Vehicle control system for autonomously controlling a vehicle, and method using said vehicle control system

Abstract

The invention relates to a vehicle control system (100) for autonomously controlling a vehicle (1), comprising a primary movement controller (110) and a primary communication connection and a secondary movement controller (120) and a secondary communication connection. The vehicle control system (100) for autonomously controlling the vehicle (1) additionally comprises a collective communication connection (165) for actuating at least one redundancy-free actuator (265) of the vehicle (1). The invention additionally relates to a vehicle system comprising a vehicle control system (100), to a vehicle (1) comprising a vehicle system or a vehicle control system (100), and to a method for operating a vehicle control system (100), a vehicle system, or a vehicle (1).

Description

[0001] Vehicle control system for autonomously controlling a vehicle and method therewith

[0002] The invention relates to a vehicle control system for autonomously controlling a vehicle. Furthermore, the invention relates to a vehicle system comprising the vehicle control system, a vehicle comprising the vehicle system or the vehicle control system, and a method for controlling a vehicle with a vehicle control system.

[0003] Vehicle control systems for autonomous vehicle control are known from the state of the art and serve to provide a high degree of automation for vehicles, such as passenger cars or commercial vehicles. For this purpose, such vehicle control systems are designed to control one or more actuators of a vehicle in such a way that a driving task of the vehicle is carried out. These vehicle control systems regulate the lateral and longitudinal acceleration of vehicles partially or completely independently of a human user. To operate a vehicle autonomously, i.e., driverless, requires many different sensors for environmental detection as well as significant computing power to evaluate the sensor data streams. Based on sensor data, the autonomous vehicle control system determines a trajectory or movement for the vehicle's driving task.

[0004] The Society of Automotive Engineers (SAE) has developed a five-level system for classifying the level of automation of vehicles controlled by a vehicle control system. According to the SAE-J3016 standard, the primary level of autonomous driving comprises assisted driving. This involves the vehicle supporting the driver in steering the vehicle. Examples include cruise control, which maintains a speed selected by the driver, and automatic lane keeping assistance, which keeps the vehicle in its lane. The second level of autonomous driving comprises partially automated driving. This allows the vehicle to independently perform tasks such as lane keeping, braking, or acceleration under defined conditions.In autonomy levels 3 to 5, the driving environment is monitored by the autonomous driving system, whereby in level 3 the human user takes over complete vehicle control in the event of an error in the autonomous driving system.

[0005] In autonomy levels 4 and 5, redundancy systems are provided that can continue to perform the driving task at least partially or completely in the event of a system failure. Such redundancy systems are particularly preferred as so-called fail-operational systems. Fail-operational systems are systems that can fully or at least partially perform the required function or driving task even in the event of a failure. The vehicle control system according to the invention is preferably such a vehicle control system that can partially or completely perform the function even in the event of a failure.

[0006] EP 3626 571 A1 discloses a redundant control system for a vehicle. The redundant system comprises a primary control unit connected to a primary vehicle communication network and a second control unit connected to a second vehicle communication network. The primary control unit is connected to the second control unit via a communication line. A plurality of receivers are configured to receive control commands from both the primary and the second control unit. Furthermore, the primary vehicle communication network is connected to the second control unit via the communication line, and the second vehicle communication network is connected to the primary control unit. EP 3 626 571 A1 thus discloses an architecture in which all subsystems of the control system are interconnected.

[0007] By interconnecting all subsystems, unwanted repercussions between the primary and secondary levels of the control system, for example repercussions from a fault in the primary control unit on the second vehicle communication network, can only be excluded with great effort, in addition to the increased effort required for additional cabling. In such systems, the risk of common-cause failures is therefore increased. In risk analysis, common-cause failures are defined as failures of multiple components or systems that occur as a result of a single fault cause or a single event. Such failures are also referred to as common-cause failures (CCFs). In order to reduce the risk of such failures, a significant additional effort is required. One object of the invention is therefore to address the problems of the prior art.In particular, a vehicle control system is to be provided that reduces the risk of common cause failures while maintaining a reasonable level of effort for countermeasures, particularly for complex cabling or additional components. A further object is to provide an improved vehicle control system that is designed to be fault-tolerant. A further object is to provide a vehicle control system with improved safety. In any event, the object of the present invention is to find an alternative to what is known from the prior art.

[0008] To this end, the invention relates to a vehicle control system for autonomously controlling a vehicle according to claim 1.

[0009] The vehicle control system comprises a primary motion controller configured to receive at least one primary setpoint for a vehicle movement from a primary virtual driver unit. The primary motion controller is further configured to control at least one primary actuator, in particular of a primary actuator system, of the vehicle, preferably as a function of the primary setpoint. For this purpose, the vehicle system comprises a primary communication connection, which is preferably designed as a bus connection, such as a CAN connection, and connects the primary motion controller to the primary actuator or each of the primary actuators. The primary communication connection is preferably used to send control commands, which are generated as a function of the primary setpoint, to one or more primary actuators and, particularly preferably, to receive information from the connectable primary actuators.Such information includes, for example, data indicating the current operating status of the primary actuator(s).

[0010] The vehicle control system further comprises a secondary motion controller configured to receive at least one secondary setpoint for a vehicle movement from a secondary virtual driver unit. The secondary motion controller is further configured to control at least one secondary actuator, in particular of a secondary actuator system, of the vehicle, preferably as a function of the secondary setpoint. For this purpose, the vehicle system comprises a secondary communication connection, which is preferably designed as a bus connection, such as a CAN connection, and connects the secondary motion controller to the secondary actuator or each of the secondary actuators. The secondary communication connection is preferably used to send control commands, which are generated as a function of the secondary setpoint, to one or more secondary actuators and to receive information from the connectable secondary actuators.Such information includes, for example, data indicating the current operating status of the secondary actuator(s).

[0011] The vehicle control system further comprises a collective communication connection. The collective communication connection is preferably a bus connection, particularly preferably a CAN connection. The collective bus connection is connected to the primary motion controller and the secondary motion controller and serves to control at least one non-redundant actuator, such as a drive or drive train, of the vehicle. The collective communication connection is accordingly configured to control one or more non-redundant actuators with the primary motion controller and / or the secondary motion controller. Preferably, the primary motion controller or the secondary motion controller is thus configured to control the non-redundant actuator via the collective communication connection depending on the primary setpoint or the secondary setpoint.

[0012] Redundancy-free actuators therefore correspond to actuators that are preferably not redundant and thus receive control signals or control commands from both the primary motion controller and the secondary motion controller.

[0013] Thus, the redundancy-free actuator, such as a drive train, is controlled via a communication connection that is separate from the connection between the primary motion controller and the primary actuators and the connection between the secondary motion controller and the secondary actuators.

[0014] Possible control signals that a redundancy-free actuator configured as a drive train can receive are a target drive torque and a target speed. It is preferred that, in addition to the drive train or as an alternative to the drive train, other redundancy-free actuators of the vehicle can be controlled by the primary and / or secondary motion controller via the collective communication connection.

[0015] Preferably, the primary motion controller and the primary actuators each comprise a transceiver unit for connecting to the primary communication link. The secondary motion controller and the secondary actuators each comprise a transceiver unit for connecting to the secondary communication link. The primary motion controller, the secondary motion controller, and the redundant actuators each comprise a transceiver unit for connecting to the collective communication link.

[0016] The primary communication link is connectionless with the secondary motion controller, such that the secondary motion controller does not have a transceiver unit for directly connecting and communicating with the primary communication link. Furthermore, the primary motion controller is connectionless with the secondary communication link. The primary motion controller therefore does not have a transceiver unit for directly connecting to the secondary communication link. The primary communication link, secondary communication link, and collective communication link are therefore physically separate communication links.

[0017] In the event of a failure of the connection between the primary motion controller and the primary actuator system and / or the connection between the secondary motion controller and the secondary actuator system, actuators without redundancy can still be controlled.

[0018] The provision of separate primary communication links, secondary communication links, and collective communication links allows for simple wiring of the actuators to the motion controllers. The vehicle's operational capability can thus be maintained using the secondary communication link and secondary actuators in the event of a primary communication link failure, either due to damage to the primary communication link or due to a defective actuator whose failure affects the primary communication link.

[0019] A common problem is defective primary actuators that are constantly transmitting. Such actuators are also referred to as "babbling idiots." Moisture entering the housing of an actuator's communication module can cause such a defect. If such a continuous transmitter is connected to the primary communication link, this can lead, for example, to an overload of the primary communication link and thus to either no data transmission at all or only a delayed transmission of data to the other connected primary actuators. However, this defective primary actuator does not negatively affect the function of the actuators without redundancy, as they communicate separately via the collective communication link.

[0020] Even if the primary motion controller fails completely, the redundant actuators can still be controlled by the secondary motion controller, as the redundant actuators can communicate with the primary and secondary motion controllers via the collective communication link. The secondary actuators can also be controlled via the secondary motion controller as a replacement for the primary actuators that are no longer accessible.

[0021] According to a first embodiment, the primary motion controller comprises a primary bypass circuit to provide a communication link between the primary communication link and the collective communication link. The secondary motion controller correspondingly comprises a secondary bypass circuit to provide communication between the secondary communication link and the collective communication link.

[0022] The primary bypass circuit is configured to provide information and data from the primary communication link to the collective communication link and from the collective communication link to the primary communication link. The primary bypass circuit can therefore also be referred to as a primary routing circuit, and the secondary bypass circuit can therefore also be referred to as a secondary routing circuit. For example, the state of a drive that is controlled as a non-redundant actuator and therefore sends data about its state to the primary motion controller via the collective communication link is also relevant for a primary braking system that communicates with the primary motion controller via the primary communication link. The primary bypass circuit thus serves to enable data exchange between non-redundant actuators and primary actuators.However, the primary bypass circuit is preferably designed such that not all data is forwarded between the connected communication links, i.e. only defined data is forwarded in order to reduce the data traffic on both connected communication links.

[0023] Similarly, the secondary bypass circuit is configured to provide data from the secondary communication link to the collective communication link and from the collective communication link to the secondary communication link. The secondary bypass circuit can therefore also be referred to as a secondary routing circuit. The secondary bypass circuit is also preferably configured such that not all data is forwarded between the connected communication links, i.e., only defined data.

[0024] Providing bypass circuits instead of a direct connection of the primary communication link to the collective communication link and a direct connection of a secondary communication link to the collective communication link further helps prevent the aforementioned common cause failures. Furthermore, it creates the possibility of forwarding data directly from one of the communication links connected to the bypass circuit to the other communication link connected to the bypass circuit.

[0025] Accordingly, the primary bypass circuit data-conductingly connects a transceiver unit of the primary motion controller for connection to the primary communication link and a transceiver unit of the primary motion controller for connection to the collective communication link. Furthermore, the secondary bypass circuit data-conductingly connects a transceiver unit of the secondary motion controller for connection to the secondary communication link to a transceiver unit of the secondary motion controller for connection to the collective communication link.

[0026] According to a further embodiment, the vehicle control system also has a private communication connection that connects the primary motion controller to the secondary motion controller in a data-conducting manner. The private communication connection thus provides a data line or data connection between the primary motion controller and the secondary motion controller. The private communication connection is preferably designed as a bus connection, preferably as a CAN connection.

[0027] Preferably, the secondary motion controller is configured to provide a second setpoint received from the secondary virtual driver unit to the primary motion controller via the private communication connection.

[0028] The second setpoint is then cascaded from the secondary virtual driver unit to the primary motion controller via the secondary motion controller. This cascaded provision or forwarding of the second setpoint prevents a complete switchover to the secondary motion controller and the secondary actuator system in the event of a failure of the primary virtual driver unit or a failure of the primary actuator system or an actuator or subsystem of the primary actuator system.

[0029] Preferably, the private communication connection is also configured to forward data intended to be transmitted by the primary motion controller on the collective communication connection to the secondary motion controller in the event of a fault and to transmit it via the secondary motion controller on the collective communication connection. Preferably, the private communication connection is also configured to receive data intended to be received by the primary motion controller from the collective communication connection by the secondary motion controller in the event of a fault and to forward it to the primary motion controller via the private communication connection. An error in the primary motion controller can be, for example, a defect in a transceiver unit that can be implemented in the primary motion controller to connect the collective communication connection.In the event of such a failure, it is unlikely that a corresponding transceiver unit in the secondary motion control system will also fail simultaneously. Thus, control of the non-redundant actuators remains intact.

[0030] The private communication connection thus ensures that a large number of simple faults in the vehicle control system or the vehicle control system's peripherals do not result in a blanket switchover to the secondary units of the vehicle control system or the vehicle control system's peripherals. In this respect, a fault-tolerant vehicle control system is provided that only shuts down or compensates for the faulty part of the vehicle control system or the vehicle control system's peripherals and preferentially uses the primary units of the vehicle control system or the vehicle control system's peripherals to control the vehicle.

[0031] According to a further embodiment, the private communication connection is independent of the collective communication connection and corresponds to a communication connection additional to the collective communication connection. The primary motion controller therefore comprises a transceiver unit for the private communication connection and another transceiver unit for the collective communication connection. The secondary motion controller therefore comprises a transceiver unit for the private communication connection and another transceiver unit for the collective communication connection.

[0032] According to an alternative embodiment, the private communication connection corresponds to the collective communication connection. The primary motion controller and the secondary motion controller are thus configured to exchange data with each other via the collective communication connection. This embodiment therefore does not allow an error in a transceiver unit of either the primary motion controller or the secondary motion controller for connecting to the collective communication connection to be compensated for by the correspondingly error-free motion controller. However, this does eliminate the need for an additional communication connection. Furthermore, the primary motion controller is configured to control secondary actuators via the collective communication connection and the secondary motion controller.According to a further embodiment, the primary motion controller and the secondary motion controller are configured to perform a plausibility check of primary setpoints and secondary setpoints via the private communication connection. Accordingly, primary setpoints sent by the primary virtual driver unit and received by the primary motion controller are preferably sent to the secondary motion controller via the private communication connection, and / or secondary setpoints sent by the secondary virtual driver unit and received by the secondary motion controller are sent to the primary motion controller via the private communication connection. Thus, primary setpoints and secondary setpoints are present in the primary motion controller and / or the secondary motion controller.Primary setpoints and secondary setpoints can be compared if they were generated at the same time, i.e., when the vehicle was in the same state. A deviation between a primary setpoint and a secondary setpoint can thus be recorded and identified as an error. A faulty primary virtual driver unit or a faulty secondary virtual driver unit can be detected.

[0033] According to a further embodiment, the primary motion controller is configured to send data on the secondary communication connection to or receive data from at least one secondary actuator via the private communication connection and the secondary motion controller.

[0034] This allows a failed primary actuator to be replaced by a secondary actuator, while the secondary actuator continues to be directly controlled by the primary motion controller. Thus, a primary actuator that is no longer controllable or defective is simply replaced by a secondary actuator to continue providing the functionality of the primary actuator.

[0035] Frequently, mutually redundant primary and secondary actuators are designed such that the functional scope of the secondary actuator, which is provided redundantly to a corresponding primary actuator, is limited compared to the primary actuator. According to this embodiment, a defective primary actuator does not require a complete switchover to the secondary system, comprising the secondary virtual driver unit, the secondary motion controller, and the secondary actuators; instead, the defective primary actuator can simply be replaced by the redundant secondary actuator. The potentially more extensive functional scope of the remaining, still functional primary actuators, as well as the primary virtual driver unit and / or the primary motion controller, is thus fully retained.

[0036] According to a further embodiment, the secondary motion controller is configured to use the private communication connection to send secondary setpoints to the primary motion controller and / or to control primary actuators via the private communication connection and the primary motion controller. Control occurs, for example, by generating control commands in the secondary motion controller as a function of the secondary setpoints and sending these control commands to the primary actuators via the private communication connection and the primary communication connection in order to control the primary actuators as a function of the control commands. According to a further alternative, the secondary motion controller is configured to transmit setpoints for the primary motion controller, generated as a function of the secondary setpoints, to the primary motion controller via the private communication connection.These generated setpoints can be adapted to the type of primary setpoints if, at the same time, i.e., with the same operating state of the vehicle, different primary setpoints and secondary setpoints are generated by the assigned primary virtual driver unit and the secondary virtual driver unit. However, the generated setpoints can also correspond to the secondary setpoints. In the latter case, the secondary motion control system forwards the secondary setpoints.

[0037] A failure of a primary virtual driver unit can thus be compensated for by the secondary virtual driver unit, while continuing to use the primary motion control and the primary actuators. This is particularly advantageous when, as described above, primary components have a greater range of functions than secondary components.

[0038] According to a further embodiment, each primary actuator is assigned a secondary actuator. Associated actuators correspond to a pair of mutually redundant actuators. Accordingly, the vehicle control system comprises the primary actuators and the secondary actuators. At least one of the pairs, several of the pairs, or all of the pairs comprise a system communication connection. The system communication connection is preferably a bus connection, particularly preferably a CAN connection. The connection can also be referred to as a system bus.

[0039] Associated vehicle actuators are therefore each connected to each other via a system bus. Thanks to the system communication connections, it is possible to control primary actuators via the associated secondary actuator using the secondary communication connection if the primary communication connection fails. In the event of a failed primary communication connection, a data connection to the primary actuators can be established via the secondary motion controller, the secondary communication connection, and the secondary actuators thanks to the private communication connection that provides a connection between the primary system and the secondary system. Furthermore, all primary components of the vehicle control system can be used even if the primary communication connection fails.

[0040] According to a further embodiment, a primary and a secondary power supply are provided for the power supply of the vehicle control system. It is preferred that the primary power supply supplies the primary virtual driver unit, the primary motion controller, and / or the primary actuators of the primary actuator system with power. It is further preferred that the secondary power supply supplies the secondary virtual driver unit, the secondary motion controller, and / or the secondary actuators of the secondary actuator system with power.

[0041] Preferably, all non-redundant actuators are connected to the primary power supply in order to be supplied via the primary power supply. According to an alternative, some of the non-redundant actuators are connected to the primary power supply and another part of the non-redundant actuators are connected to the secondary power supply. Preferably, the total rated power of the non-redundant actuators supplied with the primary energy source differs by less than 50%, preferably less than 20%, or particularly preferably less than 10% from the total rated power of the non-redundant actuators supplied with the secondary power supply. This makes it possible to provide essentially two energy supplies of equal size, such as energy storage devices, preferably accumulators. A simpler symmetry of the primary and secondary systems can thus be achieved.

[0042] According to a further embodiment, the primary motion controller and the secondary motion controller are configured to arbitrate the data sent by the primary motion controller and / or the secondary motion controller. Arbitration of the data, in particular control commands, serves to prevent collisions between data sent simultaneously by the primary motion controller and the secondary motion controller. In particular, the arbitration is performed depending on a health status detection system that can detect the functionality or errors in the motion controllers or the virtual driver units and thus specify which motion controller is permitted to send commands.

[0043] According to a further embodiment, the primary motion controller and / or the primary bypass circuit is configured to monitor communication between the primary communication link and the collective communication link for interference. Such interference includes, in particular, implausible data or data transmitted by defective, for example, continuously transmitting, actuators, in particular primary actuators. Furthermore, the primary motion controller and / or the primary bypass circuit is configured to interrupt communication between the primary communication link and the collective communication link in the event of a detected interference. This ensures that data can be transmitted and received on the collective communication link by the second motion controller, especially when the primary communication link is disrupted by the interference.

[0044] According to a further embodiment, the secondary motion controller and / or the secondary bypass circuit is configured to monitor communication between the secondary communication link and the collective communication link for interference. Such interference includes, in particular, implausible data or data transmitted by defective, for example, continuously transmitting, actuators, in particular secondary actuators. Furthermore, the secondary motion controller and / or the secondary bypass circuit is configured to interrupt communication between the secondary communication link and the collective communication link in the event of a detected interference. This ensures that data can be transmitted and received on the collective communication link by the first motion controller, especially when the secondary communication link is disrupted by the interference.

[0045] According to a further embodiment, the primary motion controller comprises a primary control unit, and the secondary motion controller comprises a secondary control unit. The primary control unit is configured to detect errors in a primary actuator and, upon detection of an error, to control the secondary actuator associated with the primary actuator via the secondary motion controller and the secondary communication connection. Preferably, the primary control unit is part of the health status detection system and, in this case, is also configured to monitor error-free operation of the primary motion controller and / or the secondary actuator.

[0046] According to a further embodiment, the secondary motion controller also comprises a control unit, which preferably forms part of the health status detection system. The secondary motion controller is configured with the control unit to detect an error in the primary motion controller and to shut down or deactivate the primary motion controller or at least to arbitrate such that data is sent from the secondary motion controller to the actuators without redundancy via the collective communication connection. For this purpose, the secondary motion controller preferably receives a health status signal from the primary motion controller, which can be received either via the private communication connection or a dedicated communication connection.

[0047] The invention also encompasses a vehicle system having a vehicle control system according to one of the aforementioned embodiments. Furthermore, the vehicle system comprises a primary virtual driver unit and a secondary virtual driver unit. Furthermore, the invention encompasses a vehicle having a plurality of primary actuators, secondary actuators, and redundant actuators, as well as a vehicle system or a vehicle control system according to one of the aforementioned embodiments.

[0048] The invention also includes a method for operating a vehicle control system according to one of the aforementioned embodiments.

[0049] According to one embodiment of the method, in the event of a failure of a primary actuator, data is sent with the primary motion controller via the private communication connection to a secondary actuator via the private communication connection, the secondary motion controller and the secondary communication connection in order to control the secondary actuator on behalf of the primary failed actuator.

[0050] According to a further embodiment, secondary setpoints are sent to the primary motion controller via the private communication link using the secondary motion controller in order to generate control signals for the primary actuators from the primary setpoints using the primary motion controller.

[0051] According to a further embodiment, the primary motion controller thus controls a primary actuator with data sent via the private communication link, the primary motion controller, the secondary communication link, a secondary actuator that is redundant with the primary actuator to be controlled, and a system communication link that connects the primary actuator to the secondary actuator associated with the primary actuator.

[0052] Furthermore, a primary motion controller detects faults in a primary actuator and disables the primary actuator. A secondary actuator, replacing the primary actuator, is then controlled via the private communication link, the secondary motion controller, and the secondary communication link.

[0053] According to a further embodiment, an error of a primary motion controller, in particular in the absence of a monitored health status signal of the primary motion controller, is detected with the secondary motion controller and the primary motion controller and / or primary actuators and / or the primary virtual driver are deactivated and the vehicle is controlled with the secondary virtual driver of the secondary motion controller and the secondary actuators.

[0054] It is preferred that the primary motion controller is connected to the primary virtual driver unit via a primary virtual driver communication connection. It is further preferred that the secondary motion controller is connected to the secondary virtual driver unit via a secondary virtual communication connection. The primary virtual communication connection and the secondary virtual communication connection are preferably independent and physically separate network connections. By separating the two network connections, the risk of common cause failures can be reduced. In a preferred development, the primary virtual driver communication connection is a bus connection, particularly preferably a CAN connection. It is further preferred that the secondary virtual driver communication connection is a bus connection, particularly preferably a CAN connection.

[0055] Preferably, the primary virtual driver unit and the secondary virtual driver unit are configured to fully or partially replace each other functionally. The primary virtual driver unit and the secondary virtual driver unit are therefore designed to be redundant and can fully or partially fulfill the required function even if one of the virtual driver units fails. In a preferred development, the primary virtual driver unit and the secondary virtual driver unit are connected to one another via a driver unit connection, preferably via a driver unit BUS, particularly preferably via a driver unit CAN. The primary virtual driver unit and the secondary virtual driver unit can also be subsystems of a virtual driver system.

[0056] Preferably, the primary virtual driver unit and the secondary virtual driver unit independently form the primary setpoint and the second setpoint for a vehicle movement. For this purpose, the primary virtual driver unit and the secondary virtual driver unit can preferably each utilize different sensors for environmental detection and high computing power for evaluating the sensor data streams. It is preferred that the primary motion controller and the secondary motion controller are configured to fully or partially replace each other functionally. Thus, the primary motion controller and the secondary motion controller are also redundant and can fully or partially fulfill the required function even if one of the motion controllers fails.

[0057] The primary actuator system preferably comprises a primary braking system, and the secondary actuator system preferably comprises a secondary braking system. For transmitting data, the primary braking system and the secondary braking system are preferably connected by a system communication connection. The system communication connection can also be referred to as a brake connection, a brake bus, or a brake CAN. This allows, for example, the secondary braking system to receive a control signal and forward it to the primary braking system, if available, or to make it available to it. It is also possible for the primary braking system to forward a received control signal to the secondary braking system, if available. This ensures that the actuator system of the redundant braking systems is used that is better suited to executing the control signal.

[0058] It is further preferred that the primary actuator system has a primary steering system and that the secondary actuator system has a secondary steering system. Preferably, the primary steering system and the secondary steering system are connected to a system communication link for data transmission. The system communication link may also be referred to as a steering link, steering bus, or steering CAN. This allows the primary steering system and the secondary steering system to forward the respective received control signals in both directions.

[0059] The additional redundant subsystems of the primary and secondary actuator systems are also preferably connected to each other via a system communication connection in order to forward the received control signal in both directions. Preferably, the secondary motion controller is signal-conductingly connected to the secondary actuator system, as already explained above, via the secondary communication connection. In the event of a predetermined single fault or a predetermined fault constellation of the vehicle control system and / or the periphery of the vehicle control system, it is preferred that the secondary motion controller processes the secondary setpoint and outputs a secondary control signal derived from the secondary setpoint to the secondary actuator system.A predetermined single fault or a predetermined fault constellation can be, for example, a failure of the primary motion controller and / or a failure of the primary power supply of the primary motion controller. Other possible faults that can lead to the secondary setpoint being controlled via the secondary motion controller and the secondary actuator system include, for example, a failure of the private communication link or a failure of the primary communication link.

[0060] In a further embodiment of the method, the method comprises providing at least one primary setpoint value for a vehicle movement to a primary motion controller of the vehicle control system. The method further comprises providing a secondary setpoint value for a vehicle movement to a secondary motion controller of the vehicle control system. The method preferably comprises forwarding or providing the secondary setpoint value from the secondary motion controller to the primary motion controller. It is preferred that the primary setpoint value is provided by a primary virtual driver unit to the primary motion controller. Preferably, the secondary setpoint value is provided by a secondary virtual driver unit to the secondary motion controller. The primary and secondary setpoint values ​​are preferably formed independently of one another.

[0061] The method preferably comprises arbitrating the primary and secondary setpoints at the primary motion controller. Arbitrating the primary and secondary setpoints preferably comprises checking the validity of the primary setpoint and / or checking the validity of the secondary setpoint. Additionally or alternatively, the arbitration comprises prioritizing the primary and secondary setpoints. Checking the validity of the primary setpoint and / or the secondary setpoint can be performed, for example, by checking a checksum, a counter, or another key of the primary and / or secondary setpoint. Prioritizing preferably comprises assigning priorities to the primary and secondary setpoints.

[0062] In a preferred embodiment, the method comprises selecting the primary or secondary setpoint. Alternatively, the method preferably comprises combining the primary and secondary setpoints. Preferably, the primary motion controller selects the setpoint that has been determined to be valid and / or that has a higher priority. The method may therefore also comprise switching from the primary setpoint to the secondary setpoint or from the secondary setpoint to the primary setpoint.

[0063] It is preferred that the method comprises processing the selected setpoint or the combined setpoint in the primary motion controller. Furthermore, the method preferably comprises sending a primary control signal derived from the selected setpoint or the combined setpoint to a primary actuator system of the vehicle. It should be understood that a primary control signal is sent to each primary actuator or subsystem included in the primary actuator system.

[0064] In the case of a predetermined single fault or a predetermined fault constellation of the vehicle control system and / or the periphery of the vehicle control system, the method preferably comprises processing the secondary setpoint value in the secondary motion controller and sending a secondary control signal derived from the secondary setpoint value to a secondary actuator system of the vehicle. The predetermined single fault or the predetermined fault constellation can, for example, be the failure of the primary motion controller and / or a power supply of the primary motion controller. The failure of relevant network connections or a failure of the primary actuator system or a subsystem of the primary actuator system can also be such a predetermined fault.

[0065] Further embodiments will become apparent from the exemplary embodiments described in the figures. Herein: Fig. 1 shows a schematic representation of a vehicle with a vehicle system according to an exemplary embodiment,

[0066] Fig. 2 is a schematic representation of an embodiment of a vehicle system with an embodiment of a vehicle control system and

[0067] Fig. 3 shows another embodiment of a vehicle control system.

[0068] Fig. 1 shows a vehicle 1 which is a commercial vehicle. The vehicle 1 has a vehicle system 200 with a vehicle control system 100. The vehicle 1 is illustrated in Fig. 1 as a commercial vehicle with a first rear axle HA1, a second rear axle HA2 and a front axle VA. Front wheels 50.1, 50.2 of the front axle VA are steerable. Rear wheels 52.1, 52.2, 52.3, 52.4 of the first rear axle HA1 and second rear axle HA2 are designed here as non-steerable wheels. However, it can also be provided that the rear wheels 52.1, 52.2 of the primary rear axle HA1 and / or the rear wheels 52.3, 52.4 of the second rear axle HA2 are steerable.

[0069] The vehicle control system 100 comprises a primary motion controller 110 and a secondary motion controller 120. The primary motion controller 110 is connected to a primary virtual driver unit 112. The primary virtual driver unit 112 is preferably configured to plan a vehicle movement and to form a primary target value S1 for the planned vehicle movement. The vehicle movement is preferably planned using sensor data provided by primary sensors and / or secondary sensor data provided by secondary sensors (not shown). The secondary motion controller 120 is connected to a secondary virtual driver unit 122. The secondary virtual driver unit 122 is preferably configured to plan a vehicle movement and to form a secondary target value S2 for the planned vehicle movement.The vehicle movement is preferably planned using secondary sensor data provided by secondary sensors and / or primary sensor data provided by primary sensors (not shown). In the exemplary embodiments illustrated in Figures 1 to 3, the primary virtual driver unit 112 and the secondary virtual driver unit 122 are connected to one another via a driver unit bus FB. The driver unit bus FB is preferably embodied as a CAN connection.

[0070] The primary virtual driver unit 112 is configured to provide the primary setpoint to the primary motion controller 110. A primary virtual driver communication connection PVF is provided, which connects the primary virtual driver unit 112 to the primary motion controller 110. The primary virtual driver unit 112 can provide the primary setpoint to the primary motion controller 110 via the primary virtual driver communication connection PVF. The secondary virtual driver unit 122 is configured to provide the secondary setpoint to the secondary motion controller 120. A secondary virtual driver communication connection SVF is provided, which connects the secondary virtual driver unit 122 to the secondary motion controller 120.The secondary virtual driver unit 122 can provide the secondary setpoint to the secondary motion controller 120 via the secondary virtual driver communication link SVF.

[0071] The primary motion controller 110 and the secondary motion controller 120 are connected to one another via a private communication connection 130. The private communication connection 130 is preferably a bus connection, more preferably a private bus connection, particularly preferably a CAN connection. The secondary motion controller 120 is configured to forward the secondary setpoint S2 received from the secondary virtual driver unit 122 to the primary virtual driver unit 112 via the private communication connection 130 (see Fig. 3). The secondary motion controller 120 preferably provides the secondary setpoint S2 to the primary motion controller 110 continuously upon request from the primary motion controller 110 and / or event-driven via the private communication connection 130. This means that the primary motion controller 110 is configured to receive both the primary setpoint S1 and the secondary setpoint S2.In a preferred development, the primary motion controller 110 is also or alternatively configured to provide the primary setpoint S1 received from the primary virtual driver unit 112 to the secondary motion controller 120 via the private communication connection 130. In this case, the secondary motion controller 120 is configured to receive both the primary setpoint S1 and the secondary setpoint S2 (not shown).

[0072] The primary motion controller 110 is configured to output a primary control signal PS to a primary actuator system 230 so that the vehicle movement or trajectory required by the primary and / or secondary virtual driver unit is executed (see Figures 2 and 3). The primary control signal PS is preferably a control signal derived from the primary setpoint S1, the secondary setpoint S2, or a combination of the primary and secondary setpoints. A primary communication connection PAB, which may also be referred to as a primary actuator bus, is provided to connect the primary motion controller 110 to the primary actuator system 230.

[0073] The secondary motion controller 120 is configured to output a secondary control signal SS to a secondary actuator system 240 (see Figures 2 and 3). The secondary actuator system 240 is preferably configured to be redundant with the primary actuator system 230. The secondary control signal SS is preferably a control signal derived from the secondary setpoint S2. For an embodiment in which the primary motion controller 110 provides the primary setpoint S1 to the secondary motion controller 120 via the private communication connection 130, the secondary control signal SS can also be a control signal derived from the primary setpoint S1, the secondary setpoint S2, or a combination of the primary and secondary setpoint S2.

[0074] A secondary communication connection SAB is provided to connect the secondary motion controller 120 to the secondary actuator system 240. The secondary communication connection SAB can also be referred to as a secondary actuator bus. It is preferred that the secondary motion controller 120 outputs the secondary control signal SS if, for example, the primary virtual driver unit 112, the primary virtual driver communication connection, the primary motion controller 110, and / or the private communication connection 130 has failed.

[0075] The primary motion controller 110 and the secondary motion controller 120 are also connected to one another via a collective communication connection 165, wherein the collective communication connection 165 is preferably a bus connection, particularly preferably a CAN connection. The collective communication connection 165 connects the primary motion controller 110 and the secondary motion controller 120 to a drive train 160 of the vehicle 1. Both the primary motion controller 110 and the secondary motion controller 120 can control the drive train 160 via the collective communication connection 165, wherein the drive train 160 is preferably not designed to be redundant and therefore corresponds to a redundancy-free actuator 265. Thus, the drive train 160 remains controllable even if the primary motion controller 110 or the secondary motion controller 120 fails.Both the primary motion controller 110 and the secondary motion controller 120 are configured to output a drive train control signal AS or drive train control signals to the drive train 160 (see Fig. 2). The drive train control signals AS can be control signals derived from the primary setpoint S1, the secondary setpoint S2, or a combination of the primary and secondary setpoints. Possible drive train control signals AS relate to a setpoint drive torque and / or a setpoint speed. The primary motion controller 110 and the secondary motion controller 120 are preferably configured to check whether the collective communication connection 165 is occupied by the respective other motion controller. Additional actuators 265 without redundancy can also be controlled via the collective communication connection 165 (see Fig. 2).

[0076] The primary actuator system 230 and the secondary actuator system 240 are preferably designed redundantly, as already explained above. The primary actuator system 230 and the secondary actuator system 240 preferably comprise vehicle actuators or subsystems from the group: transmission, brakes, and / or steering. It should be understood that the primary motion controller 110 each outputs a primary control signal PS to an actuator or to a subsystem of the primary actuator system 230. It should also be understood that not every actuator or subsystem of the primary actuator system 230 needs to be controlled for every required vehicle movement or trajectory. For example, if the vehicle 1 is to be braked, but the direction of the vehicle 1 is not to be changed, the primary motion controller 110 can also control only one brake actuator or brake system of the primary actuator system 230.Likewise, it should be understood that the secondary motion controller 120 outputs a secondary control signal SS to an actuator or to a subsystem of the secondary actuator system 240. It should also be understood that not every actuator or subsystem of the secondary actuator system 240 needs to be controlled for every vehicle movement or trajectory. For example, if the vehicle 1 is to be braked, but the direction of the vehicle 1 is not to be changed, the secondary motion controller 120 can also control only one brake actuator or one brake system of the secondary actuator system 240. If, however, only one direction is to be changed, only one steering actuator or one steering system of the secondary actuator system 240 can be controlled.

[0077] Fig. 1 schematically shows that the primary actuator system 230 is connected to the secondary actuator system 240, wherein the redundantly designed actuators or the redundantly designed subsystems of the primary actuator system 230 and the secondary actuator system 240 are preferably connected to one another.

[0078] Fig. 2 shows an embodiment of the vehicle control system 100, in which the primary motion controller 110 is configured to control primary actuators 231, 232, 235 of the primary actuator system 230. The secondary motion controller 120 is configured to control secondary actuators 241, 242, 245 of the secondary actuator system 240. The secondary actuator system 240 comprises secondary actuators 241, 242, 245, each of which corresponds to a redundant primary actuator 231, 232, 235 of the primary actuator system 230. To ensure safe operation of a vehicle with the vehicle control system 100, safety-relevant actuators 235, 245 are therefore provided redundantly.

[0079] Actuators of the actuator systems 230, 240 that are assigned to one another, i.e., redundant to one another, are each connected via system communication connections 270. The system communication connections 270 also preferably correspond to bus connections, such as CAN connections.

[0080] Accordingly, for example, a primary actuator 235 configured as a primary braking system 231 is connected to a secondary actuator 245 configured as a secondary braking system 241 via a brake bus BB. The secondary braking system 241 can forward a secondary control signal SS received from the secondary motion controller 120 to the primary braking system 231 via the brake bus BB, so that the secondary control signal SS is executed by the primary braking system 231. In the other direction, the primary braking system 231 can also forward a primary control signal PS received from the primary motion controller 110 to the secondary braking system 241 via the brake bus BB, so that the primary control signal PS is executed by the secondary braking system 241.

[0081] A primary actuator 235 configured as primary steering system 232 is correspondingly connected to a secondary actuator 245 configured as secondary steering system 242 via a steering bus LB. The secondary steering system 242 can forward a secondary control signal SS received from the secondary motion controller 120 to the primary steering system 232 via the steering bus LB, so that the secondary control signal SS is executed by the primary steering system 232. In the other direction, the primary steering system 232 can also forward a primary control signal PS received from the primary motion controller 110 to the secondary steering system 242 via the steering bus LB, so that the primary control signal PS is executed by the secondary steering system 242.

[0082] At least one primary actuator 235 designed as a further primary actuator P is connected via a further system communication connection 270 to a secondary actuator 245 designed as a further secondary actuator S.

[0083] By connecting the primary actuator system 230 to the secondary actuator system 240, it can be achieved that the primary actuator system 230 can be used to control the vehicle even in the event of failure of the primary virtual driver unit 112, the primary motion controller 110, a connection between the primary virtual driver unit 112 and the primary motion controller 110 and / or a connection between the primary motion controller 110 and the primary actuator system 230.

[0084] Fig. 2 shows an embodiment of the vehicle control system 100 of a vehicle system 200 for a vehicle, in particular an autonomous vehicle that supports autonomous driving according to automation level 4 or 5. The vehicle control system 100 comprises the primary motion controller 110 and the secondary motion controller 120. The motion controllers 110, 120 serve to generate control commands for actuators of the vehicle depending on trajectories that are generated via the virtual driver units 112, 122 and specified in the form of the setpoint values ​​S1, S2 for the motion controllers 110, 120.

[0085] The primary motion controller 110 and the secondary motion controller 120 are connected to each other via the private communication link 130. Preferably, the secondary motion controller 120 provides redundancy to the primary motion controller 110. In the event of a failure of the primary motion controller 110, which can control actuators completely independently of the secondary motion controller 120 during normal operation, the secondary motion controller 120 is therefore configured to control actuators independently of the primary motion controller 110 in the event of a failure of the primary motion controller 110.

[0086] The primary motion controller 110 is connected to the primary virtual driver unit 112 via the primary virtual driver communication link PVF. The primary motion controller 110 is connected to the primary actuators 235 and the subsystems of the primary actuator system 230 via the primary communication link PAB. The primary motion controller 110 is also connected to a redundant actuator 260, in particular the drive train 160, via the collective communication link 165. A primary power supply 210 is provided to supply power to the primary virtual driver unit 112, the primary motion controller 110, the primary actuator system 230, and the drive train 160. Alternatively, the primary virtual driver unit 112, the primary motion controller 110, the primary actuator system 230, and / or the drive train 160 may each have a separate power supply (not shown).

[0087] The primary power supply 210, the primary virtual driver unit 112, the primary motion controller 110, the primary actuator system 230, and the drivetrain 160 can be considered the primary system level 118, where the primary motion controller 110 is a unit of the vehicle control system 100 and the primary virtual driver unit 112, the primary power supply 210, the primary actuator system 230, and the drivetrain 160 are units of a periphery of the vehicle control system 100. The secondary motion controller 120 is connected to the secondary virtual driver unit 122 via the secondary virtual driver communication link SVF. The secondary motion controller 120 is connected to secondary actuators 245 or subsystems of the secondary actuator system 240 via the secondary communication link SAB. The secondary motion controller is also connected to the drivetrain 160 via the collective communication link 165.A secondary power supply 220 is provided to supply power to the secondary virtual driver unit 122, the secondary motion controller 120, and the secondary actuator system 240. Alternatively, the secondary virtual driver unit 122, the secondary motion controller 120, and / or the secondary actuator system 240 may each have a separate power supply (not shown). It is also possible for the secondary power supply 220 to supply power to the drive train 160 in addition to or as an alternative to the primary power supply 210.

[0088] The secondary power supply 220, the secondary virtual driver unit 122, the secondary motion controller 120, and the secondary actuator system 240 can be considered the secondary system level 128, where the secondary motion controller 120 is a unit of the vehicle control system 100 and the secondary virtual driver unit 122, the secondary power supply 220, and the secondary actuator system 240 are units of the peripherals of the vehicle control system 100. The drivetrain 160 is also part of the secondary system level 128, so that the primary system level 118 and the secondary system level 128 overlap, with the overlap being the drivetrain 160.

[0089] The units of the primary system level 118 and the units of the secondary system level 128 are each redundant, except for the drive train 160. The redundant units of the primary system level 118 and the secondary system level 128 are configured to fully or partially replace each other functionally.

[0090] The primary virtual unit provides the primary setpoint S1 to the primary motion controller 110 via the primary virtual driver communication connection PVF. The primary setpoint S1 specifies a vehicle movement or a target trajectory for the vehicle 1. The vehicle movement or the target trajectory is a vehicle movement planned by the primary virtual driver unit 112. The secondary virtual driver unit 122 provides the secondary setpoint S2 to the secondary motion controller 120 via the secondary virtual driver communication connection SVF. The secondary setpoint S2 specifies a vehicle movement or a target trajectory for the vehicle 1, wherein the vehicle movement or the target trajectory is a vehicle movement planned by the secondary virtual driver unit 122.The secondary motion controller 120 provides the secondary setpoint S2 received from the secondary virtual driver unit 122 to the primary motion controller 110 via the private communication connection 130. The secondary motion controller 120 is configured to provide the secondary setpoint S2 continuously, upon request from the primary motion controller 110, and / or event-driven via the private communication connection 130 to the primary motion controller 110. A possible event can be, for example, a simple error or a simple error constellation of the vehicle control system 100 and / or the peripherals of the vehicle control system 100 and / or an invalid primary setpoint S1. A simple error or a simple error constellation or an invalid primary setpoint S1 can also lead to the primary motion controller 110 requesting the secondary setpoint S2 from the secondary motion controller 120.

[0091] The primary motion controller 110 is configured to arbitrate the primary setpoint S1 and the secondary setpoint S2. To do so, the primary motion controller 110 preferably checks the validity of the primary setpoint S1 and / or the validity of the secondary setpoint S2. To check the validity of the primary and / or secondary setpoint, a checksum, a counter, or another key of the primary and / or secondary setpoint can be checked, for example. To check the primary and secondary setpoints, it is also possible to compare the primary setpoint S1 with the secondary setpoint S2. For arbitration, the primary motion controller 110 can preferably prioritize the primary setpoint S1 and the secondary setpoint S2, with the primary motion controller 110 preferentially assigning priorities to the primary setpoint S1 and the secondary setpoint S2.The priority of the setpoints can, for example, depend on whether the respective setpoint was found to be valid or not, in which case a valid setpoint would have a higher priority than an invalid setpoint. The priority can also depend on an identifier of the primary and secondary setpoints, whereby the lower the identifier of the setpoint, the higher the priority of the setpoint. The primary motion controller 110 is configured to select the primary setpoint S1 or the secondary setpoint S2 or to combine the primary setpoint S1 with the secondary setpoint S2. The primary motion controller 110 preferably selects the setpoint that was found to be valid and / or that has a higher priority.

[0092] The primary motion controller 110 is configured to process the selected setpoint or the combined setpoint and to transmit a primary control signal PS derived therefrom to the primary actuator system 230 or to the primary actuators 235 via the primary communication connection PAB. To process the selected setpoint or the combined setpoint, the primary motion controller 110 has a primary control unit 310 (see Fig. 3). The primary motion controller 110 is also configured to transmit a drivetrain control signal AS derived from the selected setpoint or combined setpoint to the drivetrain 160 via the collective communication connection 165.

[0093] By forwarding the secondary setpoint S2 from the secondary motion controller 120 to the primary motion controller 110, a single fault or a simple fault constellation in the primary system level 118 is prevented from completely switching to the secondary system level 128. A single fault or a simple fault constellation is, for example, the failure of the primary virtual driver unit 112, the primary virtual driver communication connection, and / or a primary actuator or subsystem of the primary actuator system 230.

[0094] Should the primary motion controller 110 and / or the primary power supply 210 fail in addition to or as an alternative to one of the aforementioned simple faults, the secondary system level 128 can be fully utilized to control the vehicle 1. In this respect, the secondary motion controller 120 is configured to process the secondary setpoint S2 and to transmit a secondary control signal SS derived therefrom to the secondary actuator system 240 or to the secondary actuators 245 via the secondary communication connection SAB.

[0095] Fig. 3 shows another embodiment of the vehicle control system 100. The

[0096] Vehicle control system 100 comprises the primary motion controller 110 and the secondary motion controller 120. The motion controllers 110, 120 each have a control unit 310, 320 for generating control commands 330, 335 for actuators of the vehicle depending on trajectories that are generated via the virtual driver units 112, 122 and specified in the form of the setpoint values ​​S1, S2 for the motion controllers 110, 120.

[0097] Furthermore, the primary motion controller has two transceiver units 340, 342, wherein one transceiver unit 340 of the transceiver units 340, 342 is configured to transmit control commands for the primary actuators 235 on the primary communication link PAB and the second transceiver unit 342 of the transceiver units 340, 342 is configured to transmit control commands for the redundant actuators 265 on the collective communication link 165. The secondary motion controller also has two transceiver units 344, 346, wherein one transceiver unit 346 of the transceiver units 344, 346 is configured to transmit control commands for the secondary actuators 245 on the secondary communication link SAB and the second transceiver unit 344 of the transceiver units 344, 346 is configured to transmit control commands for the non-redundant actuators 265 on the collective communication link 165.The control commands 330, 335 are thus transmitted via transceiver units 340, 342, 344, 346 connected to the control units on the primary communication link PAB, the secondary communication link SAB or the collective communication link 165.

[0098] The primary communication link PAB, the secondary communication link SAB, and the collective communication link 165 are therefore physically separated from one another. Information cannot be exchanged directly between the buses. To enable this, two bypass circuits 350, 355 are provided. Accordingly, the primary motion controller 110 has a primary bypass circuit 350 that passes information or data from the primary communication link PAB to the collective communication link 165 and vice versa. The secondary motion controller 1200 has a secondary bypass circuit 355 that passes information or data from the secondary communication link SAB to the collective communication link 165 and vice versa. Reference numerals (part of the description)

[0099] 1 vehicle

[0100] 50.1 front wheel

[0101] 50.2 front wheel

[0102] 52.1 Rear wheel

[0103] 52.2 rear wheel

[0104] 52.3 Rear wheel

[0105] 52.4 rear wheel

[0106] 100 Vehicle control system

[0107] 110 primary movement control

[0108] 112 primary virtual driver unit

[0109] 118 primary system level

[0110] 120 secondary motion control

[0111] 122 secondary virtual driver unit

[0112] 128 secondary system level

[0113] 130 private communication connection

[0114] 160 Drivetrain

[0115] 165 collective communication link

[0116] 200 vehicle system

[0117] 210 primary energy supply

[0118] 220 secondary energy supply

[0119] 230 primary actuator system

[0120] 231 primary braking system

[0121] 232 primary steering system

[0122] 235 primary actuator

[0123] 240 secondary actuator system

[0124] 241 secondary braking system

[0125] 242 secondary steering system

[0126] 245 secondary actuator

[0127] 265 redundancy-free actuator

[0128] 270 System communication connection

[0129] 310 primary control unit

[0130] 320 secondary control unit

[0131] 330 control commands 335 control commands

[0132] 340 Transceiver Unit

[0133] 342 Transceiver unit

[0134] 344 Transceiver unit

[0135] 346 Transceiver unit

[0136] 350 primary bypass circuit

[0137] 355 secondary bypass circuit

[0138] AS driveline control signal

[0139] BB Brake BUS

[0140] FB driver unit-BUS

[0141] HA1 first rear axle

[0142] HA2 second rear axle

[0143] LB steering bus

[0144] PAB primary communication link

[0145] PS primary control signal

[0146] PVF primary virtual driver communication link

[0147] 51 primary setpoint

[0148] 52 secondary setpoint

[0149] SAB secondary communication link

[0150] SS secondary control signal

[0151] SVF secondary virtual driver communication link

[0152] VA front axle

[0153] P additional primary actuator

[0154] S additional secondary actuator

Claims

Patent claims:

1. Vehicle control system (100) for autonomously controlling a vehicle (1), comprising: a primary motion controller (110) and a primary communication connection (PAB), wherein the primary motion controller (110) is configured to receive at least one primary setpoint value (S1) for a vehicle movement from a primary virtual driver unit (112) and to control at least one primary actuator (235) of the vehicle (1) via the primary communication connection (PAB), a secondary motion controller (120) and a secondary communication connection (SAB), wherein the secondary motion controller (120) is configured,to receive at least one secondary setpoint value (S2) for a vehicle movement from a secondary virtual driver unit (122) and to control at least one secondary actuator (245) of the vehicle (1) via the secondary communication connection (SAB) and a collective communication connection (165) for controlling at least one redundancy-free actuator (265) of the vehicle (1), wherein the primary motion controller (110) and the secondary motion controller (120) are configured to control the redundancy-free actuator (265) via the collective communication connection (165).

2. The vehicle control system (100) of claim 1, wherein the primary motion controller (110) includes a primary bypass circuit (350) to provide communication between the primary communication link (PAB) and the collective communication link (165), and the secondary motion controller (120) includes a secondary bypass circuit (355) to provide communication between the secondary communication link (SAB) and the collective communication link (165).

3. Vehicle control system (100) according to claim 1 or 2, further comprising a private communication connection (130) connecting the primary motion controller (110) to the secondary motion controller (120), wherein preferably the primary motion controller (110) is configured to transmit the primary setpoint value (S1) received from the primary virtual driver unit (112) and / or control commands (330) derived from the primary setpoint value (S1) via the private communication connection (130) for the secondary motion control (120), and wherein preferably the private communication connection (130) is an additional separate communication connection (130) or is formed by the collective communication connection (165).

4. Vehicle control system (100) according to claim 3, wherein the primary motion controller (110) and the secondary motion controller (120) are configured to check the plausibility of primary setpoint values (S1) and secondary setpoint values (S2) against each other via the private communication connection (130).

5. The vehicle control system (100) of claim 3 or 4, wherein the primary motion controller (110) is configured to send data to or receive data from at least one secondary actuator (245) via the private communication link (130), the secondary motion controller (120) and the secondary communication link (SAB).

6. The vehicle control system (100) according to any one of claims 3 to 5, wherein the vehicle control system (100) is configured to use the private communication connection (130) to send secondary setpoint values (S2) from the secondary motion controller (120) to the primary motion controller (110) and / or to generate control signals for at least one primary actuator (235) from secondary setpoint values (S2) in the secondary motion controller (120) and to control primary actuators (235) via the private communication connection (130), the primary motion controller (110) and the primary communication connection.

7. Vehicle control system (100) according to one of the preceding claims, wherein the vehicle control system (100) comprises at least one pair comprising a primary actuator (235) and a secondary actuator (245) redundant with respect to the primary actuator (235), wherein mutually associated actuators (235, 245) of one, several or all pairs are each connected via a system communication link (270) associated with the pair.

8. Vehicle control system (100) according to one of the preceding claims, wherein the vehicle control system (100) comprises a primary power supply (210) and a secondary power supply (220), wherein the primary power supply (210) is is directed to supply the primary motion controller (110), the primary actuator (235) and / or the primary virtual driver unit (112) with energy and the secondary energy supply (220) is configured to supply the secondary motion controller (120), the secondary actuator (245) and / or the secondary virtual driver unit (122) with energy, wherein the non-redundant actuators (265) can be supplied with energy from the primary energy supply (210) or a portion of the non-redundant actuators (265) can be supplied with energy from the primary energy supply (210) and another portion of the non-redundant actuators (265) can be supplied with energy from the secondary energy supply (220).

9. Vehicle control system (100) according to one of the preceding claims, wherein the primary motion controller (110) and the secondary motion controller (120) are configured to arbitrate the commands to be sent, in particular on the collective communication link (165), among themselves, and / or the primary motion controller (110) and / or the primary bypass circuit (350) are configured to monitor communication between the primary communication link (PAB) and the collective communication link (165) for faults, in particular including implausible data, and to interrupt said communication if a fault is detected, and / or the secondary motion controller (120) and / or the secondary bypass circuit (355) are configured to monitor communication between the secondary communication link (SAB) and the collective communication link (165) for faults, in particular including implausible data,to monitor and interrupt if a fault is detected.

10. The vehicle control system (100) according to any one of the preceding claims, wherein the primary motion controller (110) comprises a primary control unit (310) configured to detect a fault in one or more primary actuators (235), to deactivate or no longer control faulty primary actuators (235), and to control one or more secondary actuators (245) redundant with respect to the failed primary actuator (235) via the private communication link (130), the secondary motion controller (120), and the secondary communication link.

11. Vehicle control system (100) according to one of the preceding claims, wherein the secondary motion controller (120) is configured to receive a health status signal via the private communication connection (130) or a separate additional connection in order to detect a fault of the primary motion controller (110) as a function of the health status signal and preferably to control the secondary actuators (245) as a function of the secondary setpoint value (S2).

12. Vehicle system (200) with a vehicle control system (100) according to one of claims 1 to 11 and a primary virtual driver unit (112) and a secondary virtual driver unit (122) and preferably primary actuators (235), secondary actuators (245) and redundancy-free actuators (265).

13. Vehicle (1) with a vehicle system (200) according to claim 12 or a vehicle control system (100) according to one of claims 1 to 11, wherein the vehicle (1) is preferably a commercial vehicle or a passenger car.

14. A method for operating a vehicle control system (100) according to any one of claims 1 to 11 or a vehicle system (200) according to claim 12 or a vehicle (1) according to claim 13, preferably comprising: Controlling primary actuators (235) with a primary motion controller (110) depending on primary setpoints (S1) of a virtual driver unit, Controlling non-redundant actuators (265) via a collective communication connection (165) between the primary motion controller (110) and the non-redundant actuators (265), Detecting an error in the primary motion controller (110), switching to a secondary motion controller (120), continuing to operate the vehicle (1) with the secondary motion controller (120) as a function of secondary setpoint values (S2) of a secondary virtual driver unit (122), wherein non-redundant actuators (265) are controlled via the collective communication link (165), which is additionally connected to the secondary motion controller (120), and secondary actuators (245) are controlled via a secondary communication link (SAB).

15. The method of claim 14, further comprising: Detecting an error with the primary motion control (110) in at least one primary actuator (235), Controlling at least one secondary actuator (245) redundant with respect to the faulty primary actuator (235) via a private communication connection (130), the secondary motion controller (120) and the secondary communication connection, wherein the private communication connection (130) corresponds to the collective communication connection (165) or is a communication connection (130) separate from the private communication connection.

Images