Method for controlling an autonomous vehicle, and vehicle

Abstract

The invention relates to a method for controlling a vehicle (1) comprising multiple subsystems (2), wherein the vehicle (1) is controlled autonomously by a motion control unit (20) that is designed to determine a target trajectory on the basis of a mission specification (VM) and / or a route specification (VR) and to communicate with and / or actuate at least some of the subsystems (2) such that the vehicle (1) moves from a starting point to a destination point, wherein the method comprises at least the following steps: - monitoring at least one subsystem (2) of the vehicle (1) for the presence of a fault, and in the event that at least one fault has been detected in the at least one monitored subsystem (2) based on which the subsystem (2) in question is able to be operated only at a reduced functional level: - classifying the at least one fault into a fault class; - adapting the mission specification (VM) and / or the route specification (VR) and / or the target trajectory on the basis of the fault class of the respectively detected fault.

Description

[0001] Method for controlling an autonomous vehicle and vehicle

[0002] The present invention relates to a method for controlling an autonomous vehicle, as well as a vehicle for carrying out the method.

[0003] In an autonomous vehicle, which normally comprises several subsystems, a motion control unit typically coordinates the input of a mission specification and / or generates a route specification from it, which corresponds, for example, to a target trajectory. The motion control unit then communicates with at least some of the subsystems and / or automatically controls at least some of the subsystems depending on this target trajectory so that the vehicle moves from a starting point to a destination point along a roadway to implement the mission specification and / or the route specification. If errors occur in such an automated system, the vehicle is generally brought into a safe state, for example, parked at the side of the road, regardless of the type of error.

[0004] DE 10 2019213 512 A1 describes monitoring the service brake system for a fault and, if a fault is detected in the service brake system, providing a backup function via a backup brake system, thus maintaining ferry operations. However, no other adjustments to ferry operations are provided. Further backup functions as replacements for certain braking functions in the vehicle are described in DE 10 2011 016 740 A1.

[0005] The object of the present invention is to provide a method for controlling an autonomous vehicle that ensures safe operation of the vehicle even in the event of a fault. A further object is to provide a vehicle.

[0006] These objects are achieved according to the invention by a method and a vehicle according to the independent claims, wherein the subclaims describe preferred developments and embodiments. According to the invention, a method for controlling a vehicle with multiple subsystems is provided, wherein the vehicle is controlled autonomously by a motion control unit, wherein the motion control unit is configured to determine a target trajectory depending on a mission specification and / or a route specification and to communicate with at least some of the subsystems and / or to control at least some of the subsystems depending on the target trajectory, so that the vehicle moves from a starting point to a destination point along a roadway to implement the mission specification and / or the route specification, wherein the method comprises at least the following steps:

[0007] - Monitoring at least one subsystem of the vehicle for the presence of a fault, and in the event that at least one fault has been detected in the at least one monitored subsystem, as a result of which the subsystem in question can only be operated at a reduced level of functionality:

[0008] - Classifying the at least one error into an error class;

[0009] - Adapting the mission specification and / or the route specification and / or the target trajectory depending on the error class of the detected error.

[0010] Advantageously, when a fault is detected in one of the vehicle's subsystems, the mission or route or target trajectory of the vehicle is initially adjusted as a fault reaction or mitigating measure. This occurs depending on the influence the fault has on the vehicle's driving behavior and the degree to which the function of the subsystem is restricted. According to the invention, the hazard posed by the vehicle in the event of a fault with the reduced level of functionality is initially minimized by adapting the mission, route or target trajectory accordingly. If, for example, there is a fault with a moderate influence on the driving behavior, the mitigating measure or fault reaction can be to divert the vehicle to secondary routes or routes that are manageable with the fault or the reduced level of functionality. In the case of smaller or more influential faults orIf the functionality of the respective subsystem is slightly or severely reduced, the mitigation measures or the error response will then be different depending on the error class. Preferably, it can further be provided that, if an error is detected in the at least one monitored subsystem, as a result of which the subsystem in question can only be operated at a reduced level of functionality, a backup function is activated by the subsystem in question and / or by one of the other subsystems, wherein the activated backup function at least partially compensates for the detected error to a compensation level. In addition, an attempt is therefore made to at least partially compensate for the error in order to be able to maintain ferry operations as safely as possible, even with an adapted mission, route, or target trajectory.

[0011] Preferably, it is then additionally provided that the mission specification and / or the route specification and / or the target trajectory is / are adjusted depending on the degree of compensation to which the backup function can compensate for the reduced functionality of the subsystem in question. This can advantageously ensure that, in the event that the error can be compensated (at least partially) in another way, the mission, route, or target trajectory requires less adjustment. The mitigation measure or error response can therefore be selected to be "stronger" or "weaker" depending on the degree of compensation of the respective backup function.

[0012] Preferably, the mission specification and / or the route specification and / or the target trajectory are adapted in such a way, preferably depending on the compensation level of the backup function and / or the remaining functional level of the relevant subsystem, that after the adjustment of the mission specification and / or the route specification and / or the target trajectory, the vehicle only moves on roads and / or to a destination point with a specified surface characteristic. It can therefore advantageously be specified that, as a mitigation measure, the vehicle only moves on surfaces that are manageable under the reduced (compensated) functional level.

[0013] For example, it can be provided that a gradient and / or a surface condition and / or a coefficient of friction and / or a curvature and / or a change in curvature of the roadway and / or the target point are specified as the subsurface property, preferably depending on the degree of compensation of the backup function and / or the remaining functional level of the relevant subsystem. Thus, in the event of a failure of the subsystems that impair longitudinal or transverse stability, mitigation measures can be implemented to only cover sections where stability-critical situations in the longitudinal or transverse direction can no longer occur or can be avoided.

[0014] Thus, it can preferably be provided that the mission specification and / or the route specification and / or the target trajectory are adapted in such a way that the autonomously controlled vehicle, depending on this, only moves on lanes and / or to a destination point on which

[0015] - the gradient falls below a limit gradient, and / or

[0016] - the friction coefficient exceeds a specified limit friction coefficient, and / or

[0017] - the curvature falls below a curvature limit, and / or

[0018] - the change in curvature falls below a change limit, whereby the limit gradient and / or the limit friction coefficient and / or the curvature limit and / or the change limit are determined depending on the degree of compensation of the backup function and / or the remaining functional level of the subsystem in question.

[0019] For example, only slightly curved roads can be driven in the event of a (partial) failure of the anti-roll bar system, or roads with a slight gradient in the event of a (partial) failure of the brakes or drive system. This allows for the vehicle to avoid stability-critical situations in the event of a failure and still continue operation. Advantageously, this allows for appropriate response to the reduced functionality in each situation.

[0020] Preferably, it can further be provided that the mission specification and / or the route specification and / or the target trajectory are adjusted in such a way, preferably depending on the degree of compensation of the backup function and / or the remaining functional level of the relevant subsystem, that after the adjustment of the mission specification and / or the route specification and / or the target trajectory, the vehicle only moves on lanes and / or to a destination point where an external environmental disturbance, for example, a crosswind strength, falls below a disturbance threshold. Accordingly, other external disturbances on the faulty ferry operation can also be taken into account.

[0021] Preferably, it can further be provided that the adjustment of the mission specification and / or the route specification and / or the target trajectory takes into account the probability of failure in the event of a failure of the remaining backup function. Advantageously, the robustness of the influence of the degree of compensation is also assessed, and whether this could potentially disappear during the course of the mitigation measure. This then has a corresponding impact on the selected mitigation measure or error response, in particular on the adjustment of the route or mission.

[0022] Preferably, it is further provided that the vehicle has as a subsystem at least one parking brake system with at least one pneumatically operated spring brake and / or a service brake system with at least one pneumatically operated service brake, wherein the at least one spring brake and / or the at least one service brake are pneumatically operated with pressure medium from a pressure medium supply.According to a preferred embodiment, it can then be provided that, upon detection of a parking brake fault in the vehicle's parking brake system, due to which the at least one spring-loaded brake can no longer be controlled or can only be controlled to a limited extent by a parking brake control unit, a backup function is provided by controlling the at least one service brake of the service brake system instead of the at least one spring-loaded brake or in addition to the at least one spring-loaded brake in such a way that the detected parking brake fault is at least partially compensated to a degree of compensation. When selecting the mitigation measure or fault reaction, it is therefore additionally taken into account that the service brake can step in to replace or compensate for the (reduced or failed) function of the parking brake while the vehicle is traveling the route or executing the mission.

[0023] In particular, it can be provided that the at least one spring-loaded brake and the at least one service brake are pneumatically operated with pressure medium from the same pressure medium supply, wherein the backup function is provided by the at least one service brake of the service brake system being activated once or repeatedly in such a way that a supply pressure of the pressure medium supply is reduced to a limit supply pressure, wherein the at least one spring-loaded brake is applied or pulled when the limit supply pressure is reached or undershot in order to at least partially compensate for the detected parking brake error to a degree of compensation. The pressure medium supply is therefore "sucked dry" by actuating the service brake, so that the vehicle can still be parked safely using the parking brake, even if the parking brake can not be activated or can only be activated to a limited extent.In this way, route or mission planning can be adapted according to the degree of compensation to be achieved and safe parking or a safe parking option can still be guaranteed.

[0024] Preferably, it is further provided that the backup function is provided by controlling the at least one service brake of the service brake system in such a way that the vehicle is held stationary solely by the at least one service brake in order to compensate for the detected parking brake error, wherein the remaining quantity of pressure medium with which the at least one service brake is pneumatically operated is preferably taken into account in order to determine the compensation level of the backup function with which the detected parking brake error is at least partially compensated to a compensation level. It is therefore additionally assessed how long the service brake could replace a parking brake function in order to keep the vehicle stationary on the route or during the mission, for example until a repair opportunity can arrive. The mitigating measure or error reaction can then be cancelled accordingly.

[0025] Preferably, it is further provided that when a service brake fault is detected in the service brake system of the vehicle, as a result of which the at least one service brake cannot be controlled or can only be controlled to a limited extent by a service brake control unit and / or as a result of which a stability control system of the service brake system cannot be operated or can only be operated to a limited extent, depending on the degree of compensation of the respectively activated backup function and / or the remaining degree of functionality of the service brake system and / or the error class of the service brake fault, at least one driving dynamics variable of the vehicle is to be limited, which is selected from the group consisting of: lateral acceleration, longitudinal acceleration, vehicle speed, steering angle, steering angle gradient, steering speed, steering torque.As a mitigating measure, it can also be specified that the vehicle will only continue to be operated under certain driving dynamic restrictions in order to react accordingly to a fault of a certain fault class.

[0026] Preferably, it is further provided that, in the event of a detected steering system error in a steering system of the vehicle, due to which a steering request cannot be implemented automatically or can only be implemented to a limited extent, a backup function is provided by the service brake system causing a different braking of the vehicle on each side such that the vehicle is steered depending on the steering request in order to at least partially compensate for the detected steering system error to a certain degree of compensation. Accordingly, the mitigation measure can also be determined depending on the extent to which the faulty steering function can be compensated by steering braking.

[0027] Preferably, it is further provided that the mission specification and / or the route specification and / or the target trajectory are adjusted in such a way that, after the adjustment of the mission specification and / or the route specification and / or the target trajectory, the vehicle is automatically brought to a standstill within a remaining time, wherein the remaining time is determined depending on the degree of compensation of the backup function and / or the remaining functional level of the relevant subsystem. Advantageously, continued faulty operation of the vehicle is therefore not permanently permitted, even if compensation is present, in order to minimize the hazard due to the error and any subsequent errors.

[0028] Preferably, it is further provided that, upon detection of an error in at least one of the subsystems, a warning is generated and issued to other road users, preferably via a V2X connection. The warning is generated depending on the error class of the respective error. Thus, surrounding traffic can be warned, particularly in the case of an automated vehicle, so that the surrounding traffic itself can react with the necessary caution, for example, if a serious error occurs.

[0029] Preferably, the vehicle further comprises at least one trailer, wherein the trailer is monitored for the presence of a trailer fault. If a trailer fault is detected in the monitored trailer, as a result of which the trailer can only be operated at a reduced level of functionality, the trailer fault is classified into a fault class, and the mission specification and / or the route specification and / or the target trajectory are adjusted depending on the fault class of the trailer fault. The trailer itself can thus be considered an additional subsystem for which a corresponding mitigating measure can be initiated if a fault of a specific fault class is present.

[0030] In particular, it can be provided that the mission specification and / or the route specification and / or the target trajectory are adjusted in such a way that the trailer is transferred to a parked state and, depending on the error class and / or the remaining functional level of the trailer, is separated from the vehicle. This allows the towing vehicle, for example, to continue operating and the route or mission, depending on the error class, to be continued even without the trailer.

[0031] Preferably, it is further provided that the at least one monitored subsystem of the vehicle is selected from the group consisting of: - drive system, in particular comprising a transmission system, an engine system, a differential system,

[0032] - Wheel system, in particular comprising a wheel end and a tire,

[0033] - suspension system, in particular an electronic air suspension system,

[0034] - Environment detection system, e.g. with a camera, a laser sensor, an Ll-DAR sensor,

[0035] - Localization system, e.g., satellite positioning. This allows for fault monitoring and classification for a number of other vehicle subsystems that are critical to operation, with appropriate mitigation measures being implemented in the event of a fault.

[0036] The invention is explained in more detail below with reference to the accompanying drawings. They show:

[0037] Fig. 1 is a schematic view of a vehicle with multiple subsystems; and

[0038] Fig. 2 is a flow chart of the method according to the invention.

[0039] Figure 1 shows a highly schematic view of a vehicle 1 with several subsystems 2, namely a service brake system 6 with service brakes 6a and a stability control system 6b and a service brake control unit 6c for electrically controlling the service brake system 6, a parking brake system 4 with spring brakes 4a and a parking brake control unit 4b for electrically controlling the parking brake system 4, an automated steering system 8 with an electrically controllable steering actuator 8a, a drive system 10, in particular comprising a transmission system 10a, an engine system 10b and a differential system 10c, at least four wheel systems 12, each in particular comprising a

[0040] Wheelend 12a and a tire 12b, a suspension system 14, in particular an electronic air suspension system 14a, an environment detection system 16, e.g. with a camera 16a, a laser

[0041] Sensor 16b, a LIDAR sensor 16c, etc., and a localization system 18, e.g. a satellite positioning system 18a, in particular GPS, GLONASS, etc.

[0042] Further, unmentioned subsystems 2 may also be provided in the vehicle 1. The vehicle 1 shown moves on a roadway 3 with a certain surface property E, e.g. with a certain gradient EN, with a certain surface condition EB (gravel, asphalt, snow, rain), with a certain coefficient of friction ER, with a certain curvature EK or a corresponding change in curvature EKA.

[0043] Furthermore, a movement control unit 20 is provided, in which a mission planning system 13, a route planning system 15, and a trajectory control system 17 are integrated. The mission planning system 13 serves to record or read in a mission specification VM, for example, "delivery of cargo from a starting point A to a destination point Z." The route planning system 15 serves to determine or read in a route specification VR, which contains the planned path of the vehicle 1 along a specific route from the starting point A to the destination point Z, preferably in the form of a target trajectory TSoll, along which the vehicle 1 is to move from A to Z. The above-mentioned ground properties E can also be assigned to the starting point A and the destination point Z.

[0044] The trajectory control system 17 ensures that the respective subsystems 2 in the vehicle 1 are controlled or that communication is carried out with certain subsystems 2 in the vehicle 1, preferably via a serial data connection, in particular a data bus system 7, preferably a CAN bus, in order to cause the vehicle 1 to move along the desired trajectory Tdesired. This is done using the respective subsystems 2 (braking system (4, 6), drive system 10, steering system 8, wheel system 12, suspension system 14, and possibly others), which influence or co-determine the movement of the vehicle 1, and by communicating with the respective subsystems 2 (environment detection system 16, localization system 18, and possibly others), which are involved in monitoring the vehicle 1, i.e. observing the environment U and localizing the vehicle 1. Accordingly, a fully automated orAutonomous control, preferably according to SAE Level 4 or 5, can take place, in which the vehicle 1 is controlled driverless or without recourse to a driver along the target trajectory TSoll and this movement is monitored with regard to whether the target trajectory TSoll is adhered to and / or collisions with other road users 50 are avoided. The movement of the vehicle 1 is therefore coordinated centrally and autonomously by the movement control unit 20. Furthermore, a monitoring system 22 is provided, via which the autonomous operation of the vehicle 1 is continuously monitored, wherein the monitoring system 22 can, for example, be a component of the movement control unit 20 or can at least exchange data with it, so that, as described below, a response can be made to a detected error F2 in one or more of the aforementioned subsystems 2 or to a degraded availability of the respective subsystem 2. For this purpose, the example shown in Fig.2 procedures are provided:.

[0045] Accordingly, it is provided that after an initial (STO) determination of the target trajectory TSoll depending on the mission specification VM and / or the route specification VR by the motion control unit 20, error monitoring takes place continuously in a monitoring step ST1, while the vehicle 1 is automatically controlled via the trajectory control system 17 depending on the target trajectory TSoll. Within the scope of the error monitoring, at least one of the subsystems 2 of the vehicle 1 is monitored for the presence of an error F2 or for the availability of the respective subsystem 2.

[0046] In the event that an error F2 is detected in at least one of the monitored subsystems 2, as a result of which the respective subsystem 2 can then only be operated at a reduced functional level FG, i.e., no longer fully as in normal operation, the at least one error F2 is assigned or classified into an error class KF in a classification step ST2. Depending on this, the mission specification VM and / or the route specification VR and / or the target trajectory TSoll are then adjusted in an adaptation step ST3.

[0047] The route or mission is thus adjusted according to the detected error F2. Upon detection of an error F2 in the at least one monitored subsystem 2 and depending on the error class KF of the error F2, a backup function B2 is activated either by the subsystem 2 affected by the error F2 itself and / or by one of the other subsystems 2. The activated backup function B2 then serves to at least partially, but preferably completely (if possible), compensate for the detected error F2 to a certain degree of compensation KG.

[0048] For example, it can be provided that if a parking brake error F4 is detected in the parking brake system 4 of the vehicle 1, due to which, for example, the spring-loaded brakes 4a cannot be controlled or can only be controlled to a limited extent by the parking brake control unit 4b, a backup function B2 is provided by controlling at least one service brake 6a of the service brake system 6 instead of the at least one spring-loaded brake 4a or (if this can still be controlled to a limited extent) in addition to the at least one spring-loaded brake 4a. The complete or partial failure of the parking brake system 4 is thus compensated by the use of the service brake system 6.

[0049] In particular, it can be provided that, in the event that the at least one spring-loaded brake 4a and the at least one service brake 6a are pneumatically operated with pressure medium from the same pressure medium supply 9, the backup function B2 is provided by the pressure medium being "used up" by actuating the at least one service brake 6a. The at least one service brake 6a of the service brake system 6 is thus actuated once or several times in such a way that a supply pressure pV of the jointly used pressure medium supply 9 is reduced to a limit supply pressure pVG, for example ambient pressure, wherein the at least one spring-loaded brake 4a is applied or engaged when the limit supply pressure pVG is reached or undershot.In this way, the faulty control via the parking brake control unit 4b can be compensated for by the fact that the pressure medium supply 9 is “sucked dry” by controlling the service brake 6a and the spring brake 4a can therefore no longer be held in the open position.

[0050] Furthermore, it can be provided that the backup function B2 for a parking brake error F4 is provided by controlling the at least one service brake 6a of the service brake system 6 in such a way that the vehicle 1 is held stationary via the at least one service brake 6a alone. In this case, for example, the remaining quantity of pressure medium with which the at least one service brake 6a is pneumatically operated can be taken into account in order to determine the compensation level KG of the backup function B2. Depending on this, it can then be estimated, for example, how long the vehicle 1 can be safely held stationary via the service brake 6a until the vehicle 1 can be secured against rolling away using additional mechanical measures via external intervention, i.e. not by the automated vehicle 1 itself, e.g. by an (automatically) requested breakdown assistance / operator / towing service.This backup function F2 will therefore only be considered if it is ensured that sufficient pressure fluid (including safety margin) is available to safely bridge the required time window with this emergency operation. Only then can a backup function B2 with a sufficiently high compensation level KG be provided.

[0051] Furthermore, in the event of a detected steering system error F8 in a steering system 8 of the vehicle 1, due to which a steering request LA cannot be implemented automatically or can only be implemented to a limited extent via the steering actuator 8a, a backup function B2 can be provided by controlling the service brakes 6a of the service brake system 6 differently on each side in order to at least partially achieve steering (by braking) depending on the respective steering request LA through the different braking of the vehicle 1 on each side. The detected steering system error F4 can therefore be at least partially compensated by this steering braking to a certain degree of compensation KG.

[0052] If a drive fault F10 or a service brake fault F6 is present in the drive system 10 or in the service brake system 6, due to which the respective subsystem 2; 10, 6 can only be operated to a limited extent, a backup function B2 can be provided by driving or braking the vehicle 1 only to a limited extent via the respective subsystem 2; 10, 6, for example via a redundant path, or by driving or braking (to a limited extent) via corresponding, equivalently acting replacement means in the vehicle 1, then (correspondingly limited) with a corresponding compensation level KG. The fact that the backup function B2 is used normally results in limitations or restrictions in the respective function of the faulty subsystem 2, for example the parking brake function or service brake function or steering function or the drive function or the like, and thus the function of the vehicle 1 in general.Depending on the degree of compensation KG to which the respective backup function B2 can compensate for the reduced functional level FG of the affected faulty subsystem 2, the route or route specification VR and / or the mission or mission specification MV, and thus also the target trajectory Ttarget, are adjusted accordingly. Vehicle 1 is thus rerouted accordingly or sent on a different route to account for the limitations of the backup function B2.

[0053] For this purpose, it can be provided, for example, that the mission specification VM and / or the route specification VR and / or the target trajectory TSoll are adapted in such a way that the vehicle 1, after the adaptation step ST3, only moves on lanes 3 and / or to a destination point Z with a specified surface property E. Depending on the respective limitation due to the intervention of the respective backup function B2, a gradient EN and / or a surface condition EB, e.g. gravel, asphalt, snow, rain, and / or a coefficient of friction ER and / or a curvature EK and / or a change in curvature EKA can be specified as the surface property E for the lane 3 or the destination point Z, for example.Thus, it can be determined that, particularly depending on the compensation level KG of the backup function B2 and / or the remaining functional level FG of the relevant subsystem 2, the further route or mission of the vehicle 1 is determined such that the resulting target trajectory Ttarget can be traversed without problems with the still existing and (possibly limited) functioning subsystems 2. In doing so, it is also possible to consider the effects that the occurrence of further errors F2 in the same or further subsystems 2 or the failure of the respectively activated backup function B2 would have, or how high a failure probability WB2 of the relevant backup function B2 is.

[0054] For example, it can be taken into account that after the adaptation step ST3, the vehicle 1 only moves on lanes 3 and / or to a destination point Z on which the gradient EN falls below a limit gradient ENG, so that in the event of a parking brake error F4 and / or a service brake error F6 with a reduced functional level FG of the service brake system 6, the vehicle 1 cannot get into a situation in which it has to be braked permanently (parking brake) or temporarily (service brake) via a faulty subsystem 2 on a surface that rises or falls too steeply (lane 3, destination point Z).Accordingly, this may be the case with a drive error F10, in which the drive system 10 continues to operate with a reduced level of functionality FG and therefore, under certain circumstances, not all gear ratios and / or only limited drive torques are available, which does not allow driving on certain surfaces with certain gradients EN or only allows it to a limited extent.

[0055] Furthermore, it can be taken into account that, after the adaptation step ST3, the vehicle 1 only moves on lanes 3 and / or to a destination point Z where the friction coefficient ER exceeds a specified limit friction coefficient ERG. In this way, it can be avoided that the vehicle 1, for example, in the event of a service brake fault F6 in the service brake system 6 and / or a drive fault F10 in the drive system 10, does not get into a situation in which an unwanted loss of stability occurs, which can fundamentally occur due to the reduced functional level FG or the respective compensation level KG of the respectively activated backup function B2.

[0056] Furthermore, it can be taken into account that after the adaptation step ST3, the vehicle 1 only moves on lanes 3 and / or to a target point Z on which the curvature EK falls below a curvature limit value EKG and / or the curvature change EKA falls below a change limit value EKAG. In this way, it can be avoided that the vehicle 1, for example in the event of a steering system error F8 in the steering system 8, is automatically maneuvered onto a lane 3 or to a target point Z at which a steering movement of the vehicle 1 is to be requested, which cannot be achieved, for example, by steering braking via the service brake system 6 as a backup function B2.

[0057] The route or the mission or the target trajectory TSoll can therefore be adapted accordingly to this limitation, whereby the aforementioned limit values, i.e. the limit gradient ENG and / or the limit friction coefficient ERG and / or the curvature limit EKG and / or the change limit EKAG are determined depending on the compensation level KG of the backup function B2 and / or the remaining functional level FG of the relevant subsystem 2. In addition, external environmental disturbances SG on the way to the destination point Z can also be taken into account, for example a crosswind strength that should not exceed a disturbance limit SGG if, for example, the stability control system 6b within the service brake system 6 has an error F2 and is therefore unable to react to larger gusts. Crossings over longer bridges or adjacent to open spaces can therefore be taken into account during the adaptation in adaptation step ST3.

[0058] If a service brake fault F6 is detected in the service brake system 6 of the vehicle 1, due to which the at least one service brake 6a can no longer be controlled or can only be controlled to a limited extent by a service brake control unit 6c and / or due to which the stability control system 6b of the service brake system 6 can no longer be operated or can only be operated to a limited extent, and / or also if a drive fault F10 is detected in the drive system 10, the limitation resulting from the recourse to the respective backup function B2 can be taken into account by limiting at least one driving dynamics variable DG of the vehicle 1. For example, a lateral acceleration aq and / or a longitudinal acceleration ax and / or a vehicle speed v1 and / or a steering angle LW and / or a steering angle gradient dL and / or a steering speed vL and / or a steering torque ML can be limited as the driving dynamics variable DG.In this way, it can be taken into account that excessive intervention in the driving dynamics of vehicle 1 due to recourse to the respective backup function B2 to compensate for the respective occurring error F2 could possibly lead to stability-critical situations that cannot be corrected. This can be taken into account both during the adaptation in adaptation step ST3, for example by avoiding lanes 3 or target points Z with excessively high minimum speeds (motorways) or excessively sharp bends, and during the subsequent automated control of vehicle 1 along the already adapted target trajectory TSoll, i.e. this is then driven, for example, at a reduced vehicle speed v1 and / or not with excessive acceleration.

[0059] For all the aforementioned embodiments of the backup functions B2 and the reactions thereto, it can additionally be taken into account in the adaptation step ST3 that the vehicle 1 is automatically brought to a standstill within a remaining time tR after the adaptation of the mission specification VM and / or the route specification VR and / or the target trajectory TSoll. For safety reasons, a remaining time tR is therefore defined within which the vehicle is safely parked, either at the side of the road or in a workshop, even if a sufficient compensation level KG is present by the respective backup function B2, in order to rectify or validate the respectively detected error F2. Accordingly, it is then also provided that the remaining time tR is determined depending on the compensation level KG of the respective backup function B2 and / or the remaining functional level FG of the relevant subsystem 2.If the error F2 has a greater impact on the functionality of vehicle 1, i.e., the remaining functional level FG is lower, and / or this error can be compensated to a greater extent by the backup function B2, i.e., if the compensation level KG is higher, a longer remaining time tR can be selected, since only a slight degradation can be assumed. In the opposite case, the degradation is correspondingly higher, and vehicle 1 must be stopped earlier to avoid endangering surrounding road users 50.

[0060] In order to also inform the surrounding road users 50 that the operation of vehicle 1 is faulty, this can be output to the other road users 50 in a warning W, preferably via a V2X connection V2X. The warning W is then preferably generated depending on the error class KF of the respective error F2 or depending on the reduced functional level FG or the compensation level KG, i.e., the urgency of warning the other road users 50.

[0061] In a further embodiment, it can also be provided that if a trailer 5 is attached to the vehicle 1, this can also be monitored for the presence of a trailer error F5. In the event that a trailer error F5 is detected in the respective monitored trailer 5 in this monitoring step ST1, as a result of which the trailer s can only be operated at a reduced functional level FG, the trailer error F5 is classified in an error class KF in a classification step ST2. Subsequently, in an adaptation step ST3, the mission specification VM and / or the route specification VR and / or the target trajectory TSoll are adapted depending on the error class KF of the trailer error F5. In this way, it is also possible to react to such a trailer error F5 that restricts the ferry operation of the vehicle 1 and the vehicle 1 can be automatically controlled with a different mission or on a different route.

[0062] If a corresponding error class FK exists or a certain reduced functional level FG of the trailer 5, the mission specification VM and / or the route specification VR and / or the target trajectory TSoll can also be adjusted such that the trailer 5 is transferred to a parked state together with the vehicle 1 and, if necessary, is also separated from the vehicle 1. In this way, at least the vehicle 1 can continue its journey without the trailer 5.

[0063] In this way, the other subsystems 2 of the vehicle 1 and, if applicable, their subsystems or components can also be monitored in order to react with an adjustment in the event of a corresponding error F2.

[0064] Reference symbol (part of the description)

[0065] 1 vehicle

[0066] 2 vehicle subsystems 1

[0067] 3 lane

[0068] 4 Parking brake system

[0069] 4a Spring brake

[0070] 4b Parking brake control unit

[0071] 5 followers

[0072] 6 Service brake system

[0073] 6a Service brake

[0074] 6b Stability control system

[0075] 6c Service brake control unit

[0076] 7 Data bus system

[0077] 8 Steering system

[0078] 8a Steering actuator

[0079] 9 Print center Istock

[0080] 10 Drive system

[0081] 10a Gear system

[0082] 10b Motor system

[0083] 10c Differential system

[0084] 12 wheel systems

[0085] 12a Wheelend

[0086] 12b tires

[0087] 13 Mission Planning System

[0088] 14 Suspension system

[0089] 14a electronic air suspension system

[0090] 15 Route planning system

[0091] 16 Environment detection system

[0092] 16a Camera

[0093] 16b Laser sensor

[0094] 16c LIDAR sensor 18

[0095] 17 Trajectory control system

[0096] 18 Localization system 18a Satellite positioning system

[0097] 20 Motion control unit

[0098] 22 Surveillance system

[0099] 50 road users

[0100] A starting point aq lateral acceleration ax longitudinal acceleration

[0101] B2 backup function

[0102] DG Driving dynamics variable dL Steering angle gradient

[0103] E Subsurface property

[0104] EN gradient

[0105] ENG limit gradient

[0106] EB subsurface condition

[0107] ER friction coefficient

[0108] ERG limiting friction coefficient

[0109] EK curvature

[0110] ECG curvature limit

[0111] EKA curvature change

[0112] EKAG change limit

[0113] F2 Error in Subsystem 2

[0114] F4 Parking brake error

[0115] F5 trailer error

[0116] F6 Service brake error

[0117] F8 Steering system error

[0118] F10 Drive error

[0119] FG Functionality level of subsystem 2

[0120] KF error class

[0121] KG compensation level

[0122] LA steering request

[0123] LW steering angle

[0124] ML Steering torque pV Supply pressure of the pressure medium supply 9 pVG Limit supply pressure SG Ambient disturbance variable

[0125] SGG disturbance limit tR remaining time

[0126] TSoll Target trajectory

[0127] U Environment around the vehicle 1 v1 Vehicle speed vL Steering angle speed

[0128] VM mission specification

[0129] VR route specification

[0130] V2X V2X connection

[0131] W Warning

[0132] WB2 Failure probability of the backup function B2

[0133] Z Target point

[0134] ST1 monitoring step

[0135] ST2 classification step

[0136] ST3 adjustment step

Claims

Patent claims 1. A method for controlling a vehicle (1) with multiple subsystems (2), wherein the vehicle (1) is controlled autonomously by a motion control unit (20), wherein the motion control unit (20) is designed to determine a target trajectory (TSoll) depending on a mission specification (VM) and / or a route specification (VR) and to communicate with at least some of the subsystems (2) and / or to control at least some of the subsystems (2) depending on the target trajectory (TSoll), so that the vehicle (1) moves from a starting point (A) to a destination point (Z) along a roadway (3) to implement the mission specification (VM) and / or the route specification (VR), wherein the method comprises at least the following steps: - monitoring at least one subsystem (2) of the vehicle (1) for the presence of a fault (F2) (ST 1 ), and in the event that at least one fault (F2) has been detected in the at least one monitored subsystem (2), due to which the subsystem (2) in question can only be operated at a reduced level of functionality (FG): - Classifying the at least one error (F2) into an error class (KF) (ST2); - Adaptation of the mission specification (VM) and / or the route specification (VR) and / or the target trajectory (TSoll) depending on the error class (KF) of the respective detected error (F2) (ST3).

2. Method according to one of the preceding claims, characterized in that when an error (F2) is detected in the at least one monitored subsystem (2), due to which the subsystem in question (2) can only be operated to a reduced level of functionality (FG), a backup function (B2) is activated by the subsystem in question (2) and / or by one of the other subsystems (2), wherein the activated backup function (B2) at least partially compensates for the detected error (F2) to a level of compensation (KG).

3. Method according to claim 2, characterized in that the mission specification (VM) and / or the route specification (VR) and / or the desired trajectory (TSoll) is adapted depending on the degree of compensation (KG) to which the backup function (B2) can compensate for the reduced degree of functionality (FG) of the relevant subsystem (2).

4. Method according to claim 2 or 3, characterized in that the mission specification (VM) and / or the route specification (VR) and / or the desired trajectory (TSoll) are adapted in such a way, preferably as a function of the compensation level (KG) of the backup function (B2) and / or the remaining functional level (FG) of the relevant subsystem (2), that the vehicle (1) after the adaptation of the mission specification (VM) and / or the route specification (VR) and / or the desired trajectory (TSoll) only moves on roadways (3) and / or to a destination point (Z) with a predetermined underground property (E).

5. Method according to claim 4, characterized in that a gradient (EN) and / or a surface condition (EB) and / or a coefficient of friction (ER) and / or a curvature (EK) and / or a change in curvature (EKA) of the roadway (3) and / or the target point (Z) are specified as the surface property (E), preferably depending on the degree of compensation (KG) of the backup function (B2) and / or the remaining degree of function (FG) of the relevant subsystem (2).

6. Method according to claim 5, characterized in that the mission specification (VM) and / or the route specification (VR) and / or the target trajectory (TSoll) are adapted in such a way that the autonomously controlled vehicle (1) moves only on lanes (3) and / or to a destination point (Z) on which - the gradient (EN) falls below a limit gradient (ENG), and / or - the coefficient of friction (ER) exceeds a specified limit coefficient of friction (ERG), and / or - the curvature (EK) falls below a curvature limit (ECG), and / or - the change in curvature (EKA) falls below a change limit value (EKAG), whereby the limit gradient (ENG) and / or the limit friction coefficient (ERG) and / or the curvature limit value (EKG) and / or the change limit value (EKAG) are determined depending on the compensation level (KG) of the backup function (B2) and / or the remaining functional level (FG) of the subsystem (2) in question.

7. Method according to one of claims 2 to 6, characterized in that the mission specification (VM) and / or the route specification (VR) and / or the desired trajectory (TSoll) are adapted in such a way, preferably as a function of the compensation level (KG) of the backup function (B2) and / or the remaining functional level (FG) of the subsystem (2) in question, that after the adaptation of the mission specification (VM) and / or the route specification (VR) and / or the desired trajectory (TSoll), the vehicle (1) only moves on lanes (3) and / or to a destination point (Z) on which an external environmental disturbance variable (SG), for example a crosswind strength, falls below a disturbance variable limit value (SGG).

8. Method according to one of claims 2 to 7, characterized in that the adaptation of the mission specification (MV) and / or the route specification (VR) and / or the target trajectory (TSoll) (ST3) takes into account a failure probability (WB2) for a failure of the remaining backup function (B2).

9. Method according to one of claims 2 to 8, characterized in that the vehicle (1) has as a subsystem (2) at least one parking brake system (4) with at least one pneumatically operated spring brake (4a) and / or a service brake system (6) with at least one pneumatically operated service brake (6a), wherein the at least one spring brake (4a) and / or the at least one service brake (6a) are pneumatically operated with pressure medium from a pressure medium supply (9).

10. The method according to claim 9, characterized in that when a parking brake error (F4) is detected in the parking brake system (4) of the vehicle (1), due to which the at least one spring-loaded brake (4a) can no longer be controlled or can only be controlled to a limited extent by a parking brake control unit (4b), a backup function (B2) is provided in that instead of the at least one spring-loaded brake (4a) or in addition to the at least one spring-loaded brake (4a), the at least one service brake (6a) of the service brake system (6) is controlled in such a way that the detected parking brake error (F4) is at least partially compensated to a compensation level (KG).

11. Method according to claim 10, characterized in that the at least one spring-loaded brake (4a) and the at least one service brake (6a) are pneumatically operated with pressure medium from the same pressure medium supply (9), wherein the backup function (B2) is provided in that the at least one service brake (6a) of the service brake system (6) is activated once or several times in such a way that a supply pressure (pV) of the pressure medium supply (9) is reduced to a limit supply pressure (pVG), wherein the at least one spring-loaded brake (4a) is applied or pulled when the limit supply pressure (pVG) is reached or undershot in order to at least partially compensate for the detected parking brake error (F4) to a compensation degree (KG).

12. The method according to claim 10 or 11, characterized in that the backup function (B2) is provided in that the at least one service brake (6a) of the service brake system (6) is controlled in such a way that the vehicle (1) is held at a standstill solely via the at least one service brake (6a) in order to compensate for the detected parking brake error (F4), wherein preferably the remaining quantity of pressure medium with which the at least one service brake (6a) is pneumatically operated is taken into account in order to determine the degree of compensation (KG) of the backup function (B2) with which the detected parking brake error (F4) is at least partially compensated to a degree of compensation (KG).

13. Method according to one of claims 9 to 12, characterized in that upon detection of a service brake fault (F6) in the service brake system (6) of the vehicle (1), due to which the at least one service brake (6a) cannot be controlled or can only be controlled to a limited extent by a service brake control unit (6c) and / or due to which a stability control system (6b) of the service brake system (6) cannot be operated or can only be operated to a limited extent, depending on the compensation level (KG) of the respectively activated backup function (B2) and / or the remaining functional level (FG) of the service brake system (6) and / or the error class (KF) of the service brake fault (F6), it is provided to limit at least one driving dynamics variable (DG) of the vehicle (1), which is selected from the group consisting of: lateral acceleration (aq), longitudinal acceleration (ax), vehicle speed (v1), steering angle (LW), steering angle gradient (dL), steering speed (vL),Steering torque (ML)., 14. Method according to one of claims 9 to 13, characterized in that in the event of a detected steering system error (F8) in a steering system (8) of the vehicle (1), due to which a steering request (LA) cannot be implemented automatically or can only be implemented to a limited extent, a backup function (B2) is provided in that the service brake system (6) effects a side-by-side different braking of the vehicle (1) in such a way that the vehicle (1) is steered as a function of the steering request (LA) in order to at least partially compensate for the detected steering system error (F4) to a compensation degree (KG).

15. Method according to one of claims 2 to 14, characterized in that the mission specification (VM) and / or the route specification (VR) and / or the desired trajectory (TSoll) are adapted in such a way that the vehicle (1) is automatically brought to a standstill within a remaining time (tR) after the adaptation of the mission specification (VM) and / or the route specification (VR) and / or the desired trajectory (TSoll), wherein the remaining time (tR) is determined as a function of the compensation level (KG) of the backup function (B2) and / or the remaining functional level (FG) of the relevant subsystem (2).

16. Method according to one of the preceding claims, characterized in that when an error (F2) is detected in at least one of the subsystems (2), a warning (W) is generated and output to other road users (50), preferably via a V2X connection (V2X), wherein the warning (W) is generated depending on the error class (KF) of the respective error (F2).

17. Method according to one of the preceding claims, characterized in that the vehicle (1) has at least one trailer (5), wherein the trailer (5) is monitored for the presence of a trailer error (F5), and in the event that a trailer error (F5) has been detected in the monitored trailer (5), due to which the trailer (5) can only be operated to a reduced level of functionality (FG), the trailer error (F5) is classified in an error class (KF), and the mission specification (VM) and / or the route specification (VR) and / or the target trajectory (TSoll) are determined as a function of the error class (KF) of the Trailer error (F5) is adjusted.

18. The method according to claim 17, characterized in that the mission specification (VM) and / or the route specification (VR) and / or the target trajectory (TSoll) are adapted in such a way that the trailer (3) is transferred to a parked state and is separated from the vehicle (1) depending on the error class (KF) and / or the remaining functional level (FG) of the trailer (5).

19. Method according to one of the preceding claims, characterized in that the at least one monitored subsystem (2) of the vehicle (1) is selected from the group consisting of: - drive system (10), in particular comprising a transmission system (10a), a motor system (10b), a differential system (10c), - wheel system (12), in particular comprising a wheel end (12a) and a tire (12b), - suspension system (14), in particular an electronic air suspension system (14a), - environment detection system (16), e.g. with a camera (16a), a laser sensor (16b), a LIDAR sensor (16c), - Localization system (18), e.g. satellite positioning (18a).

20. A vehicle (1) comprising a plurality of subsystems (2), a movement control unit (20) and a monitoring system (22), wherein the movement control unit (20) is designed to automatically determine a target trajectory (TSoll) depending on a mission specification (VM) and / or a route specification (VR) and to communicate automatically with at least some of the subsystems (2) of the vehicle (1) and / or to automatically control at least some of the subsystems (2) of the vehicle (1) depending on the target trajectory (TSoll) such that the vehicle (1) moves from a starting point (A) to a destination point (Z) along a roadway (3) in order to implement the mission specification (VM) and / or the route specification (VR), and wherein the monitoring system (22) is designed to carry out a method according to one of the preceding claims.

Images