Control system for a vehicle and vehicle with such a control system

Abstract

The invention relates to a control system for a vehicle, comprising a first (P1E1) and a second (P1E2) processor unit arranged sequentially in a first signal path (P1) and a first (P2E1) and a second (P2E2) processor unit arranged sequentially in a second signal path (P2). The control system according to the invention is characterized in that - the two second processor units (P1E2, P2E2) are communicating with each other; - the first processor unit (P1E1) is set up to calculate a first standard trajectory (Tsdt-1) and a first emergency trajectory (Tnot-1) for the vehicle; - the first processor unit (P2E1) is set up to calculate a second standard trajectory (Tsdt-2) and a second emergency trajectory (Tnot-2) for the vehicle; - the second processor unit (P1E2) is set up to calculate a radar-based emergency trajectory (Tnot-r) for the vehicle; - the second processor unit (P2E2) is configured to calculate a lidar-based emergency trajectory (Tnot-I) for the vehicle; wherein - a first motion control mechanism (CTRL1) is implemented in the second processor unit (P1E2) and a second motion control mechanism (CTRL2) is implemented in the second processor unit (P2E2); and - a first error detection mechanism (ERROR1) is implemented in the second processor unit (P1E2) and a second error detection mechanism (ERROR2) is implemented in the second processor unit (P2E2).

Description

[0001] The invention relates to a control system for a vehicle of the type defined in more detail in the preamble of claim 1 and to a vehicle comprising such a control system.

[0002] Modern vehicles already feature various driving modes that allow for semi-automated vehicle control. With ongoing development, highly automated, fully automated, or even autonomous driving systems are increasingly being integrated into vehicles. Such systems require not only comprehensive sensor technology for environmental perception but also various processing units to process the sensor data and issue control commands to the vehicle's actuators.

[0003] It is essential to implement measures that ensure safe driving in all conceivable driving situations. This requires incorporating redundancies so that the vehicle can still be safely controlled even if one or more system components fail. In this context, ISO 26262 should be mentioned, which describes a scheme for risk assessment of vehicle safety integrity. This is known as the Automotive Safety Integrity Level (ASIL). The scheme defines safety requirements for vehicles, compliance with which must be ensured by the vehicle manufacturer. This involves a risk analysis of a potential hazard by considering its severity, probability of occurrence, and controllability via the vehicle in the respective situation. Four ASIL classes are distinguished: ASIL-A, ASIL-B, ASIL-C, and ASIL-D.The highest safety standards are applied to ASIL-D and the lowest to ASIL-A.

[0004] The standard also offers the possibility of so-called decomposition. Decomposition allows particularly safety-critical system components, which are assigned a high ASIL class, to be replaced by several redundant system components. These redundant system components can then be assigned a comparatively lower ASIL class. For example, one system component of ASIL class B can be replaced by two system components of ASIL class A.

[0005] A method and system for detecting faults in vehicles under ASIL decomposition is known, for example, from US 2024 / 0296702 A1. This document describes a system-on-a-chip (SoC) comprising a first and second chiplet die, which are interconnected via a communication interface. Each chiplet die includes two ASIL domain circuits. The ASIL domain circuits on the first chiplet die are referred to as the first instance, and the ASIL domain circuits on the second chiplet die as the second instance. The ASIL domain circuits are capable of receiving and processing ASIL input signals. The described system includes means for detecting faults during the operation of the ASIL domain circuits.Depending on whether a fault is detected, the system selects which of the ASIL domain circuits—that is, the first or second instance of the first or second ASIL domain circuit—should provide the output signal to control a motion control unit of the vehicle. Using the hardware described in the publication, one ASIL-D domain circuit can be replaced by several ASIL-B domain circuits.

[0006] The present invention is based on the objective of providing an improved control system for a vehicle which is characterized by a simple design, is therefore inexpensive to manufacture and meets all required safety standards.

[0007] According to the invention, this problem is solved by a control system for a vehicle with the features of claim 1. Advantageous embodiments and further developments, as well as a vehicle with such a control system, are described in the dependent claims.

[0008] A generic control system for a vehicle, comprising a first and a second processor unit arranged sequentially in a first signal path, a first and a second processor unit arranged sequentially in a second signal path, and fault detection means, wherein the processor units are configured to receive and process sensor data and to output control commands for controlling a vehicle actuator, and the fault detection means are configured to examine the processor units for faults and, depending on the faults detected, to decide which processor unit's generated control commands are forwarded to the vehicle actuator, is further developed according to the invention in that - the two second processor units are communicating with each other; - the first processor unit in the first signal path is set up to receive camera images from a first camera and, by processing the camera images, to calculate a first standard trajectory and a first emergency trajectory for the vehicle; - the first processor unit in the second signal path is set up to receive camera images from a second camera and, by processing the camera images, to calculate a second standard trajectory and a second emergency trajectory for the vehicle; - the second processor unit in the first signal path is set up to receive radar data from a radar sensor and, by processing the radar data, to calculate a radar-based emergency trajectory for the vehicle; - the second processor unit in the second signal path is configured to receive lidar data from a lidar sensor and, by processing the lidar data, to calculate a lidar-based emergency trajectory for the vehicle; wherein - in the second processor unit, a first motion control mechanism is implemented in the first signal path, and in the second processor unit, a second motion control mechanism is implemented, each configured to execute the control commands so that the vehicle is moved along one of the respective trajectories; and - in the second processor unit in the first signal path a first error detection mechanism and in the second processor unit in the second signal path a second error detection mechanism is implemented, each configured to detect a malfunction of at least the processor units in its own signal path and to select a trajectory for its own motion control mechanism depending on a detected malfunction.

[0009] The control system according to the invention allows automated driving operation of the vehicle in accordance with SAE Level 3, provided all components are fully functional. Due to multiple redundancies, ASIL-D system components can be distributed across several system components, each belonging to a lower ASIL class, using decomposition. This clever distribution across the first and second signal paths eliminates the need for additional microcontrollers, thereby optimizing the ASIL and saving on system components. The system architecture is thus simpler and therefore more cost-effective. Nevertheless, the control system remains compliant with SAE Level 3.

[0010] For fault detection in the respective processor unit, proven methods can be used. The internal processes in the individual processor units can be monitored, allowing system errors to be identified. Algorithms can be employed to identify hardware defects or hardware-related defects, such as voltage values ​​or current spikes outside the operating range. It is possible to detect when a processor unit has made a calculation error. For example, checksums can be compared. Furthermore, each processor unit processes different sensor data. From this sensor data, an environmental representation of the vehicle can be reconstructed. This environmental reconstruction can be compared with other representations, at least in correlating sections. If the respective environmental representations differ by a defined amount, this indicates a fault.Such errors can also result from at least a temporarily limited detection capability of the underlying sensor technology.

[0011] According to the invention, the two second processor units in the first and second signal paths communicate with each other. This enables the exchange of information between the first and second signal paths. Thus, the respective processor units in the first signal path can be notified when an error is detected in the second signal path, and vice versa. The error detection mechanism is implemented twice and is therefore redundant. Therefore, should the error detection mechanism in the first signal path fail, for example, the error detection mechanism in the second signal path can still continue to operate. It is conceivable that relevant information from the first signal path is forwarded to the second signal path, so that the error detection mechanism in the second signal path can also detect errors in the processor unit in the first signal path, and vice versa.

[0012] According to the invention, the two first processor units in the first and second signal paths calculate a standard trajectory for the vehicle. Control commands are then generated to steer the vehicle, enabling it to follow this standard trajectory. If all system components are operating normally, i.e., without errors and within the intended operating range, the vehicle is controlled to follow the standard trajectory. The first and second standard trajectories are identical. The standard trajectory is thus calculated twice, creating additional redundancy. Therefore, if, for example, the first signal path fails, there is a certain probability that the second standard trajectory can be used to control the vehicle, and vice versa.

[0013] Furthermore, the first two processor units in the first and second signal paths each calculate an emergency trajectory. This emergency trajectory is also known as the "Buffer Minimal Risk Maneuver" (bMRM). The emergency trajectory thus differs significantly from the standard trajectory. The vehicle is controlled in such a way as to bring it to a safe state, such as stopping at the roadside, with the highest possible probability of avoiding an accident. Here, too, the first and second emergency trajectories can preferably be identical, thus creating further redundancy. Camera images are considered for calculating the respective standard and emergency trajectories. Camera images from the first camera are considered in the first signal path, and camera images from the second camera are considered in the second signal path. These are two separate cameras, thus creating further redundancy.In general, it is conceivable to also forward radar data or lidar data to the respective first processor units, so that this sensor data could be additionally taken into account.

[0014] A second processor unit is now provided in both the first and second signal paths. This provides additional redundancy, as emergency trajectories can be calculated should the respective primary processor units fail or malfunction. The first signal path uses radar data, while the second uses lidar data to calculate a radar-based and a lidar-based emergency trajectory, respectively. This provides multiple redundancy levels, as sensor data from two additional sensor modalities is now considered. Therefore, if the first and second standard trajectories for vehicle control are unavailable, the vehicle is controlled along one of the emergency trajectories. The first and second fault detection mechanisms determine which of these trajectories are used to derive the control commands for the vehicle actuators.Ideally, all emergency trajectories are identical. One of these emergency trajectories is then selected to derive the control commands. For example, this could be the first or second emergency trajectory, or the radar-based or lidar-based emergency trajectory. The selection is made taking into account which of the processor units is faulty.

[0015] An advantageous embodiment of the control system according to the invention provides that the first and second fault detection mechanisms are configured to detect a fault in a processor unit if the respective processor unit does not output a trajectory. If the respective processor unit is functioning correctly, a trajectory is output after processing the input sensor data. The first processor unit in the first signal path thus normally outputs the first standard trajectory and the first emergency trajectory. The first processor unit in the second signal path normally outputs the second standard trajectory and the second emergency trajectory. The second processor unit in the first signal path outputs the radar-based emergency trajectory, and the second processor unit in the second signal path outputs the lidar-based emergency trajectory.The first fault detection mechanism thus checks whether the first standard trajectory, the first emergency trajectory, and the radar-based emergency trajectory are present in at least the first signal path. The second fault detection mechanism checks whether the second standard trajectory, the second emergency trajectory, and the lidar-based emergency trajectory are present in at least the second signal path.

[0016] As previously described, the first fault detection mechanism can preferably also check whether the second standard trajectory, second emergency trajectory, and lidar-based emergency trajectory are present in the second signal path, and the second fault detection mechanism can preferably check whether the first standard trajectory, first emergency trajectory, and radar-based emergency trajectory are present in the first signal path. This means that if one of the described trajectories is missing, a corresponding remaining trajectory is selected as a substitute for deriving the control commands for the vehicle.

[0017] According to a further advantageous embodiment of the control system according to the invention, it is further provided that the first and second fault detection mechanisms are configured to compare at least three of the first and second emergency trajectories, the radar-based emergency trajectory and the lidar-based emergency trajectory with each other and to detect a fault of a processor unit outputting the respective trajectory if the trajectory deviates from the remaining trajectories and the remaining trajectories are identical to each other.In other words, the first fault detection mechanism compares at least the first emergency trajectory with the radar-based emergency trajectory and the lidar-based emergency trajectory, and detects a fault of the first processor unit in the first signal path if the first emergency trajectory deviates from the radar-based emergency trajectory and the lidar-based emergency trajectory, which are themselves identical. Depending on the situation, the first fault detection mechanism detects a fault of the second processor unit in the first signal path if the radar-based emergency trajectory deviates from the first emergency trajectory and the lidar-based emergency trajectory, which are then again identical.In a third scenario, the first fault detection mechanism detects a fault of the second processor unit in the second signal path if the lidar-based emergency trajectory deviates from the first emergency trajectory and the radar-based emergency trajectory, which are then identical to each other.

[0018] In general, it is conceivable that the second emergency trajectory is also passed through to the second processor unit in the first signal path via the communication link between the two second processor units, so that the first error detection mechanism can also take this second emergency trajectory into account for comparison.

[0019] The second fault detection mechanism specifically compares at least the second emergency trajectory with the radar-based emergency trajectory and the lidar-based emergency trajectory. The second fault detection mechanism detects a fault in the first processing unit in the second signal path if the second emergency trajectory deviates from the radar-based emergency trajectory and the lidar-based emergency trajectory, which are identical to each other. The second fault detection mechanism detects a fault in the second processing unit in the second signal path if the lidar-based emergency trajectory deviates from the second emergency trajectory and the radar-based emergency trajectory, which are identical to each other.In a third scenario, the second fault detection mechanism detects a fault of the second processor unit in the first signal path if the radar-based emergency trajectory deviates from the second emergency trajectory and the lidar-based emergency trajectory, which are identical to each other.

[0020] In general, it is conceivable that the first emergency trajectory is also passed through to the second processor unit in the second signal path via the communication link between the two second processor units, so that the second error detection mechanism can also take this first emergency trajectory into account for comparison.

[0021] In general, it is also conceivable that the first and / or second error detection mechanism each compares the two standard trajectories with each other.

[0022] Established trajectory matching methods can be used to compare trajectories. Such methods and algorithms are well known to those skilled in the art. For example, see: Tao Yaguang, et al., A comparative analysis of trajectory similarity measures, GIScience & Remote Sensing, Volume 58, 2021 - Issue 5, 643-669, https: / / doi.org / 10.1080 / 15481603.2021.1908927.

[0023] Preferably, each processor unit is configured to temporarily store at least its own calculated trajectories as a trajectory history and make it available to the two error detection mechanisms. The first and second error detection mechanisms are configured, respectively, to consider trajectory histories as additional input data for comparing at least the emergency trajectories. Previously, it was described that only the currently calculated emergency trajectories were compared. However, it is now also possible to consider the trajectory history in addition. This provides a larger data set for error detection. Specifically, it allows for determining whether the currently calculated trajectory is plausible or implausible based on its own history. This also enables the detection of errors in processor units.

[0024] According to a further advantageous embodiment of the control system according to the invention, it is further provided that the first and second fault detection mechanisms are configured to: - to select the standard trajectory as the trajectory for the own motion control mechanism, assuming a fault-free first and second processor unit in its own signal path; - in the case of a faulty first processor unit and a fault-free second processor unit in its own signal path, to select the radar-based or lidar-based emergency trajectory as the trajectory for its own motion control mechanism; and - in the case of a faulty first and second processor unit in the same signal path, to check whether at least the second processor unit in the other signal path is functioning correctly, whereby, if this is the case, control commands for the vehicle actuators are determined based on a trajectory of the other signal path; and - the first and second motion control mechanisms are designed to control the vehicle actuators to execute an emergency braking maneuver in the event of a fault in at least both second processor units.

[0025] This describes which trajectory is selected for which fault behavior in order to determine control commands for the vehicle. Crucially, at least one of the two second processor units must be functioning correctly. If this is not the case, regardless of whether at least one of the two first processor units is functioning correctly, the emergency braking maneuver is executed for the vehicle. However, if at least one of the two second processor units is functioning correctly, either an emergency trajectory output via the corresponding signal path of the functioning second processor unit is executed, or, if the first processor unit is also functioning correctly, the corresponding standard trajectory is executed in the same signal path.

[0026] A further advantageous embodiment of the control system according to the invention provides that the second processor unit in the first signal path and the second processor unit in the second signal path are capable of communicating with the vehicle actuators via a different communication protocol, in particular each via its own data line. This creates additional redundancy. For example, one of the two second processor units can be connected to the vehicle actuators via an Ethernet data line, and the other second processor unit via a CAN bus. Thus, a different communication protocol is used for data exchange. In the event of a communication protocol-specific error, the risk of all communication between control units and actuators breaking down is therefore reduced.

[0027] It is particularly advantageous that both second processor units can be connected to the vehicle actuators via their own dedicated data lines. This means that even if one data line experiences a mechanical interruption, information can still be transmitted to the vehicle actuators via the other data line.

[0028] According to a further advantageous embodiment of the control system according to the invention, the first processor units are each implemented as a system-on-a-chip and the second processor units are each implemented as a microcontroller. The performance of each processing unit can thus be specifically adapted to the respective task.

[0029] A further advantageous embodiment of the control system according to the invention provides that the two first processor units communicate with each other and that the first processor unit in the first signal path is configured to receive camera images from the second camera and take them into account in the trajectory calculation, and that the first processor unit in the second signal path is configured to receive camera images from the first camera and take them into account in the trajectory calculation, wherein, in particular, the first and second cameras are part of a stereo camera and the two first processor units are configured to generate depth images based on the camera images. According to the invention, the first processor unit in the first signal path is thus enabled to take the camera images from the second camera into account, and the first processor unit in the second signal path is enabled to take the camera images from the first camera into account.

[0030] This creates additional redundancy. Ideally, the first and second cameras are the two individual cameras of a stereo camera. Each of the first processor units is then able to consider the camera images of the stereo camera and thus acquire and incorporate depth information. This allows for even more reliable calculation of particularly safe trajectories. The respective first processor units can consider the camera images of the other camera in the other signal path when calculating both the standard trajectory and the emergency trajectory.

[0031] According to a further advantageous embodiment of the control system according to the invention, it is further provided that the first processor units are configured to recognize a left and / or right edge of the roadway and / or a vehicle ahead in the respective camera images; and / or the second processor unit in the first signal path is configured to consider only radar data that can be assigned to the left and / or right edge of the roadway and / or the vehicle ahead; and / or the second processor unit in the second signal path is configured to consider only lidar data that can be assigned to the left and / or right edge of the roadway and / or the vehicle ahead.

[0032] According to the invention, the amount of data to be processed can be reduced. Only relevant content from the respective sensor data is considered. In particular, the left and right wheels of the road, as well as vehicles ahead, provide especially relevant information for determining suitable trajectories for safe vehicle control. The computational effort for the processor units and the amount of data to be transmitted in the respective signal path can thus be reduced. This allows simpler hardware components to be used to provide the desired system behavior, which further reduces the costs of the control system according to the invention.

[0033] Preferably, the first fault detection mechanism is configured to detect a fault in the first and / or second processor unit in the first signal path if a discrepancy occurs between the road edges detected by the first and second processor units; and / or the second fault detection mechanism is configured to detect a fault in the first and / or second processor unit in the second signal path if a discrepancy occurs between the road edges detected by the first and second processor units. This provides an additional mechanism for detecting faults in the processor units.

[0034] A vehicle of this type, comprising at least two cameras, a radar sensor, a lidar sensor, and vehicle actuators, is further developed according to the invention by a control system described above. The vehicle can be any road vehicle such as a car, truck, van, bus, or the like.

[0035] Further advantageous embodiments of the control system according to the invention also result from the exemplary embodiments which are described in more detail below with reference to the figures.

[0036] This shows: Fig. 1 a schematic system structure of the control system according to the invention in a first embodiment; Fig. 2 a schematic system structure of the control system according to the invention in a second embodiment; Fig. 3. A schematic overview of possible system behavior in different situations; and Fig. 4 a schematic representation of a sensor data selection for calculating trajectories for the vehicle using the control system according to the invention in an advantageous embodiment.

[0037] Fig. Figure 1 shows a highly schematic representation of the structure of a control system according to the invention for a vehicle. The control system is divided into a first path P1 and a second path P2. In the first path P1, a first processor unit P1E1 and a second processor unit P1E2 are arranged, and in the second path P2, a first processor unit P2E1 and a second processor unit P2E2 are arranged. The first processor unit P1E1 receives camera images from a first camera CAM1 and processes them. As a result, the first processor unit P1E1 provides a first standard trajectory Tsdt-1 and a first emergency trajectory Tnot-1. The second processor unit P1E2, on the other hand, receives radar data from a radar sensor 2 and calculates a radar-based emergency trajectory Tnot-r by processing the radar data.

[0038] The first processor unit P2E1 receives camera images from a second camera CAM2, processes them, and calculates a second standard trajectory Tsdt-2 and a second emergency trajectory Tnot-2. The second processor unit P2E2 receives lidar data from a lidar sensor 3 and calculates a lidar-based emergency trajectory Tnot-I from it.

[0039] The second processor units P1E2 and P2E2 are each connected to a vehicle actuator 1 via their own data line (ETH, CAN). This could be, for example, an Ethernet data line and a CAN bus. In the second processor unit P1E2, a first motion control mechanism (STRG1) and a first fault detection mechanism (ERROR 1) are implemented in the first signal path (P1). Similarly, in the second processor unit P2E2, a second motion control mechanism (STRG2) and a second fault detection mechanism (ERROR2) are implemented in the second signal path (P2). The respective fault detection mechanisms (ERROR1, ERROR2) serve to detect malfunctions of the respective processor units P1E1, P1E2, P2E1, and P2E2, at least within their own signal path (P1, P2), and, depending on the detected malfunction, to select one of the trajectories (Tsdt-1, Tsdt-2, Tnot-1, Tnot-2, Tnot-r, Tnot-I) for their own motion control mechanism (STRG1, STRG2).In an advantageous further development, the second standard trajectory Tsdt-2 could also be taken into account by the first motion control mechanism STRG1. The respective motion control mechanisms STRG1 and STRG2, in turn, serve to execute control commands for the vehicle actuator 1, taking into account the respective trajectory Tsdt-1, Tsdt-2, Tnot-1, Tnot-2, Tnot-r, and Tnot-I, so that the vehicle follows the respective trajectory Tsdt-1, Tsdt-2, Tnot-1, Tnot-2, Tnot-r, and Tnot-I.

[0040] In Fig. The respective ASIL classes or levels of the individual subcomponents are listed in section 1. Due to multiple redundancies, the vehicle actuator 1 can be described as an ASIL-D system, while all other components are classified as ASIL-B(D). The first two processor units, P1E1 and P2E1, can even be classified as "QM," meaning "Quality Management." These are components for which all assessed risks are tolerable from a safety perspective.

[0041] Fig. Figure 2 shows an alternative embodiment of the control system according to the invention, in which the two first processor units P1E1, P2E1 are also connected to each other via a communication channel 4. The communication channel 4 enables the first processor unit P1E1 to receive camera images from the second camera CAM2 and the first processor unit P2E1 to receive camera images from the first camera CAM1. Preferably, the first and second cameras CAM1, CAM2 are the two cameras of a stereo camera. Thus, based on stereoscopic vision, each of the two first processor units P1E1, P2E1 can take depth information into account. Since this creates additional redundancy, the radar sensor 2, the lidar sensor 3, and the two first processor units P1E1, P2E1 can now be assigned to ASIL class ASIL-A(D).

[0042] Particularly preferably, the detection of an error in one of the processor units P1E1, P1E2, P2E1, P2E2 is carried out if the respective processor unit P1E1, P1E2, P2E1, P2E2 does not output a trajectory Tsdt-1, Tsdt-2, Tnot-1, Tnot-2, Tnot-r, Tnot-I. Particularly preferably, the emergency trajectories Tnot-1, Tnot-2, Tnot-r, Tnot-I are compared with each other, wherein the second processor unit P1E2 specifically compares the emergency trajectories Tnot-1, Tnot-r, and Tnot-I, and the second processor unit P2E2 compares the emergency trajectories Tnot-2, Tnot-r, and Tnot-I. At least two of the trajectories Tnot-1, Tnot-r, Tnot-I or Tnot-2, Tnot-r, Tnot-I should match. If one of the emergency trajectories Tnot-1, Tnot-2, Tnot-r, Tnot-I deviates from the other emergency trajectories Tnot-1, Tnot-2, Tnot-r, Tnot-I, this means that the respective processor unit P1E1, P1E2, P2E1, P2E2 is exhibiting a malfunction.

[0043] Fig. Figure 3 illustrates the various possible combinations in a table. In the first four columns of the table, "0" represents an error and "1" represents error-free operation. In the columns for "P1" and "P2", "0" means that at least the second processor unit P1E2, P2E2 in the respective signal path has an error, while "1" indicates error-free operation. The value "2" is present when both processor units P1E1, P1E2 or P2E1, P2E2 in the same signal path P1, P2 are operating without errors. The last column of the table specifies the trajectory Tsdt-1, Tsdt-2, Tnot-1, Tnot-2, Tnot-r, Tnot-I to be executed by the vehicle in the respective situation. If both second processor units P1E2, P2E2 exhibit a malfunction, i.e., if the value "0" is present for both columns "P1", "P2", then an emergency braking maneuver BREMS is executed.

[0044] If all processor units P1E1, P1E2, P2E1, and P2E2 are functioning correctly, the underlying SAE Level 3 control system for the vehicle is fully operational. This is indicated by the entry "L3".

[0045] According to a further advantageous embodiment of the control system according to the invention, the respective sensor data to be processed by the processor units P1E1, P1E2, P2E1, P2E2 are filtered in order to reduce the amount of data to be processed. Fig.Figure 4 illustrates a detection area 5 of the respective sensor system, for example, the first and / or second camera CAM1, CAM2, the radar sensor 2, and / or the lidar sensor 3. In a sub-area 6, the left edge of the roadway is detected, in a sub-area 7 the right edge of the roadway, and in a sub-area 8 a vehicle ahead. Irrelevant data points are masked and thus discarded, indicated by hatching. This reduces not only the amount of data that needs to be processed but also the amount of data that needs to be transmitted along paths P1 and P2.

[0046] To detect a malfunction of the processor units P1E1, P1E2, P2E1, P2E2, the left or right edge of the road and / or the vehicle ahead, detected by each sensor modality, can optionally be compared with each other.

[0047] Due to the multiple redundancies, the control system according to the invention is characterized by a particularly simple design while simultaneously fulfilling the specified safety requirements.

Claims

[1] Control system for a vehicle, comprising a first (P1E1) and a second (P1E2) processor unit arranged sequentially in a first signal path (P1), a first (P2E1) and a second (P2E2) processor unit arranged sequentially in a second signal path (P2), and fault detection means, wherein the processor units (P1E1, P1E2, P2E1, P2E2) are configured to receive and process sensor data and to output control commands for actuating a vehicle actuator (1), and the fault detection means are configured to examine the processor units (P1E1, P1E2, P2E1, P2E2) for faults and, depending on the faults detected, to decide which processor unit (P1E1, P1E2, P2E1, P2E2) generates control commands and forwards them to the vehicle actuator (1). characterized by , that - the two second processor units (P1E2, P2E2) are communicating with each other; - the first processor unit (P1E1) in the first signal path (P1) is set up to receive camera images from a first camera (CAM1) and to calculate a first standard trajectory (Tsdt-1) and a first emergency trajectory (Tnot-1) for the vehicle by processing the camera images; - the first processor unit (P2E1) in the second signal path (P2) is configured to receive camera images from a second camera (CAM2) and, by processing the camera images, to calculate a second standard trajectory (Tsdt-2) and a second emergency trajectory (Tnot-2) for the vehicle; - the second processor unit (P1E2) in the first signal path (P1) is configured to receive radar data from a radar sensor (2) and to calculate a radar-based emergency trajectory (Tnot-r) for the vehicle by processing the radar data; - the second processor unit (P2E2) in the second signal path (P2) is configured to receive lidar data from a lidar sensor (3) and to calculate a lidar-based emergency trajectory (Tnot-I) for the vehicle by processing the lidar data; wherein - in the second processor unit (P1E2) a first motion control mechanism (CTRL1) is implemented in the first signal path (P1) and in the second processor unit (P2E2) a second motion control mechanism (CTRL2) is implemented in the second signal path (P2), each configured to execute the control commands so that the vehicle is moved along one of the respective trajectories (Tsdt-1, Tsdt-2, Tnot-1, Tnot-2, Tnot-r, Tnot-I); and - in the second processor unit (P1E2) in the first signal path (P1) a first error detection mechanism (ERROR1) and in the second processor unit (P2E2) in the second signal path (P2) a second error detection mechanism (ERROR2) is implemented, each configured to detect a malfunction of at least the processor units (P1E1, P1E2, P2E1, P2E2) in their own signal path (P1, P2) and, depending on a detected malfunction, to select a trajectory (Tsdt-1, Tsdt-2, Tnot-1, Tnot-2, Tnot-r, Tnot-I) for their own motion control mechanism (CTRL1, CTRL2). [2] Control system according to claim 1, characterized by , that the first (ERROR1) and second error detection mechanisms (ERROR2) are set up to detect an error of a processor unit (P1E1, P1E2, P2E1, P2E2) when the respective processor unit (P1E1, P1E2, P2E1, P2E2) does not output a trajectory (Tsdt-1, Tsdt-2, Tnot-1, Tnot-2, Tnot-r, Tnot-I). [3] Control system according to claim 1 or 2, characterized by , that the first (ERROR1) and second error detection mechanisms (ERROR2) are configured to compare at least three of the first and second emergency trajectories (Tnot-1, Tnot-2), the radar-based emergency trajectory (Tnot-r) and the lidar-based emergency trajectory (Tnot-I) and to detect an error of a processor unit (P1E1, P1E2, P2E1, P2E2) outputting the respective trajectory (Tnot-1, Tnot-2, Tnot-r, Tnot-I) if the trajectory (Tnot-1, Tnot-2, Tnot-r, Tnot-I) deviates from the respective remaining trajectories (Tnot-1, Tnot-2, Tnot-r, Tnot-I) and the remaining trajectories (Tnot-1, Tnot-2, Tnot-r, Tnot-I) are identical to each other. [4] Control system according to claim 3, characterized by, that each processor unit (P1E1, P1E2, P2E1, P2E2) is configured to temporarily store at least the self-calculated trajectories (Tsdt-1, Tsdt2, Tnot-1, Tnot-2, Tnot-r, Tnot-I) as a trajectory sequence and to make it available to the two error detection mechanisms (ERROR1, ERROR2), and that the first (ERROR1) and second error detection mechanisms (ERROR2) are configured to consider trajectory sequences as additional input data for the comparison of at least the emergency trajectories (Tnot-1, Tnot-2, Tnot-r, Tnot-I). [5] Control system according to any one of claims 1 to 4, characterized by , that the first (ERROR1) and second error detection mechanisms (ERROR2) are set up for this purpose: - to select the standard trajectory (Tsdt-1, Tsdt-2) as the trajectory for the own motion control mechanism (CTRL1, CTRL2) in the own signal path (P1, P2) if the first (P1E1, P2E1) and second processor units (P1E2, P2E2) are error-free; - in the case of a faulty first processor unit (P1E1, P2E1) and a fault-free second processor unit (P1E2, P2E2) in its own signal path (P1, P2), to select the radar-based (Tnot-r) or lidar-based emergency trajectory (Tnot-I) as the trajectory for its own motion control mechanism (CTRL1, CTRL2); and - in the case of a faulty first (P1E1, P2E1) and second processor unit (P1E2, P2E2) in the same signal path (P1, P2), to check whether at least the second processor unit (P2E2, P1E2) in the other signal path (P2, P1) is functioning correctly, whereby if this is the case, control commands for the vehicle actuators (1) are determined based on a trajectory (Tsdt-1, Tsdt-2, Tnot-1, Tnot-2, Tnot-r, Tnot-I) of the other signal path (P2, P1); and - the first (CTRL1) and second motion control mechanisms (CTRL2) are designed to control the vehicle actuators (1) to perform an emergency braking maneuver in the event of a fault in at least both second processor units (P1E2, P2E2). [6] Control system according to any one of claims 1 to 5, characterized by, that the second processor unit (P1E2) in the first signal path (P1) and the second processor unit (P2E2) in the second signal path (P2) are capable of communicating with the vehicle actuators (1) via a different communication protocol, in particular each via its own data line (ETH, CAN). [7] Control system according to any one of claims 1 to 6, characterized by , that the first processor units (P1E1, P2E1) are each implemented as a system-on-a-chip and the second processor units (P1E2, P2E2) are each implemented as a microcontroller. [8] Control system according to any one of claims 1 to 7, characterized by, that the two first processor units (P1E1, P2E1) are in communication with each other and the first processor unit (P1E1) in the first signal path (P1) is configured to receive camera images from the second camera (CAM2) and to take them into account in the trajectory calculation and the first processor unit (P2E1) in the second signal path (P2) is configured to receive camera images from the first camera (CAM1) and to take them into account in the trajectory calculation, wherein in particular the first (CAM1) and second camera (CAM2) are part of a stereo camera and the two first processor units (P1E1, P2E1) are configured to generate depth images based on the camera images. [9] Control system according to any one of claims 1 to 8, characterized by, that the first processor units (P1E1, P2E1) are configured to detect a left and / or right edge of the road and / or a vehicle ahead in the respective camera images; and / or the second processor unit (P1E2) in the first signal path (P1) is configured to consider only radar data that can be assigned to the left and / or right edge of the road and / or the vehicle ahead; and / or the second processor unit (P2E2) in the second signal path (P2) is configured to consider only lidar data that can be assigned to the left and / or right edge of the road and / or the vehicle ahead. [10] Control system according to claim 9, characterized by , that the first fault detection mechanism (ERROR1) is configured to detect a fault of the first (P1E1) and / or second processor unit (P1E2) in the first signal path (P1) when a discrepancy occurs between the road edges detected by the first processor unit (P1E1) and the second processor unit (P1E2); and / or The second fault detection mechanism (ERROR2) is designed to detect a fault of the first (P2E1) and / or second processor unit (P2E2) in the second signal path (P2) when a deviation occurs between the road edges detected by the first processor unit (P2E1) and the second processor unit (P2E2). [11] Vehicle comprising at least two cameras (CAM1, CAM2), a radar sensor (2), a lidar sensor (3) and a vehicle actuator (1), characterized by a control system according to any one of claims 1 to 10.

Images