Method and system for checking a trajectory for collision-free operation

Abstract

The invention relates to a method for checking a planned trajectory (T) of a vehicle (1) for collision-free travel based on an environment model (2, 2') comprising a plurality of cells (Z), wherein the cells each correspond to an environmental area in the vicinity of the vehicle (1) and each cell (Z) is assigned information indicating whether the environmental area represented by the cell (Z) can be traversed without collision, wherein the first environment model (2) is provided by a first processor (P1) having a first safety integrity level that is lower than a safety level required for checking the trajectory (T) for collision-free travel, wherein the first processor (P1) determines at least one trajectory (T) to be checked for collision-free travel based on the first environment model (2), wherein the first environment model (2) or a different environment model (2) is used to determine the trajectory (T) to be checked for collision-free travel.a second, information-reduced environment model (3) is generated from the first environment model (2) or the further environment model (2') by reducing the first environment model (2) or the further environment model (2') to information relevant for the collision check of the trajectory (T), and wherein a second processor (P2), which has a second safety integrity level that is at least equivalent to the safety integrity level required for checking the trajectory (T) for collision-free operation, performs a collision check of the trajectory (T) based on the second, information-reduced environment model (3).

Description

The invention relates to a method and system for checking a planned trajectory of a vehicle for collision-free travel. Driver assistance systems that feature a trajectory planner, which provides a collision-free trajectory on which at least semi-autonomous vehicle control is based, are already known. In these systems, the trajectory planner determines, for example, several test trajectories, also known as trajectory hypotheses, then checks these test trajectories for collision-free driving, and after a positive collision-free check, selects a collision-free trajectory on which at least semi-autonomous driving is carried out. For collision detection, a grid-based environment model can be used, which has a large number of cells and cell attributes assigned to these cells. Based on these cell attributes, it is possible to check whether a planned trajectory can be traversed without collisions or not. For example, the cell attributes can indicate whether a cell is free and therefore traversable without collisions, or whether it is occupied by a third-party object. The problem is that the processor used for collision detection of a trajectory using a grid-based environmental model must have high memory and computing resources, while simultaneously meeting a high safety integrity level (ASIL level; ASIL: Automotive Safety Integrity Level). Specifically, for L4 systems and above, it must meet ASIL D safety integrity level according to SAE J3016. However, no processors are available, or only very expensive ones, that meet this safety integrity level and simultaneously offer the necessary memory and computing capacities. From DE 10 2021 120 391 A1 a system for operating a driver assistance system of a vehicle is known. DE 10 2022 213 178 A1 discloses a fault-tolerant data processing system for generating safe behavior of an automated vehicle. DE 10 2013 217 486 A1 discloses a method for representing the environment of a vehicle in an occupancy grid, wherein the data are acquired with at least one environment detection system. Based on this, the object of the invention is to provide a method for checking a planned trajectory of a vehicle for collision-free operation, which offers a high level of safety and is feasible with processors available on the market that meet the required safety integrity level. The problem is solved by a method having the features of independent claim 1. Preferred embodiments are the subject of the dependent claims. A system for checking a planned trajectory of a vehicle for collision-free travel is the subject of dependent claim 15. According to a first aspect, a method for checking a planned vehicle trajectory for collision-free travel is disclosed, in which a first environment model is used. The first environment model has a plurality of cells, each corresponding to an environmental region in the vicinity of the vehicle. In other words, each cell contains information about a discrete environmental region. Each cell is associated with information indicating whether the environmental region represented by the cell can be traversed without collision. The first environment model is processed by a first processor, which has a first safety integrity level that is lower than the safety level required for checking the trajectory for collision-free travel. Preferably, the first environment model is also generated by the first processor.In particular, the first processor does not meet the ASIL D level required for Level 4 systems according to SAE J3016 or higher. Based on the first environmental model, the first processor determines at least one trajectory to be checked for collision-free behavior. From the first environmental model, or from a different, further environmental model, a second, information-reduced environmental model is generated by reducing the first or further environmental model to information relevant for the collision check of the trajectory. This further environmental model can be provided by another processor with a safety integrity level lower than that required for checking the trajectory for collision-free behavior. In particular, this further processor does not meet the ASIL D level required for Level 4 systems according to SAE J3016 or higher.A second processor with a second safety integrity level, which is at least equivalent to the safety integrity level required for checking the trajectory for collision-free operation, performs a collision check of at least one trajectory based on the second, information-reduced environment model. The technical advantage of this method lies in the fact that by distributing the tasks across at least two processors and reducing the information from the first environment model to a second environment model, it becomes possible to use a grid-based environment model for planning test trajectories and subsequently check these test trajectories for collision-free operation using a commercially available processor with the required safety integrity level. The advantage of using a first environment model to determine at least one trajectory and a second environment model, different from the first and from which the second, information-reduced environment model is generated, is that the use of two differently implemented environment models allows for the achievement of higher safety requirements, such as compliance with standards like ISO 21448 "Safety of the intended Functionality" or ISO / PAS 8800. According to the invention, each cell of the first environment model and / or the further environment model is assigned several probability values. A first probability value indicates the probability that the respective cell is free. Thus, the information regarding the occupancy of a cell is not purely binary, but a probability value with a wider range of possible values, which is advantageous for information reduction for the second environment model. According to one embodiment, a second probability value indicates the probability that the respective cell is occupied by a static object. This information is therefore not purely binary, but rather a probability value with a wider range of possible values, which in turn is advantageous for information reduction in the second environment model. According to one embodiment, a third probability value indicates the probability that the respective cell is occupied by a dynamic object. This information is therefore not purely binary, but rather a probability value with a wider range of possible values, which in turn is advantageous for information reduction in the second environment model. According to the invention, several probability means are determined based on the probability values ​​of the cells of the first environment model and / or the further environment model. The probability means are each calculated by averaging the probability values ​​of a group of cells that are occupied at least temporarily while the vehicle traverses the trajectory through its body. The averaging can be equally weighted or unequally weighted. The probability means are used by the second processor as information from the second, information-reduced environment model to check the trajectory for collision avoidance.This has the advantage that the information reduction carried out in the formation of the second environment model uses a large number of less precise pieces of information that exhibit information redundancy with each other, so that a distortion of individual or a few values ​​does not lead to a wrong decision regarding the existence of collision freedom if the interpretation is otherwise correct. According to one embodiment, at least a first probability mean is determined, which indicates the probability that a group of cells, which is at least temporarily occupied by the vehicle's body while traversing the trajectory, is clear. This probability mean thus combines the initial probability values ​​of the group of cells into a single value, which is a measure of the probability that the group of cells is clear and therefore passable by the vehicle without collision. According to one embodiment, at least a second probability mean is determined, indicating the probability that at least one static object is located in a group of cells that is at least temporarily occupied by the vehicle's body while traversing the trajectory. This probability mean thus combines the second probability values ​​for the group of cells into a single value, which is a measure of the probability that the group of cells is statically occupied and therefore cannot be traversed by the vehicle without collision. It is evident that the first and second probability means have information redundancy, since an occupied group of cells is not free, and vice versa. This information redundancy can be used by the second processor for plausibility checks. According to one embodiment, at least a third probability mean is determined, indicating the probability that at least one dynamic object is located in a group of cells that is at least temporarily occupied by the vehicle's body while traversing the trajectory. This probability mean thus combines the third probability values ​​of the group of cells into a single value, which is a measure of the probability that the group of cells is occupied by a dynamic object (i.e., the object exhibits its own motion) and therefore cannot be traversed by the vehicle without collision. It is evident that the first and third probability means have information redundancy, since a group of cells occupied by a dynamic object is not free, and vice versa. This information redundancy can be used by the second processor for plausibility checks. According to one embodiment, the mean probability values ​​are calculated by averaging the probability values ​​of the cells of the first environmental model and / or the second environmental model that are temporarily occupied by the vehicle body while traversing the entire trajectory under test. In other words, an average is calculated over the entire length of the trajectory. This achieves a high degree of information reduction between the first and second environmental models. According to one embodiment, the probability averages refer to a group of cells in the first environment model and / or the second environment model that are occupied by the vehicle body at a certain point during the trajectory's travel. In other words, the group of cells extends only to a portion of the trajectory to be checked for collision-free operation. The second environment model thus comprises several probability averages for multiple groups of cells distributed along the trajectory to be checked. These groups can overlap. Alternatively, the groups can be arranged contiguously without overlap. This allows the second processor to check the collision-free operation of the trajectory incrementally. According to one embodiment, several groups of probability means are used to check the trajectory for collision-free operation. Each group of probability means relates to a group of cells of the first environment model and / or the further environment model that are occupied by the vehicle body at different times during the trajectory's passage. This allows the collision-free operation of the trajectory to be checked piecemeal, and the multiple probability means assigned to a group of cells provide information redundancy, which increases the reliability of the collision check of the trajectory. According to one embodiment, a group of probability means comprises: - a first probability mean that indicates the probability that a group of cells of the first environment model and / or the further environment model, which is occupied by the vehicle body at a certain time during the trajectory, is free; - a second probability mean that indicates the probability that a group of cells of the first environment model and / or the further environment model, which is occupied by the vehicle body at a certain time during the trajectory, is occupied by at least one static object;- each calculates a third probability mean value, which indicates the probability that a group of cells of the first environment model and / or the further environment model, which is occupied by the vehicle body at a certain time when traversing the trajectory, is occupied by at least one dynamic object.; This triple of values ​​provides a high level of information redundancy, which further increases the safety of the collision check of the trajectories. According to one embodiment, when assessing the collision-free nature of a trajectory, the mean probability values ​​of a group of mean probability values ​​are compared, and a plausibility check is performed based on this comparison. By comparing the mean probability values, it can be determined whether they are in a relationship that strongly suggests a collision-free trajectory, or whether there are discrepancies between the mean probability values ​​that indicate an uncertain collision-free path. According to one embodiment, the second, information-reduced environment model is formed by reducing the first environment model and / or the further environment model to the cells that are temporarily occupied as the vehicle traverses the trajectory through its body. In other words, the first environment model and / or the further environment model are spatially limited to the area of ​​the vehicle relevant for collision detection. This allows a second environment model to be obtained that can be processed by the second processor but still has a sufficient number of cell attributes assigned to the respective cells to provide information redundancy for collision detection. According to another aspect, a system for checking a vehicle's trajectory for collision-free travel is disclosed. The system includes a first processor that processes and, if necessary, provides a first environmental model of the vehicle, which comprises a multitude of cells. Each cell corresponds to an environmental area surrounding the vehicle. Information is assigned to each cell indicating whether the environmental area represented by the cell can be traversed without collision. The first processor has a first safety integrity level that is lower than the safety level required for checking the trajectory for collision-free travel. The first processor is configured to determine at least one trajectory to be checked for collision-free travel based on the first environmental model.The first processor, or a further processor with a safety integrity level lower than that required for collision-free trajectory testing, is configured to generate a second, information-reduced environment model from the first environment model, or a further environment model, by reducing the first environment model or the further environment model to information relevant for collision testing of the trajectory. Additionally, a second processor is provided with a second safety integrity level that is at least equivalent to that required for collision-free trajectory testing. The second processor is configured to perform a collision test of the trajectory based on the second, information-reduced environment model. A “second environment model” within the meaning of the present invention can also be a cell-based environment model or an environment model in which the cell information of several cells of the first environment model or the further environment model has been combined into combination information. Another “environmental model” within the meaning of the present invention is also a cell-based environmental model that is similar to the first environmental model but differs from the first environmental model in that it was generated by a different method. The terms “approximately”, “essentially” or “about” mean, within the meaning of the invention, deviations from the respective exact value by + / - 10%, preferably by + / - 5% and / or deviations in the form of changes that are insignificant for the function. Further developments, advantages, and possible applications of the invention will also become apparent from the following description of exemplary embodiments and from the figures. All features described and / or illustrated are, individually or in any combination, fundamentally the subject matter of the invention, irrespective of their compilation in the claims or their cross-reference. The content of the claims is also incorporated into the description. The invention is explained in more detail below with reference to exemplary embodiments shown in the figures. Figure 1 shows, by way of example, a schematic representation of a vehicle with sensors for environmental perception; Figure 2 shows, by way of example, a schematic representation of a system for collision detection of a trajectory, comprising a first and a second processor; Figure 3 shows, by way of example, a schematic representation of a further system for collision detection of a trajectory, comprising a first processor for providing at least one trajectory, a further processor for generating the second, information-reduced environmental model, and a second processor for collision detection of the at least one trajectory based on the second, information-reduced environmental model; Figure 4 shows, by way of example, a first environmental model showing the vehicle's surroundings in the area of ​​the trajectory to be tested; Figure 5 shows the second, third, and fourth, respectively.Figure 5 shows, by way of example, a block diagram illustrating the steps of the procedure for checking a trajectory for collision-free operation; Figure 6 shows, by way of example, a section of the first environment model or the extended environment model and an illustration of a group of cells used to form the second environment model; Figure 7 shows, by way of example, a section of the first environment model or the extended environment model and an illustration of several groups of cells used to form the second environment model; and Figure 8 shows, by way of example, a bar chart illustrating the first to third probability means of the groups of cells according to Figure 6 at times t1 to t5. Fig. 1 shows, by way of example and schematically, a vehicle 1 with a body 1.1. The vehicle 1 has a driver assistance system by means of which the vehicle 1 can be moved at least semi-autonomously according to level 2 of the J3016 standard of the standardization organization SAE International, in particular also highly autonomously according to level 3 of the J3016 standard of the standardization organization SAE International, and most preferably also fully autonomously according to level 4 of the J3016 standard of the standardization organization SAE International. The driver assistance system includes, among other things, a trajectory planner and a unit for checking the trajectory for collision avoidance. Vehicle 1 includes several sensors 1.3 by means of which the environment of vehicle 1 can be detected. The sensors can be of different types and can be selected from the following group: radar sensor, camera, ultrasonic sensor, LiDAR sensor, etc. The vehicle 1 includes a computing unit 1.2, which is designed to process information from the sensors 1.3 of the vehicle 1 or information derived from this sensor information and, based on this, to create a first environmental model 2 of the area surrounding the vehicle 1 in which the vehicle 1 is currently located. The first environment model 2 is a grid-based environment model containing a multitude of cells Z. Each cell Z of the first environment model 2 refers to a discrete environmental area. Cell attributes are assigned to each cell Z, characterizing this discrete environmental area. These cell attributes can, for example, indicate whether cell Z is clear and therefore accessible, or whether cell Z is occupied and therefore inaccessible. In the case of the "occupied" cell attribute, it can also be specified whether the cell is occupied by a dynamic or a stationary object. It is understood that a variety of other cell attributes can be assigned to cells Z, such as the object's height, the object's direction of movement, etc., to create a detailed environment model. Trajectory planning is performed based on this first environment model 2. Specifically, the computing unit 1.2 uses the first environment model 2 to determine several test trajectories, checks these for collision avoidance, and selects one of these test trajectories after the collision check. Vehicle 1 is then controlled based on the selected trajectory T. Fig. 2 shows a block diagram of a system 10 that is used to plan a collision-free trajectory T based on the first environment model 2. System 10 comprises a first processor P1 and a second processor P2. The first processor P1 has higher computing power than the second processor P2. However, the first processor P1 only meets a first safety integrity level (ASIL level), which is lower than the second safety integrity level met by the second processor P2. In particular, the first safety integrity level of the first processor P1 is insufficient to meet the required safety requirements for calculating a collision-free trajectory. While the second safety integrity level of the second processor P2 meets the required safety requirements for calculating a collision-free trajectory, its memory and computing resources are insufficient to directly perform the calculations necessary for creating a collision-free trajectory based on the first environment model 2. Fig. 3 shows a block diagram of another system 10' that can be used to plan a collision-free trajectory T. System 10' again comprises a first processor P1 and a second processor P2 with the same tasks and the same properties regarding computing power and security integrity level as previously described in relation to System 10 of Fig. 2. In contrast, System 10' includes an additional processor P1'. This additional processor P1' has higher computing power than the second processor P2, but a lower security integrity level. For example, the additional processor P1' can have the same security integrity level as the first processor P1. The difference between System 10' (Fig. 3) and System 10 (Fig. 2) is that the computation of at least one test trajectory and the generation of the second, information-reduced environment model are performed on different processors P1 and P1', and not by a single processor, namely the first processor P1. Fig. 4 shows an example of a first environment model 2. As described above, the first environment model 2 is a grid-based environment model, but the individual cells Z are not visible in Fig. 4 due to their small size. The cell attributes of the cells Z are illustrated in Fig. 4 by different shades of gray, with lighter shades indicating traversable cells Z and darker shades indicating cells Z occupied by objects and therefore not traversable without collision. Fig. 5 shows a block diagram illustrating the process steps of a procedure for checking a planned trajectory, intended to be traveled by a vehicle, for collision-free travel. The procedure comprises the following steps: First, a first environment model 2 is provided, which has a plurality of cells Z, where each cell Z corresponds to an environmental area in the vicinity of the vehicle 1 and each cell Z is assigned information (also referred to as cell attributes) that indicates whether the environmental area represented by the cell Z can be traversed without collision (S10). This first environment model 2 is processed by the first processor P1. Subsequently, the first processor P1 determines at least one trajectory T, which is to be checked for collision-free conduct (S11). In particular, based on the first environment model 2, the first processor P1 calculates one or more trajectories T, also called test trajectories, which are to be checked for collisions. It should be noted that the first processor P1 can also be configured to perform both tasks: creating the first environment model 2 and determining one or more test trajectories based on this first environment model 2. Subsequently, a second, information-reduced environment model 3 is generated from the first environment model 2 or another environment model that differs from the first environment model by reducing the first environment model 2 or the further environment model 2' to information relevant for the collision check of the respective trajectory T (S12). The second processor P2, which has a second safety integrity level that is at least equivalent to the safety integrity level required for checking the trajectory T for collision-free operation, then performs a collision check of the trajectory T based on the second, information-reduced environment model 3 (S13). Information reduction is achieved such that the second, information-reduced environment model 3 has a reduced feature space containing the information necessary for collision detection of the trajectory T and which can be processed by the second processor P2 with its limited computing resources. However, the information reduction is preferably carried out such that the second, information-reduced environment model 3 still exhibits information redundancies per cell Z, so that any distortion of information caused by noise or other interfering effects is corrected and does not lead to an incorrect decision (i.e., a misjudgment of the trajectory as not collision-free when it is actually traversable, or vice versa). Information reduction can be achieved in different ways, as will be described in more detail below. Information reduction can initially be achieved by restricting the second environment model 3 to those cells Z that are swept by the body 1.1 of vehicle 1 when traversing the trajectory T to be checked for collision. In other words, the first environment model 2 or the further environment model 2' is cropped to the area around the trajectory T that is actually traveled by vehicle 1. Thus, when generating the second environment model 3, the first environment model 2 or the further environment model 2' is merely spatially limited to the area relevant for traveling the trajectory. According to a preferred embodiment, the information reduction of the first environment model 2 or the further environment model 2' is carried out by combining, in particular averaging (equally weighted or unequally weighted) several probability values ​​W1 - W3, which are assigned to the respective cells Z of the first environment model 2 or the further environment model 2'. For this purpose, each cell Z of the first environment model 2 or the further environment model 2' is preferably assigned several probability values ​​W1 - W3, where a first probability value W1 indicates the probability that the respective cell Z is free and therefore accessible to vehicle 1. A second probability value W2 indicates the probability that the respective cell Z is occupied by a static object and therefore not accessible to vehicle 1. A third probability value W3 indicates the probability that the respective cell Z is occupied by a dynamic object and therefore not accessible at the time represented by the first environment model 2. Assigning several probability values ​​W1 - W3 to the respective cells of the first environment model 2 or the further environment model 2' has the technical advantage of creating information redundancy.For example, a cell that has a high probability value W1 assigned to the cell attribute "free" but also a high probability value W2 for the cell attribute "occupied by a static object" can be identified as a faulty cell Z in the first environment model 2 or the further environment model 2'. This information redundancy can be used to ensure that, despite the distortion of individual or a few values, no incorrect decision is made regarding the collision-free nature of the trajectory T by considering larger areas of the first environment model 2 or the further environment model 2'. In a first implementation variant, it is possible to generate a second environment model 3 from the first environment model 2 or the further environment model 2', whose cells Z contain only several probability values ​​W1 - W3, indicating the probability of the cells being occupied (for example, a probability value tuple with probability values ​​for "occupied" and "free" or a probability value triple with probability values ​​for "occupied with a static object", "occupied with a dynamic object" and "free"). In other words, the information reduction to provide the second environment model 3 from the first environment model 2 or the further environment model 2' is achieved by reducing the cell attributes exclusively to the aforementioned probability values ​​W1 - W3. In a second implementation variant, when generating the second environment model 3, a fusion of probability values ​​W1 - W3, which are assigned to the respective cells Z in the first environment model 2 or in the further environment model 2', is performed to create probability means WM1 - WM3. A group G of several cells from the first environment model 2 or the further environment model 2' is selected, the probability values ​​assigned to this group G of cells are combined into a probability mean, and this probability mean is used as the value for the group G of cells in the second environment model 3.In particular, several probability means WM1 - WM3 are calculated for the group G of cells, namely, for example, a first probability mean WM1 from the first probability values ​​W1, which indicate whether the respective cells Z of the group G are free of cells, a second probability mean WM2 from the second probability values ​​W2, which indicate whether the respective cells T of the group G are occupied by at least one static object, and a third probability mean WM3 from the third probability values ​​W3, which indicate whether the respective cells Z of the group G are free of cells. Fig. 6 illustrates a trajectory T planned by a trajectory planner of a vehicle 1. The grid shown defines the cells Z of the first environment model 2 or the further environment model 2'. Each cell Z is assigned probability values ​​W1, W2, W3, where W1 defines the first probability value, W2 the second probability value, and W3 the third probability value. The group G of cells is indicated in the illustrated embodiment by the dashed outline. The group G of cells comprises the cells Z along the trajectory T that are swept out by the body 1.1 of the vehicle 1 when traversing the trajectory T. In other words, the group G of cells comprises those cells Z that lie on the travel path of the vehicle 1 and therefore must be clear to prevent a collision of the vehicle 1 with surrounding objects.It is understood that, in order to increase driving safety and the acceptance of the driver assistance system by the occupants of vehicle 1, a safety distance to surrounding objects can be taken into account, i.e. the driving channel is chosen to be larger than the area actually swept by the vehicle body by taking a safety buffer into account. The group G of cells can extend along the entire trajectory T to be tested, or it can refer only to a part of the trajectory T to be tested. From the multiple probability values ​​W1, W2, W3, several probability means WM1, WM2, WM3 are then calculated for the group G of cells. The probability means WM1, WM2, WM3 are each obtained by averaging the probability values ​​W1, W2, W3 for the group G of cells; that is, the first probability values ​​W1 of the group G of cells are averaged to generate the first probability mean WM1, the second probability values ​​W2 of the group G of cells are averaged to generate the second probability mean WM2, and the third probability values ​​W3 of the group G of cells are averaged to generate the third probability mean WM3. The averaging can be an equally weighted averaging or a weighted averaging with different weighting factors, at least for parts of the group G of cells.In particular, cells Z that are closer to vehicle 1 can be weighted more heavily than cells Z that are farther away from vehicle 1. Fig. 7 shows an alternative embodiment of grouping cells along the trajectory, namely a grouping into several groups G of cells that are relevant for the collision-free nature of the trajectory T in successive time steps. For example, the trajectory T can be divided into several time steps t0 - t5, and the cells Z can be grouped based on these time steps. Unlike the representation shown in Fig. 7, the groups of cells can also partially overlap in the longitudinal direction of the trajectory T. This allows for the calculation of several first, second, and / or third probability means WM1, WM2, WM3 for each trajectory T, with at least two probability means per group. This enables a discrete-time collision check of the trajectory T by the second processor P2. In the aforementioned embodiments, which achieve information reduction by means of probability means, these probability means WM1, WM2, WM3 of at least one group G of cells are used to form the second environment model 3. When considering the probability of cells being occupied by dynamic objects, the movement of the dynamic objects themselves can be taken into account. In particular, based on the movement of the dynamic object, it can be predicted whether cell Z is actually occupied by a dynamic object at the time when vehicle 1 is located within that cell Z. It is understood that even with information reduction based on probabilities that the cells swept over by the body 1.1 of vehicle 1 are free, an additional spatial limitation to the relevant surrounding area can be applied. Fig. 8 shows an exemplary and schematic bar chart showing the probability means WM1, WM2, WM3 for the groups G of cells shown in Fig. 7. Each time point t0 - t5 is assigned three probability means WM1, WM2, WM3, which represent the mean of the probability values ​​W1, W2, W3 of the group of cells at the respective time. The first probability mean WM1 indicates the probability that the group of cells is unoccupied and therefore freely traversable, the second probability mean WM2 indicates that the group of cells is occupied by a static object, and the third probability mean WM3 indicates that the group of cells is occupied by a dynamic object. By assigning multiple probability means WM1, WM2, WM3 to a group of cells, information redundancy is achieved, which can be used to check the plausibility of the information provided by the first processor unit P1. The probability means WM1, WM2, WM3 obtained at times t0 to t3 indicate a group of cells that can correctly be assessed as collision-free, since there is a very high probability mean WM1 for "cells are free" and very low probability means WM2, WM3 for "cells are occupied by a static object" and "cells are occupied by a dynamic object," respectively. At times t4 and t5, however, the probability means WM1, WM2, and WM3 indicate implausibility, as relatively high values ​​are given for both the first probability mean WM1 (for "cells are free") and the third probability mean (for "cells are occupied by a dynamic object"). Therefore, it can be assumed by the second processor P2 that releasing the trajectory T as collision-free is not possible, at least at times t4 and t5. The invention has been described above using exemplary embodiments. It is understood that numerous modifications and adaptations are possible without thereby departing from the scope of protection defined by the patent claims. Reference symbol list 1 Vehicle 1.1 Body 1.2 Processing unit 1.3 Sensor 2 First environment model 2' Further environment model 3 Second environment model 10, 10' System G Group P1 First processor P1' Further processor P2 Second processor W1 First probability value W2 Second probability value W3 Third probability value WM1 First probability mean WM2 Second probability mean WM3 Third probability mean T Trajectory Z Cells

Claims

Method for checking a planned trajectory (T) of a vehicle (1) for collision-free travel based on an environment model (2, 2') having a plurality of cells (Z), wherein the cells (Z) each correspond to an environmental area in the vicinity of the vehicle (1) and each cell (Z) is assigned information indicating whether the environmental area represented by the cell (Z) can be traversed without collision, wherein a first environment model (2) is processed by a first processor (P1) having a first safety integrity level that is lower than a safety level required for checking the trajectory (T) for collision-free travel, wherein the first processor (P1) determines at least one trajectory (T) to be checked for collision-free travel based on the first environment model (2), wherein a second environment model (2') is generated from the first environment model (2) or from a further environment model (2') different from the first environment model (2),an information-reduced environment model (3) is generated by reducing the first environment model (2) or the further environment model (2') to information relevant for the collision check of the trajectory (T), and wherein a second processor (P2), which has a second safety integrity level that is at least equivalent to the safety integrity level required for checking the trajectory (T) for collision-free operation, performs a collision check of the trajectory (T) based on the second, information-reduced environment model (3), wherein the cells (Z) of the first environment model (2) and / or the further environment model (2') are each assigned several probability values ​​(W1, W2, W3), wherein a first probability value (W1) indicates the probability that the respective cell (Z) is free, and wherein, based on the probability values ​​(W1, W2,W3) of the cells (Z) of the first environment model (2) and / or the further environment model (2') several probability means (WM1, WM2, WM3) are determined, wherein the probability means (WM1, WM2, WM3) are each formed by averaging the probability values ​​(W1, W2, W3) of a group (G) of cells (Z) that are occupied at least temporarily when the trajectory (T) is traversed by the body (1.1) of the vehicle (1), and that the probability means (WM1, WM2, WM3) are used as information of the second, information-reduced environment model (3) by the second processor (P2) to check the trajectory (T) for collision-free operation. Method according to claim 1, characterized in that a second probability value (W2) indicates the probability that the respective cell (Z) is occupied by a static object. Method according to claim 1 or 2, characterized in that a third probability value (W3) indicates the probability that the respective cell (Z) is occupied by a dynamic object. Method according to claim 1, characterized in that at least a first probability mean value (WM1) is determined which indicates the probability that a group (G) of cells (Z) which is at least temporarily occupied by the body (1.1) of the vehicle (1) when traversing the trajectory (T) is free. Method according to claim 1 or 4, characterized in that at least a second probability mean value (WM2) is determined which indicates the probability that at least one static object is located in a group (G) of cells (Z) which is at least temporarily occupied by the body (1.1) of the vehicle (1) when traversing the trajectory (T). Method according to one of claims 1 or 4 to 5, characterized in that at least a third probability mean value (WM3) is determined, which indicates the probability that at least one dynamic object is located in a group (G) of cells (Z) which is at least temporarily occupied by the body (1.1) of the vehicle (1) when traversing the trajectory (T). Method according to one of claims 1 or 4 to 6, characterized in that the probability mean values ​​(WM1, WM2, WM3) are formed by averaging the probability values ​​of the cells (Z) of the first environment model (2) and / or the further environment model (2') that are temporarily occupied by the body (1.1) of the vehicle (1) when driving through the entire trajectory (T) to be tested. Method according to one of claims 1 or 4 to 6, characterized in that the probability means (WM1, WM2, WM3) refer to a group (G) of cells (Z) of the first environment model (2) and / or the further environment model (2') which are occupied at a certain time when traversing the trajectory (T) by the body (1.1) of the vehicle (2). Method according to claim 8, characterized in that several groups (G) of probability means (WM1, WM2, WM3) are used to check the trajectory (T) for collision-free operation, wherein each group of probability means (WM1, WM2, WM3) refers to a group (G) of cells (Z) of the first environment model (2) and / or the further environment model (2') that are occupied by the body (1.1) of the vehicle (1) at different times when traversing the trajectory (T). The method according to claim 9, characterized in that a group of probability means (WM1, WM2, WM3) - each comprises a first probability mean (WM1) which indicates the probability that a group (G) of cells (Z) of the first environment model (2) and / or the further environment model (2'), which is occupied by the body (1.1) of the vehicle (1) at a certain time when traversing the trajectory (T), is free; - each comprises a second probability mean (WM2) which indicates the probability that a group (G) of cells (Z) of the first environment model (2) and / or the further environment model (2'), which is occupied by the body (1.1) of the vehicle (1) at a certain time when traversing the trajectory (T), is free.1) of the vehicle (1) is occupied by at least one static object;- each has a third probability mean (WM3) that indicates the probability that a group (G) of cells (Z) of the first environment model (2) and / or the further environment model (2'), which is occupied by the body (1.1) of the vehicle (1) at a certain time when traversing the trajectory (T), is occupied by at least one dynamic object. Method according to claim 9 or 10, characterized in that, when assessing the trajectory (T) for collision-free operation, the probability means (WM1, WM2, WM3) of a group of probability means are compared with each other and a plausibility check is carried out based on the comparison of the probability means (WM1, WM2, WM3) of a group. Method according to one of the preceding claims, characterized in that the second, information-reduced environment model (3) is generated by reducing the first environment model (2) and / or the further environment model (2') to the cells (Z) that are temporarily occupied when the vehicle body (1.1) traverses the trajectory (T). System for checking a vehicle's trajectory (T) for collision-free travel, wherein the system (10, 10') comprises a first processor (P1) that provides a first environment model (2) of the vehicle (1) which has a plurality of cells (Z), wherein the cells (Z) each correspond to an environmental area in the vicinity of the vehicle (1) and each cell (Z) is assigned information indicating whether the environmental area represented by the cell (Z) is traversable without collision, wherein the first processor (P1) has a first safety integrity level that is lower than a safety level required for checking the trajectory (T) for collision-free travel, wherein the first processor (P1) is configured to determine at least one trajectory (T) to be checked for collision-free travel based on the first environment model (2), wherein the first processor (P1) or a further processor (P1'),which has a security integrity level lower than that required for checking the trajectory (T) for collision-free operation and is configured to generate a second, information-reduced environment model (3) from the first environment model (2) or a further environment model (2') by reducing the first environment model (2) or the further environment model (2') to information relevant for the collision check of the trajectory (T), wherein a second processor (P2) is provided which has a second security integrity level at least equal to that required for checking the trajectory (T) for collision-free operation, and wherein the second processor (P2) is configured to perform a collision check of the trajectory (T) based on the second, information-reduced environment model (3).and wherein the cells (Z) of the first environment model (2) and / or the further environment model (2') are each assigned several probability values ​​(W1, W2, W3), wherein a first probability value (W1) indicates the probability that the respective cell (Z) is free, and wherein, based on the probability values ​​(W1, W2, W3) of the cells (Z) of the first environment model (2) and / or the further environment model (2'), several probability means (WM1, WM2, WM3) are determined, wherein the probability means (WM1, WM2, WM3) are each formed by averaging the probability values ​​(W1, W2, W3) of a group (G) of cells (Z) that are occupied at least temporarily while the body (1.1) of the vehicle (1) traverses the trajectory (T), and wherein the probability means (WM1, WM2, WM3) are provided as information from the second,The second processor (P2) uses the information-reduced environment model (3) to check the trajectory (T) for collision-free operation.

Images