Surroundings sensing system for a vehicle and method for sensing surroundings of a vehicle
Patent Information
- Application Number
- EP2023804621
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2022-11-18
- Filing Date
- 2023-11-06
- Publication Date
- 2025-09-24
AI Technical Summary
Current vehicle environment detection systems lack redundancy and reliability, as sensor failures can lead to inaccurate data affecting system behavior, and existing methods for handling sensor errors are not sufficiently robust or cost-effective.
Implementing an environment detection system with at least two independent groups of sensors, each with different types or overlapping detection areas, using an evaluation device to check sensor data for plausibility and switch to a safe state if discrepancies occur, ensuring minimum redundancy and technological diversification while maintaining safety and reducing costs.
This approach enhances the reliability and safety of vehicle surroundings detection by selecting the most critical result from multiple sensor groups, reducing the risk of sensor failures and maintaining cost-effectiveness through redundancy and sensor type diversification.
Smart Images
Figure 1.1
Abstract
Description
[0001] Description
[0002] Environment detection system for a vehicle and method for detecting the environment of a vehicle
[0003] The invention relates to an environment detection system for a vehicle and a method for detecting the environment of a vehicle.
[0004] A key component of automated driving solutions is environmental perception. This is typically achieved using various types of sensors that can record the properties of the environment and detect or recognize objects in the environment. It is important to be able to detect sensor errors so that various types of errors (e.g., corrupted sensor data or a failure of the sensors or sensor data) cannot affect system behavior. To achieve this, the sensors must be connected to the vehicle in such a way that, with the help of redundancies and monitoring, sensor data can always be provided that accurately describes the environment.
[0005] Techniques for implementing a vehicle response to a sensor failure are known from US 2020 / 0 339 151 A1. In particular, methods are known that include receiving information from a plurality of sensors coupled to a vehicle, determining that a confidence level of the received information from at least one sensor of a first subset of sensors of the plurality of sensors is less than a first threshold, comparing a number of sensors in the first subset of sensors to a second threshold, and adjusting the drivability of the vehicle to rely on information received from a second subset of sensors of the plurality of sensors, wherein the second subset of sensors excludes the at least one sensor of the first subset of sensors.
[0006] The invention is based on the object of improving an environment detection system for a vehicle and a method for detecting the environment of a vehicle. This object is achieved according to the invention by an environment detection system having the features of patent claim 1 and a method having the features of patent claim 10. Advantageous embodiments of the invention are set forth in the subclaims.
[0007] In particular, an environment detection system for a vehicle is created, comprising at least two groups of sensors, wherein the at least two groups of sensors are configured independently of one another with respect to at least one hardware, a power supply and a data communication, and an evaluation device configured to evaluate sensor data detected by the sensors, wherein the at least two groups of sensors and the evaluation device are configured to
[0008] - that two different groups of sensors cover the same environmental area with at least two different sensor types and that the results of the groups derived from the recorded sensor data are compared against each other, whereby in the case of different results, the result that is judged to be more critical is selected and provided, and / or
[0009] - that two different groups of sensors with the same sensor types record environmental areas with a specified minimum overlap of the respective detection areas, and results derived from the recorded sensor data of the groups in the overlap area are plausibly checked against each other, whereby in the case of different results, the result that is considered to be more critical is selected and provided, and / or
[0010] - that results derived from the acquired sensor data of the at least two groups of sensors are checked for plausibility in the environment using predetermined plausibility features; wherein the evaluation device is further configured to transfer the vehicle to a safe state or to initiate the transfer to a safe state if at least one of the aforementioned plausibility checks fails or a predetermined number of sensors has failed.
[0011] Furthermore, in particular, a method for detecting the surroundings of a vehicle is provided, wherein the surroundings are detected by means of at least two groups of sensors, wherein the at least two groups of sensors are operated independently of one another with respect to at least one hardware, a power supply and a data communication, wherein the sensor data detected by means of the sensors are evaluated by means of an evaluation device,
[0012] - where two different groups of sensors cover the same environmental area with at least two different sensor types and the results of the groups derived from the recorded sensor data are checked against each other for plausibility, whereby in the case of different results, the result that is judged to be more critical is selected and provided, and / or
[0013] - where two different groups of sensors with the same sensor types cover surrounding areas with a specified minimum overlap of the respective detection areas, and results derived from the recorded sensor data of the groups in the overlap area are checked against each other for plausibility, whereby in the case of different results, the result that is judged to be more critical is selected and provided, and / or
[0014] - wherein results derived from the recorded sensor data of the at least two groups of sensors are checked for plausibility based on predefined plausibility features in the environment; and wherein the vehicle is transferred to a safe state if at least one of the aforementioned plausibility checks fails or a predefined number of sensors has failed.
[0015] The environment detection system and method enable environment detection to be designed to be redundant, safe, and cost-effective. This is achieved by assigning sensors that detect the vehicle's surroundings to at least two different groups. One or more of the following safety mechanisms is then used: Two different groups of sensors detect the same environmental area using at least two different sensor types (or sensor technologies). The results of the groups derived from the detected sensor data are checked against each other for plausibility. In the event of different results, the result deemed more critical is selected and provided. Alternatively or additionally, two different groups of sensors with the same sensor types detect environmental areas with a specified minimum overlap of the respective detection ranges.Results of the groups derived from the recorded sensor data are checked against each other for plausibility in the overlap area. In the event of different results, the result deemed more critical is selected and provided. The overlap area refers in particular to the detection ranges of the sensors. The specified minimum overlap is in particular 99% of the detection ranges of the sensors or groups of sensors under consideration. Alternatively or additionally, results derived from the recorded sensor data of the at least two groups of sensors are checked for plausibility in the environment using specified plausibility features. It is intended that the vehicle is transferred to a safe state if at least one of the aforementioned plausibility checks fails or a specified number of sensors has failed.A sensor failure can be detected, for example, by the respective sensor itself and / or by the evaluation device. The specified number is, in particular, a minimum number. The specified number can be determined, for example, based on empirical tests and / or simulations. With regard to the groups, the environment detection system is configured, in particular, so that one of the groups is sufficient in terms of environment detection to transfer the vehicle to a safe state.
[0016] The advantages of the environmental detection system and the method are that they allow for minimal redundancy and technological diversification in terms of sensor types. The environmental detection system enables more reliable environmental detection while simultaneously reducing costs.
[0017] Sensors or sensor types may include, in particular, the following: cameras, stereo cameras, lidar sensors, radar sensors, ultrasonic sensors and / or thermal imaging cameras, etc.
[0018] In the simplest case, a result can include the sensor data itself. However, a result particularly includes information derived from the acquired sensor data.
[0019] Plausibility checking refers, in particular, to checking recorded sensor data and / or the results derived therefrom. Plausibility checking may, for example, include comparing sensor data and / or results. Plausibility checking may also include determining a deviation in sensor data and / or results and comparing it with at least one threshold value related to the determined deviation.
[0020] Criticality is a measure used to assess the influence of the environment or an element of the environment on the integrity and / or safety of the vehicle. The greater the criticality, the greater the influence of the environment or an element of the environment on the integrity and / or safety of the vehicle. For example, a large, solid obstacle in front of a vehicle approaching this obstacle has a greater criticality than a plastic bag floating in the air in front of the vehicle. In a comparison, something is judged to be more critical if it has a higher value of the measure used to assess the influence, i.e. a higher value of the criticality.
[0021] A vehicle is, in particular, a motor vehicle. However, a vehicle can also be any other land, rail, water, air, or space vehicle, such as a drone or an air taxi.
[0022] Parts of the environment detection system, in particular the evaluation device, can be implemented individually or collectively as a combination of hardware and software, for example, as program code executed on a microcontroller or microprocessor. However, it can also be provided that parts are implemented individually or collectively as an application-specific integrated circuit (ASIC) and / or a field-programmable gate array (FPGA).
[0023] In one embodiment, the at least two groups of sensors and / or the evaluation device are configured to perform object recognition separately for at least each of the groups of sensors. This also provides redundant object recognition. Object recognition is performed using conventional computer vision and / or artificial intelligence methods, for example, machine learning. Object recognition provides the result of objects detected in the environment (e.g., in the form of an object type and an associated position in the environment).
[0024] In one embodiment, the criticality of the results is assessed based on at least one predefined criticality criterion. A criticality criterion is, in particular, a specification for the measure used to assess the influence of the environment or an element of the environment on the integrity and / or safety of the vehicle. In a simple case, the criticality criterion comprises, for example, a threshold value or a predefined classification ranking or order for such a measure. In principle, however, the criticality criterion can also be designed to be more complex, in particular multidimensional. The criticality criterion can also comprise and / or define one or more conditions.In one embodiment, the results based on the acquired sensor data include objects detected in the environment, wherein the at least one predefined criticality criterion includes or contains an object's existence. This allows the object's existence to be used to assess criticality. The object's existence includes, in particular, information about whether or not the object was detected in the acquired sensor data. If an object was detected by one group but not by another, the result of the group that detected the object is assessed as more critical and, in particular, is provided as the (overall) result of the environment detection system.
[0025] In one embodiment, the results, based on the acquired sensor data, include objects detected in the environment, wherein the at least one predefined criticality criterion comprises or includes an object type. This allows the object type to be used to assess criticality. The object type includes, in particular, information about the type of object detected in the respectively acquired sensor data. A criticality can be assigned to the object types. For example, a boulder or a tree trunk on a road is more critical to the vehicle than a plastic bag floating in front of the vehicle.If one group records an object type with a higher assigned criticality than another group, the result of the group that recorded the object with higher criticality is assessed as more critical and, in particular, provided as the (overall) result of the environmental detection system. For example, the evaluation system can store an assignment of objects to respective criticality values, which forms the basis for an assessment.
[0026] In one embodiment, it is provided that the results, based on the recorded sensor data, comprise objects detected in the surroundings, wherein the at least one predetermined criticality criterion comprises or includes an object size and / or an object distance from the vehicle. In this way, the object size and / or the object distance from the vehicle can be taken into account as criteria for criticality. For example, larger objects (e.g. boulders or tree trunks) are generally more critical for the vehicle than smaller objects (e.g. pebbles or branches). As a rule, objects detected closer to the vehicle are also to be assessed as more critical, since there is less time to react. This can be taken into account as a respective criticality criterion. In one embodiment, it is provided that the evaluation device is further configured to keep the predetermined plausibility features available in an environment map and / or retrieve them from this.This allows suitable plausibility check features to be determined and specified depending on the vehicle's current position. This is done, in particular, by searching the environment map for the vehicle's current position, identifying suitable plausibility check features in the environment, and comparing the identified plausibility check features with the features (or objects) found in the environment based on the recorded sensor data and / or the results derived from this. If the specified plausibility check features are detected in the environment, i.e., if the features detected in the environment (especially objects) and, in particular, their positions match the plausibility check features stored in the map for this environment, the plausibility check is completed successfully. Otherwise, the plausibility check fails.For example, it may be specified that a traffic light must be detected at a location in the surrounding area because a traffic light is stored as a plausibility feature for this location in the surrounding area map. In principle, other types of objects can also be used as plausibility features, such as walls, buildings, road markings, traffic signs, etc. It may also be specified that plausibility features are set up or arranged solely for this purpose, for example, in the form of traffic signs and / or on buildings, etc.
[0027] In one embodiment, the environment detection system comprises at least three groups of sensors, wherein the evaluation device is configured to carry out a plausibility check of the results of the groups derived from the respective acquired sensor data against each other on the basis of an m-out-of-n decision and / or to make and provide an overall result based on the results of the respective groups of sensors derived from the respective acquired sensor data on the basis of an m-out-of-n decision. In this way, a majority decision can serve as the basis for the plausibility check and the derivation of an (overall) result. This is particularly advantageous when there is a greater redundancy (i.e. at least three groups of sensors).
[0028] In particular, a vehicle is also provided, comprising at least one environment detection system according to one of the described embodiments. Further features for the design of the method will become apparent from the description of embodiments of the environment detection system. The advantages of the method are the same as those of the embodiments of the environment detection system.
[0029] The invention will be explained in more detail below using preferred embodiments with reference to the figures.
[0030] Fig. 1 is a schematic representation of an embodiment of the environment detection system;
[0031] Fig. 2 is a schematic diagram illustrating embodiments of the environment detection system;
[0032] Fig. 3 is a schematic diagram to illustrate further embodiments of the environment detection system.
[0033] Fig. 1 shows a schematic representation of an embodiment of the environment detection system 1. The environment detection system 1 is arranged in particular in a vehicle 50. The environment detection system 1 comprises (at least) two groups 2, 3 of sensors 2-x, 3-x, wherein the two groups 2, 3 of sensors 2-x, 3-x are configured independently of one another with regard to at least one piece of hardware, a power supply, and data communication. Furthermore, the environment detection system 1 comprises an evaluation device 4 configured to evaluate sensor data 10 acquired by the sensors 2-x, 3-x. The evaluation device 4 comprises, for example, a computing device 4-1 and a memory 4-2. The computing device 4-1 executes suitable program code for the evaluation. The evaluated sensor data 10 are provided in particular as results 40-x and / or further processed.
[0034] The two groups 2, 3 of sensors 2-x, 3-x and the evaluation device 4 are configured so that the two (different) groups 2, 3 of sensors 2-x, 3-x capture the same surrounding area with at least two different sensor types, and results 40-2, 40-3 of groups 2, 3 derived from the captured sensor data 10 are checked against each other for plausibility. If the results 40-2, 40-3 differ, the result 40-2, 40-3 that is judged to be more critical is selected and provided. For example, it can be provided that group 2 has exclusively cameras as sensors 2-x, while group 3 has exclusively lidar sensors or radar sensors. The surrounding area is then captured by both the cameras and the lidar sensors or radar sensors. This embodiment is illustrated schematically in Fig. 2 for groups 2, 3 using the respective detection ranges.In principle, further groups with other types of sensors, such as thermal imaging cameras, ultrasonic sensors or (environmental) cameras, can also be provided.
[0035] In particular, the selected and provided more critical result 40-2, 40-3 is further processed by means of a vehicle control 51.
[0036] Alternatively or additionally, the two groups 2, 3 of sensors 2-x, 3-x and the evaluation device 4 are configured so that the two (different) groups 2, 3 of sensors 2-x, 3-x, using the same sensor types, detect environmental areas with a predetermined minimum overlap of the respective detection areas, and the results 40-2, 40-3 of groups 2, 3 derived from the detected sensor data 10 are checked against each other in the overlap area for plausibility. If the results 40-2, 40-3 differ, the result 40-2, 40-3 that is judged to be more critical is selected and provided. For example, it can be provided that both group 2 and group 3 have cameras as sensors 2-x. The environment is then detected by both the cameras of group 2 and the cameras of group 3. This embodiment is shown schematically in Fig.3 for groups 2, 3 is illustrated based on the respective detection ranges (the reference numerals of groups 2, 3 have been omitted for clarity, only the associated sensors 2-x, 3-x). In principle, this embodiment can also include further groups and / or be provided for other sensor types, for example, thermal imaging cameras, ultrasonic sensors, radar sensors, or lidar sensors.
[0037] Alternatively or additionally, results 40-2, 40-3 of the two groups 2, 3 of sensors 2-x, 3-x derived from the acquired sensor data 10 are checked for plausibility in the environment using predefined plausibility features 21. The plausibility features 21 predefined for an environment can be retrieved, for example, from an environment map 20 (Fig. 1) stored in the memory 4-2. The exemplary plausibility feature 21 (Fig. 3) is arranged in the (current) environment of the vehicle 50 and is acquired by the sensors 2-x, 3-x of groups 2, 3. For plausibility checking, it is checked in particular whether the results 40-2, 40-3 derived from the sensor data 10 acquired by the sensors 2-x, 3-x match the plausibility feature 21 (e.g., with regard to a type and a position).If the plausibility feature 21 is, for example, a traffic light, a check is carried out to determine whether, based on the recorded sensor data 10 of sensors 2-x, 3-x, the object or feature "traffic light" was also detected at the corresponding position in the (current) environment stored in the environment map 20. If this is the case, the results 40-2, 40-3 derived from the recorded sensor data 10 of sensors 2-x, 3-x are assessed as plausible; otherwise, they are assessed as implausible.
[0038] The evaluation device 4 is further configured to transfer the vehicle 50 to a safe state or to initiate the transfer to a safe state if at least one of the aforementioned plausibility checks fails or a predetermined number of sensors 2-x, 3-x has failed. This is achieved, in particular, by the evaluation device 4 transmitting a control signal 30 to a vehicle control system 51, which then controls an actuator system 52 of the vehicle 50 accordingly.
[0039] It can be provided that the two groups 2, 3 of sensors 2-x, 3-x and / or the evaluation device 4 are configured to perform object recognition separately for at least each of the groups 2, 3 of sensors 2-x, 3-x. Object recognition can already be performed in the sensors 2-x, 3-x and / or by means of the sensors 2-x, 3-x and / or by means of the evaluation device 4. Known computer vision and / or artificial intelligence methods, such as machine learning, can be used here.
[0040] It may be provided that an assessment of the criticality of the results 40-2, 40-3 is carried out based on at least one predefined criticality criterion 15. The criticality criterion 15 is specified externally and / or is or is stored in the memory 4-2.
[0041] It can be provided that the results 40-2, 40-3, based on the acquired sensor data 10, comprise objects 22 detected in the environment (Fig. 3), wherein the at least one predetermined criticality criterion 15 comprises or includes an object existence. This can be illustrated with reference to Fig. 3. If, for example, the sensors 2-x detect the object 22, but the sensors 3-x do not, the sensor data 10 or the results 40-2 derived therefrom of the sensors 2-x are assessed as more critical, since a detected
[0042] Object 22 is potentially more dangerous for vehicle 50 than an open area or no object 22. Furthermore, the incorrect detection or recognition of object 22 is less dangerous than the incorrect detection that no object 22 is present. Therefore, processing continues with sensor data 10 or with the result 40-2 of sensors 2-x that detected the existence of object 22.
[0043] It can be provided that the results 40-2, 40-3, based on the acquired sensor data 10, include objects detected in the environment, wherein the at least one predetermined criticality criterion 15 comprises or includes an object type. In particular, objects 22 are assessed as more critical the greater the (mechanical) influence of these objects 22 on the vehicle 50. For example, a boulder is assessed as more critical than a plastic bag.
[0044] It can be provided that the results, based on the acquired sensor data 10, include objects 22-x detected in the surroundings (Fig. 2), wherein the at least one predetermined criticality criterion 15 comprises or includes an object size and / or an object distance from the vehicle 50. This is illustrated schematically in Fig. 2. A single object 22-2, 22-3 is shown there, which, however, is detected by groups 2, 3 of sensors 2-x, 3-x at different positions in the surroundings (the number at the end of the reference symbol designates group 2 or 3). Since an object distance of the detected object 22-3 is smaller than an object distance of the detected object 22-2, the object 22-3 is assessed as more critical and is therefore used as the (overall) result 25. A corresponding scenario can arise if both groups 2, 3 determine the same object distances, but an object size determined from the sensor data 10 differs.In this case, the object size with the larger value is assessed as more critical and accordingly provided as (overall) result 25.
[0045] It can be provided that the environment detection system 1 has at least three groups 2, 3, 5 (Fig. 1) of sensors 2-x, 3-x, 5-x, wherein the evaluation device 4 is configured to perform a plausibility check of the results 40-x of the groups 2, 3, 5 derived from the respective acquired sensor data 10 against each other on the basis of an m-out-of-n decision and / or to make and provide an overall result 25 based on the results 40-x of the respective groups 2, 3, 5 of sensors 2-x, 3-x, 5-x derived from the respective acquired sensor data 10 on the basis of an m-out-of-n decision. For example, within the framework of a 2-out-of-3 decision, those sensor data 10 and / or results 40-x that have a 2-out-of-3 majority can be considered plausible.For example, if groups 2 and 3 detect the same object 22, but group 5 does not, the sensor data 10 of sensors 2-x, 3-x of groups 2 and 3 are assessed as plausible and / or an overall result 25 is generated and provided based on the sensor data 10 and / or the results 40-2, 40-3 of groups 2 and 3. Result 40-5 of group 5, however, is discarded.
[0046] List of reference symbols
[0047] Environment detection system
[0048] Group -x Sensor
[0049] Group -x Sensor
[0050] Evaluation device -1 Computing device -2 Memory
[0051] Group -x Sensor 0 Sensor data 5 Criticality criterion 0 Environment map 1 Plausibility feature 2 Object 2-2 Object (detected by group 2) 2-3 Object (detected by group 3) 5 Overall result 0 Control signal 0-x Result 0 Vehicle 1 Vehicle control 2 Actuators
Claims
An environment detection system (1) for a vehicle (50), comprising: at least two groups (2, 3, 5) of sensors (2-x, 3-x, 5-x), wherein the at least two groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) are configured independently of one another with respect to at least one piece of hardware, a power supply, and a data communication, and an evaluation device (4) configured to evaluate sensor data (10) acquired by the sensors (2-x, 3-x, 5-x), wherein the at least two groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) and the evaluation device (4) are configured to - that two different groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) record the same environmental area with at least two different sensor types and results of the groups (2, 3, 5) derived from the recorded sensor data (10) are checked against each other for plausibility, whereby in the case of different results, the result which is judged to be more critical is selected and provided, and / or - that two different groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) with the same sensor types detect environmental areas with a predetermined minimum overlap of the respective detection areas, and results of the groups (2, 3, 5) derived from the detected sensor data (10) are checked against each other in the overlap area for plausibility, whereby in the case of different results, the result which is judged to be more critical is selected and provided, and / or - that results derived from the acquired sensor data (10) of the at least two groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) are checked for plausibility in the environment using predetermined plausibility features (21); wherein the evaluation device (4) is further configured to transfer the vehicle (50) to a safe state or to initiate the transfer to a safe state if at least one of the aforementioned plausibility checks fails or a predetermined number of sensors (2-x, 3-x, 5-x) has failed. Environment detection system (1) according to claim 1, characterized in that the at least two groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) and / or the evaluation device (4) are configured to carry out object detection separately for at least each of the groups (2, 3, 5) of sensors (2-x, 3-x, 5-x). Environment detection system (1) according to claim 1 or 2, characterized in that an assessment of the criticality of the results is carried out on the basis of at least one predetermined criticality criterion (15). Environment detection system (1) according to claim 2 or 3, characterized in that the results, based on the detected sensor data (10), comprise objects (22, 22-x) detected in the environment, wherein the at least one predetermined criticality criterion (15) comprises or includes an object existence.Environment detection system (1) according to one of claims 2 to 4, characterized in that the results based on the acquired sensor data (10) comprise objects (22, 22-x) detected in the environment, wherein the at least one predetermined criticality criterion (15) comprises or includes an object type. Environment detection system (1) according to one of claims 2 to 5, characterized in that the results based on the acquired sensor data (10) comprise objects (22, 22-x) detected in the environment, wherein the at least one predetermined criticality criterion (15) comprises or includes an object size and / or an object distance from the vehicle (50). Environment detection system (1) according to one of claims 1 to 6, characterized in that the evaluation device (4) is further configured to keep the predetermined plausibility features (21) available in an environment map (20) and / or to retrieve them from this.Environment detection system (1) according to one of claims 1 to 7, characterized by at least three groups (2, 3, 5) of sensors (2-x, 3-x, 5-x), wherein the evaluation device (4) is set up to carry out a plausibility check of the results of the groups (2, 3, 5) derived from the respective recorded sensor data (10) against each other on the basis of an m-out-of-n decision and / or to calculate an overall result (25) based on the results from the respective. The method comprises: determining and providing the results of the respective groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) derived from the acquired sensor data (10) based on an m-out-of-n decision. A vehicle (50) comprising at least one environment detection system (1) according to one of claims 1 to 8. A method for detecting the environment of a vehicle (50), wherein the environment is detected by means of at least two groups (2, 3, 5) of sensors (2-x, 3-x, 5-x), wherein the at least two groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) are operated independently of one another with respect to at least one piece of hardware, a power supply, and a data communication system, wherein the sensor data (10) acquired by means of the sensors (2-x, 3-x, 5-x) is evaluated by means of an evaluation device (4). - wherein two different groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) record the same environmental area with at least two different sensor types and results of the groups (2, 3, 5) derived from the recorded sensor data (10) are checked against each other for plausibility, wherein in the case of different results, the result which is judged to be more critical is selected and provided, and / or - wherein two different groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) with the same sensor types detect environmental areas with a predetermined minimum overlap of the respective detection areas, and results of the groups (2, 3, 5) derived from the detected sensor data (10) are checked against each other in the overlap area for plausibility, wherein in the case of different results, the result which is judged to be more critical is selected and provided, and / or - wherein results of the at least two groups (2, 3, 5) of sensors (2-x, 3-x, 5-x) derived from the acquired sensor data (10) are checked for plausibility in the environment using predetermined plausibility features (21); and wherein the vehicle (50) is transferred to a safe state if at least one of the aforementioned plausibility checks fails or a predetermined number of sensors (2-x, 3-x, 5-x) has failed.