide a suitable system for operating an at least partially automated motor vehicle in an infrastructure environment, in particular in a parking environment, which exhibits high efficiency and reliability.

[0013] According to a first aspect of the invention, a method for operating an at least partially automated motor vehicle in an infrastructure environment, in particular in a parking environment, is proposed. The operation is controlled and monitored by an external system. The method comprises at least the following steps: • Calculation of monitoring results for safety-relevant functions of the system by at least two parallel-operated safety servers and forwarding of the monitoring results to a control unit. The control unit compares the monitoring results. If the monitoring results are inconsistent, a fault message is triggered, which at least partially shuts down the system and, in particular, stops the at least partially automated vehicle. • Generating a random code by the control unit and storing the generated random code; • Retrieval of the random code by the security servers; • Generating a human-readable task using the random code and forwarding the task to an operator of the infrastructure environment; and • Input and forwarding of a solution to the task by the operator to the security servers and forwarding of results calculated in the security servers using the solution to the control unit;

[0014] A human-readable task, in this context, is understood as an instruction that allows a human operator to convert given information (e.g., a number or a sequence of numbers) into other information in a defined and unambiguous way. This other information represents the solution to the task. Simple arithmetic procedures are preferably used for this purpose.

[0015] For each of the security servers, the control unit now compares the result calculated by the respective security server with a response calculated using the random code.

[0016] If all results are consistent with the answer calculated using the random code, the system resumes operation of the at least partially automated motor vehicle in the infrastructure environment.

[0017] If at least one result is inconsistent with the answer calculated using the random code, the system remains switched off.

[0018] The procedure described in the first aspect allows for efficient verification of the system's error-free operation and the ability to resume after a malfunction without requiring manual intervention on-site. This is achieved by generating a random code and a human-readable task based on that code. By comparing the solution to this task, sent by an infrastructure operator (e.g., from a remote backend), to the security servers, each security server independently compares the solution to a result calculated within that server itself. This verifies the security servers' functionality and allows the system to be reset and restarted without requiring manual intervention on-site.

[0019] In a preferred embodiment, generating a human-readable task using the random code can involve formulating a computational problem, where the random code is then modified based on the problem. The random code can, for example, be represented as a number or converted into a number, particularly a decimal number. The task can, for instance, include instructions to perform a specific arithmetic operation on the random code or number.

[0020] The random code can, in particular, comprise a sequence of numbers or be converted into a sequence of numbers to generate a human-readable task. The arithmetic problem can be related to this sequence of numbers.

[0021] In an example, the computational task might involve manipulating each individual digit of the number sequence in a defined way and / or performing an arithmetic operation on each digit of the number sequence and / or combining all and / or specific digits of the number sequence using a mathematical formula. The solution could be a solution number, for example, the digital root of all digits in the number sequence, or a solution sequence, for example, a sequence in which each digit is increased by a value n compared to the original number sequence.

[0022] In this way, a particularly quick and intuitive task is advantageously created, which provides a solution that can be compared particularly efficiently with the results of the security servers.

[0023] In a preferred implementation, if a result is inconsistent with the answer calculated using the random code, a new task and / or a new random code are generated and forwarded to an operator of the infrastructure environment. The number of failed attempts can be limited (for example, to 10 attempts), so that a manual reset is required after reaching the limit.

[0024] A second aspect proposes a system for operating at least a partially automated motor vehicle in an infrastructure environment, particularly a parking environment. Operation is carried out according to a procedure as described in the first aspect, with the system controlling and monitoring the operation. The system comprises • a control unit; • at least two parallel-operated security servers, each designed to calculate monitoring results of security-relevant functions of the system and to forward the monitoring results to the control unit.

[0025] The control unit is designed to compare the monitoring results and, if the monitoring results are inconsistent, to trigger a fault message, thereby at least partially shutting down the system and, in particular, stopping the at least partially automated motor vehicle.

[0026] The control unit is also designed to generate a random code. This generated random code can be stored, for example, on at least two security servers. Alternatively, the control unit can store the generated random code internally in a memory area that can be read by the servers.

[0027] The security servers are each trained to generate a human-readable task using random code and forward the task to an operator of the infrastructure environment.

[0028] The security servers are also each trained to receive an input of a solution to the task from the operator and to forward the results calculated using the solution to the control unit.

[0029] The control unit is designed to compare a result calculated by each security server with a response calculated using the random code.

[0030] If all results are consistent with the answer calculated using the random code, the system can resume operation of the at least partially automated motor vehicle in the infrastructure environment.

[0031] If at least one result is inconsistent with the answer calculated using the random code, the system remains switched off.

[0032] The system can be configured as an AVP system for a parking environment. For this purpose, it includes, in particular, an AVP backend located remotely from the parking environment. Furthermore, the system includes, in particular, an infrastructure system located within the parking environment, comprising a parking management server, at least two independent security servers, a control unit, environmental sensors, and a communication infrastructure for sending and / or receiving data to the at least partially automated vehicle and / or to the AVP backend, and optionally a device for manually resetting the system, e.g., a reset button.

[0033] The AVP backend can be specifically designed to receive the human-readable task as the operator of the infrastructure environment and to receive the solution and forward it to the control unit.

[0034] The control unit can be designed, in particular, as a programmable logic controller (PLC). Alternatively, the control unit can be designed as a pure software module, which, for example, runs on a central processing unit.

[0035] According to a third aspect, a computer program is proposed, comprising instructions which, when executed by a computer, cause it to perform a procedure according to the first aspect.

[0036] A fourth aspect proposes a machine-readable storage medium on which the computer program is stored according to the third aspect.

[0037] The phrase "at least partially automated" includes one or more of the following cases: assisted driving, semi-automated driving, highly automated driving, fully automated driving of a motor vehicle.

[0038] Assisted driving means that the driver of the vehicle is permanently responsible for either the lateral or longitudinal control of the vehicle. The other driving task (i.e., controlling the longitudinal or lateral movement of the vehicle) is performed automatically. This means that with assisted driving, either the lateral or longitudinal control of the vehicle is automatic.

[0039] Partially automated driving means that in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings) and / or for a certain period of time, the longitudinal and lateral control of the vehicle is automated. The driver does not need to manually control the vehicle's longitudinal and lateral steering. However, the driver must continuously monitor the automated control of the longitudinal and lateral steering in order to be able to intervene manually if necessary. The driver must be ready to take over full control of the vehicle at any time.

[0040] Highly automated driving means that for a certain period of time in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings), the longitudinal and lateral control of the vehicle is automated. The driver does not need to manually control the vehicle's longitudinal and lateral steering. The driver does not need to constantly monitor the automated control of longitudinal and lateral steering in order to intervene manually if necessary. If required, a takeover request is automatically issued to the driver to assume control of longitudinal and lateral steering, with a sufficient time buffer. Therefore, the driver must be potentially capable of taking over control of longitudinal and lateral steering.The limits of automatic control of lateral and longitudinal guidance are automatically detected. With highly automated guidance, it is not possible to automatically create a risk-minimizing state in every initial situation.

[0041] Fully automated driving means that in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings), the longitudinal and lateral control of the vehicle is automated. The driver does not need to manually control the vehicle's longitudinal and lateral movements. The driver does not need to monitor the automated control of longitudinal and lateral movements in order to intervene manually if necessary. Before the automated control of longitudinal and lateral movements ends, the driver is automatically prompted to take over the driving task (controlling the vehicle's longitudinal and lateral movements), with sufficient time to do so. If the driver does not take over the driving task, the system automatically returns to a low-risk state.The limits of automatic control of lateral and longitudinal guidance are automatically detected. In all situations, it is possible to automatically return to a system state with minimal risk.

[0042] Driverless control means that, regardless of the specific application (for example, driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings), the longitudinal and lateral control of the vehicle is automated. The driver does not need to manually control the vehicle's longitudinal and lateral movements. The driver does not need to monitor the automated control of longitudinal and lateral movements in order to intervene manually if necessary. Thus, the longitudinal and lateral movements of the vehicle are automatically controlled for all road types, speed ranges, and environmental conditions. The driver's entire driving task is therefore automated. The driver is no longer required.The vehicle can therefore travel from any starting position to any destination position without a driver. Potential problems are solved automatically, without driver intervention.

[0043] Remote control of a motor vehicle means that the vehicle's lateral and longitudinal steering is controlled remotely. This means, for example, that remote control signals are sent to the vehicle to control its lateral and longitudinal steering. Remote control is carried out, for example, using a remote control device.

[0044] The abbreviation "AVP" stands for "Automated Valet Parking" and can be translated into German as "automatischer Parkservice" (automated parking service). An AVP process includes, for example, at least highly automated driving of the vehicle from a drop-off zone (also called a drop-off point) to a parking position, and at least highly automated driving of the vehicle from a parking position to a pick-up point (also called a pick-up zone). At the drop-off point, i.e., the driver hands over the vehicle for an AVP process. At a pick-up point, i.e., the pick-up zone, the vehicle is retrieved after the AVP process has been completed. An AVP process therefore starts at the drop-off zone and ends at the pick-up zone.

[0045] The vehicle can be specifically equipped as an AVP vehicle. An AVP vehicle is a vehicle that can participate in an AVP process.

[0046] An AVP process can be one of the following AVP types: AVP Type 1, AVP Type 2, and AVP Type 3. However, the AVP types can also change within a single AVP process. This means, for example, that part of an AVP process is carried out according to AVP Type 1, and another part is carried out according to AVP Type 2 or AVP Type 3. This also means, for example, that an AVP process can be divided into sub-AVP processes, each carried out according to one of AVP Types 1, 2, or 3.

[0047] AVP Type 1 designates a vehicle-centric AVP process. The primary responsibility for the AVP process lies with the vehicle.

[0048] AVP type 2 characterizes an infrastructure-centric AVP process. The main responsibility for the AVP process lies with the infrastructure, i.e., the AVP system.

[0049] AVP Type 3 denotes a vehicle-infrastructure-shared AVP process. Here, primary responsibility for the AVP process is shared between the vehicle and the AVP system.

[0050] An AVP process includes the following operations or functions: 1. Determine a target position for the motor vehicle that lies within the parking lot. 2. Planning a route from a starting position encompassed by the parking lot to the destination position. 3. Detecting an object and / or an event, and reacting accordingly to a detected object and / or a detected event. 4. Locating the vehicle within the parking lot. 5. Calculate a target trajectory for the motor vehicle based on the planned route. 6. Controlling the lateral and longitudinal guidance of the motor vehicle based on the calculated target trajectory.

[0051] The following table indicates which of these processes or functions are performed by the motor vehicle or the infrastructure-side AVP system, depending on the AVP type, where "I" stands for "infrastructure", i.e., the infrastructure-side AVP system, and "K" for "motor vehicle", so that "I" indicates that the process is performed by the AVP system, and "K" indicates that the process is performed by the motor vehicle: functions AVP Type 1 AVP Type 2 AVP Type 3 Determining a target position for the motor vehicle that lies within the parking lot. I & K I I Planning a route from a starting position encompassed by the parking lot to the destination position. K I I Detecting an object and / or an event, as well as reacting appropriately to a detected object and / or a detected event. K(& optionalI) I I & K Locating the vehicle within the parking lot. K I K Calculating a target trajectory for the motor vehicle based on the planned route. K I K Controlling the lateral and longitudinal guidance of the motor vehicle based on the calculated target trajectory. K K K

[0052] The table above specifies for each function, for each AVP type, whether the function is performed by the infrastructure (i.e., by the infrastructure-side AVP system) or by the vehicle. In some cases, it may be intended that the function is performed by both the AVP system and the vehicle.

[0053] Regarding object and event detection for AVP type 1, it may optionally be provided that, in addition to the motor vehicle, the infrastructure's AVP system also performs this function.

[0054] The AVP types 1, 2 and 3 described here are further described in detail in ISO 23374. Brief description of the characters

[0055] With reference to the attached figures, embodiments of the invention are described in detail. Fig. Figure 1 shows a system designed as an AVP system for operating an at least partially automated motor vehicle according to an embodiment of the invention. Fig. 2 represents the temporal sequence of information flow in the system of Fig. 1 dar. Fig. Figure 3 shows a flowchart of a process according to one possible embodiment of the invention. Fig. Figure 4 shows a machine-readable storage medium. Preferred embodiments of the invention

[0056] In the following description of exemplary embodiments of the invention, identical elements are designated by the same reference numerals, and a repeated description of these elements may be omitted. The figures represent the subject matter of the invention only schematically.

[0057] Fig.Figure 1 schematically and in a simplified manner shows a system configured as an AVP system 10 for operating a partially automated motor vehicle, where the motor vehicle in this example is configured as an AVP vehicle 60. The AVP system 10 comprises an AVP backend 30, a parking management server 22, two safety servers 24 and 26, and a control unit configured as a PLC 28. Furthermore, the AVP system 10 includes environmental sensors 40, such as cameras and / or lidar sensors, as well as one or more access points 50 through which an AVP vehicle 60 can communicate with the AVP system 10. A manual control element 29 is also provided, with which the system 10 can be reset. The AVP backend 30 can be spatially separated from a parking infrastructure 20 operated by the AVP system 10.The parking management server 22, the security servers 24 and 26, the PLC 28, the environmental sensors 40, the access point 50, and the manual control element 29 can be spatially configured or arranged within the parking infrastructure 20 operated by the AVP system 10. The data connections between the various components (represented by arrows in the figure) can be wired or wireless and, for example, implement known network protocols or data transmission standards. The communication between the various components, which are in . Fig. 1 is preferably encrypted using state-of-the-art algorithms.

[0058] Safety servers 24 and 26 are each configured to calculate monitoring results of safety-relevant functions of the AVP system 10 and can forward these monitoring results to the PLC 28. The PLC 28 is configured to compare the monitoring results and, if the results are inconsistent, to trigger a fault message, thereby at least partially shutting down the AVP system 10 and stopping the AVP vehicle 60.

[0059] PLC 28 is configured to generate a random code and store it in a memory area that is read by the two security servers 24 and 26. Security servers 24 and 26 are each configured to generate a human-readable task using the random code and forward the task to the AVP backend 30, and thus to an operator of the infrastructure environment. Security servers 24 and 26 can each receive an input solution to the task from the AVP backend 30 and forward the results calculated using this solution to PLC 28.

[0060] The PLC 28 can now compare a result calculated by each security server 24 or 26 with a response calculated using the random code, whereby if both results are consistent with the response calculated using the random code, the AVP system resumes operation of the AVP vehicle 60 in the infrastructure environment 20, and if at least one result is not consistent with the response calculated using the random code, the AVP system 10 remains switched off.

[0061] Fig. Figure 2 shows the temporal sequence of information flow between different components of system 10. Fig. 1, namely the PLC 28, the security servers 24 and 26, the parking management server 22 and the AVP backend 30. The time axis t runs downwards in the representation.

[0062] In event 212, PLC 28 detects an anomaly while monitoring safety functions and triggers an internal fault condition, for example by setting a corresponding flag. This causes the operation of AVP vehicle 60 to be interrupted by the AVP system.

[0063] The PLC now generates a random code and sends it in event 214 to both security servers 24 and 26.

[0064] In event 216, both security servers 24 and 26 generate the same human-readable task using the random code.

[0065] In 218, the security servers 24 and 26 send the human-readable task to the park management server 22.

[0066] In 220, the parking management server 22 sends the human-readable task to the (e.g., remotely trained) AVP backend 30.

[0067] In 222, the AVP backend receives an input or response (for example, from an operator) that corresponds to a solution to the human-readable task.

[0068] In 224, the AVP backend 30 sends the solution to the park management server 22.

[0069] In 226, the parking management server 22 sends the solution to each of the security servers 24 and 26.

[0070] In 228, each of the security servers 24, 26 calculates a result, for example a reverse transformation, using the solution and the human-readable task.

[0071] In 230, both security servers 24 and 26 send their respective results to the PLC 28.

[0072] In step 232, PLC 28 compares the results with the random code or with a response calculated using the random code. If all results are consistent, the fault condition is cleared.

[0073] Fig.Section 3 describes a possible sequence of events according to the first aspect.

[0074] In step 310, PLC 28 detects that an anomaly exists and terminates the operation of the AVP system 10. PLC 28 generates a random code, in particular a randomly generated number, and stores it in memory blocks that can be read by both security servers 24 and 26.

[0075] In step 312, the security servers 24 and 26 each read the random code from the corresponding memory block of the PLC 28 (the memory addresses are statically assigned).

[0076] In step 314, security servers 24 and 26 each convert the random code into a human-readable task. For example, the random code might be in the form of a hexadecimal value (e.g., 0x2f485a7149b9). The human-readable task could, for instance, be a decimal number derived from the random code or a sequence of digits in the decimal system (e.g., "5 1 9 8 7 8 0 1 5 2 4 6 6 5"). This could be transmitted, for example, as a string generated by converting the random code (hexadecimal value) to the decimal system and adding a space between each digit. Furthermore, the human-readable task includes an instruction to modify or convert the derived number sequence. A written instruction for the human operator is generated and transmitted along with the string representing the digit sequence. (e.g., "Increase each digit by one.")“or “What is the sum of all the digits?” or “Multiply each digit by 2”, etc.).

[0077] In step 316, the security servers 24 and 26 each transmit the human-readable task, in particular via the Garage Management Server 22, to the AVP backend 30.

[0078] In step 318, the AVP backend 30 presents the human-readable task to the operator and receives input as a response. For example, a human operator can enter the response via a backend dashboard.

[0079] In step 320, the AVP backend 30 sends the operator response to the parking management server 22. The parking management server 22 forwards the operator's response to both security servers 24 and 26.

[0080] In step 322, security servers 24 and 26 each receive the operator's response via the parking management server 22 and perform a transformation (backward calculation), generating a result. For example, if the human-readable task was: "Increment each digit of the number sequence '5 1 9 8 7 8 0 1 5 2 4 6 6 5' by one," each digit of the response is replaced with a one, and then the result is converted into its equivalent hexadecimal value.

[0081] In step 324, the security servers each send the result of the transformation to the PLC. For example, as follows: • Result = Operator response (Hex) XOR 0×00ffffffffffffffffff

[0082] In step 326, the PLC checks the results obtained for each by comparing them with the original random code or with an answer calculated using the random code.

[0083] If the results from both security servers 24 and 26 are consistent with the response calculated using the random code, and no further error condition exists, in step 328, system 10 will resume operation of the at least partially automated vehicle 60 in the infrastructure environment 20. System 10 will then return to normal operation. A result can be considered consistent, for example, if (in the previous example): • 0x000ffffffffffffff == Result XOR Random Code

[0084] If the result from one or both security servers 24, 26 is not consistent with the response calculated using the random code, the system remains shut down according to step 330 and a new random code can be generated or the task can be repeated.

[0085] The safety PLC 28 can limit the maximum number of consecutive failed attempts to a predefined number (e.g., 10). If all remaining attempts are unsuccessful, the safety PLC will no longer generate 28 new random codes or tasks. The safety PLC can then no longer be reset remotely, for example, using the manual control element 29.

[0086] Fig. Figure 4 shows a machine-readable storage medium 301 on which a computer program 303 is stored. The computer program 303 comprises instructions which, when executed by a computer, cause the computer program 303 to perform a procedure according to the first aspect. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2012 222 562 A1

[0003] CN 111775954 A

[0008] KR 102560023 B1

[0009] KR 101817219 B1

[0010]

Claims

[1] Method for operating at least a partially automated motor vehicle (60) in an infrastructure environment (20), in particular in a parking environment, wherein the operation is controlled and monitored by an external system (10), comprising at least the following steps: • Calculating monitoring results of safety-relevant functions of the system (10) by at least two parallel-operated safety servers (24, 26) and forwarding the monitoring results to a control unit (28), wherein the control unit (28) compares the monitoring results and, in the case that the monitoring results are not consistent, triggers a fault message, thereby at least partially shutting down the system (10) and, in particular, stopping the at least partially automated motor vehicle (60); • Generating a random code by the control unit (28) and storing the generated random code; • Retrieval of the random code by the security servers (24, 26); • Generating a human-readable task using the random code and forwarding the task to an operator (30) of the infrastructure environment; and • Input and forwarding of a solution to the task by the operator to the security servers (24, 26) and forwarding of results calculated in the security servers (24, 26) using the solution to the control unit (28); • For each of the security servers (24, 26): Comparing the result calculated by the respective security server (24, 26) with a response calculated by the control unit (28) using the random code, • wherein, in the case that all results are consistent with the response calculated using the random code, the system (10) resumes operation of the at least partially automated motor vehicle (60) in the infrastructure environment (20), and in the case that at least one result is not consistent with the response calculated using the random code, the system (10) remains switched off. [2] Method according to claim 1, wherein generating a human-readable task by means of the random code comprises formulating a computational task, wherein the random code is to be changed based on the computational task. [3] Method according to claim 2, wherein the random code comprises a sequence of numbers or is converted into a sequence of numbers to generate the human-readable task, wherein the arithmetic task is related to the sequence of numbers and the solution is a solution number or a sequence of solution numbers. [4] Method according to claim 3, wherein the calculation task comprises manipulating each individual digit of the number sequence in a defined manner and / or performing a calculation operation on each digit of the number sequence and / or linking all and / or certain digits of the number sequence together by means of a calculation rule. [5] Method according to any of the preceding claims, wherein, in the event that a result is inconsistent with the response calculated using the random code, a new task and / or a new random code is / are generated and forwarded to an operator of the infrastructure environment. [6] System (10) for operating an at least partially automated motor vehicle (60) in an infrastructure environment (20), in particular in a parking environment, according to a method according to any one of claims 1 to 5, wherein the operation is controlled and monitored by the system (10), comprising • a control unit (28); • at least two parallel-operated safety servers (24, 26), each configured to calculate monitoring results of safety-relevant functions of the system (10) and to forward the monitoring results to the control unit (28), wherein the control unit (28) is configured to compare the monitoring results and, in the event that the monitoring results are inconsistent, to trigger a fault message, thereby at least partially shutting down the system (10) and, in particular, stopping the at least partially automated motor vehicle (60); and • wherein the control unit (28) is configured to generate and store a random code, wherein the generated random code is retrievable from the security servers (24, 26); and • wherein the security servers (24, 26) are each configured to generate a human-readable task using the random code and to forward the task to an operator (30) of the infrastructure environment (20), and to receive an input of a solution to the task from the operator (30) and to forward results calculated using the solution to the control unit (28), • wherein the control unit (28) is configured to compare for each security server (24, 26) a result calculated by the respective security server (24, 26) with a response calculated using the random code, • wherein, in the event that all results are consistent with the response calculated using the random code, the system (10) resumes operation of the at least partially automated motor vehicle (60) in the infrastructure environment (20), and • where, in the event that at least one result is inconsistent with the answer calculated using the random code, the system (10) remains switched off. [7] System according to claim 6, wherein the system (10) is configured as an AVP system for a parking environment, comprising: an AVP backend (30) as operator, in particular located remotely from the parking environment; and an infrastructure system located within the parking environment comprising a parking management server (22), at least two independent security servers (24, 26), a control unit (28), environmental sensors (40), and a communication infrastructure (50) for sending and / or receiving data to the at least partially automated motor vehicle (60) and / or to the AVP backend (30), and optionally a device (29) for manually resetting the system. [8] System according to claim 7, wherein the AVP backend (30) is configured to receive the human-readable task as operator of the infrastructure environment and to receive the solution and forward it to the control unit (28). [9] System according to any one of claims 6 to 8, wherein the control unit (28) is designed as a programmable logic controller or as a software module. [10] Computer program (303) comprising instructions which, when the computer program (303) is executed by a computer, cause it to execute a method according to any one of claims 1 to 5. [11] Machine-readable storage medium (301) on which the computer program (303) according to claim 10 is stored.

Images