Systems for assistance using vehicle infrastructure

Abstract

The present invention relates to a system for infrastructure-based assistance of a vehicle that is at least partially automatically steered in a parking lot, the system comprising: a data processing mechanism adapted to determine infrastructure assistance data for the infrastructure-based assistance of a vehicle that is at least partially automatically steered in a parking lot, a communication mechanism adapted to transmit the infrastructure assistance data to the vehicle via a communication network, and a control unit adapted to transition to a safe state, in particular such that communication between the system and the vehicle is at least disturbed, in particular blocked, if an occurrence of at least one anomaly of the data processing mechanism and the communication mechanism is detected during the infrastructure-based assistance.The present invention relates to a method, a computer program, and a machine-readable recording medium.

Description

[Technical field]

[0001] The present invention relates to a system and method for infrastructure-based assistance of at least partially autonomously piloted vehicles in parking lots.The present invention relates to a computer program and a machine-readable recording medium. [Background technology]

[0002] In so-called automated valet parking (AVP), which can be translated into German as automatische Parkservice (automated parking service), the car is driven unmanned at low speeds (<10 km / h), for example by a parking garage.

[0003] In this case, the infrastructure is responsible for obstacle recognition and controls the vehicle. For obstacle recognition, for example, lidar sensors or cameras are installed in the infrastructure. The vehicle does not need on-board sensor equipment for AVP.

[0004] The communication between the vehicle and the infrastructure is carried out via a wireless connection, which can be based on WLAN or via mobile radio (4G, 5G, etc.). What all communication paths have in common is that data transmission can be interrupted or blocked, for example by the failure of a communication module, electromagnetic interference, etc.

[0005] In this case, the car must recognize the loss of communication and transition to a safe state, which at low speeds, such as AVP's, is simply the car coming to a halt, meaning it must brake to a stop and then, for example, prevent itself from rolling away.

[0006] This is exactly what happens in a typical AVP car: if communication stops, the car immediately brakes and is prevented from rolling away. Publication EP 2 858 039 A1 discloses a method for automatically controlling the entry of road vehicles into a controlled road section.

[0007] Publication DE102012202934A1 discloses a wireless remote control by which vehicle functions of a motor vehicle can be controlled. Summary of the Invention [Problem to be solved by the invention]

[0008] The problem underlying the present invention can be seen as providing a concept for safe, infrastructure-based assistance of at least partially autonomously driven vehicles in parking lots. [Means for solving the problem]

[0009] This problem is solved by the subject matter of the respective independent claims. Advantageous configurations of the invention are the subject matter of the respective dependent claims. According to a first aspect, there is provided a system for infrastructure-based assistance of an at least partially autonomously driven vehicle in a parking lot, the system comprising: a data processing mechanism adapted to determine infrastructure assistance data for infrastructure-based assistance of the at least partially autonomously driven vehicle in a parking lot; a communication mechanism adapted to transmit infrastructure assistance data to the vehicle via a communication network; A system is provided that includes a control unit adapted to transition to a safe state, in particular such that communication between the communication mechanism and the vehicle is at least disrupted, in particular blocked, when an abnormality is detected in at least one of the data processing mechanism and the communication mechanism (i.e., the data processing mechanism and / or the communication mechanism) during infrastructure-based assistance.

[0010] According to a second aspect, a method for infrastructure-based assistance of an at least partially autonomously driven vehicle in a parking lot is provided, the method comprising the steps of: determining infrastructure assistance data for infrastructure-based assistance of the at least partially autonomously driven vehicle in a parking lot; transmitting the infrastructure assistance data to the vehicle via a communications network; When an abnormality is detected during assistance using the infrastructure, a safe state is transitioned to, more specifically, communication with the vehicle is at least disrupted, particularly cut off.

[0011] According to a third aspect there is provided a computer program comprising instructions which, when executed by a computer, for example by a system according to the first aspect, cause the computer to carry out a method according to the second aspect.

[0012] According to a fourth aspect, there is provided a machine-readable recording medium having stored thereon a computer program according to the third aspect. The present invention is based on and incorporates the knowledge that the above problem is solved by an instance that assists, i.e. supports, in at least partially automated driving of a vehicle in a parking lot being transferred to a safe state upon detection of an anomaly, in particular by at least disrupting, in particular interrupting, the communication between the instance, i.e. the system according to the first aspect, and the vehicle. In a vehicle, this means that the vehicle is also transferred to a safe state, e.g. parked, so that the collision risk can be effectively reduced. The vehicle is thus adapted to transition to a safe state, in particular to park, when the communication between the system and the vehicle is disrupted, in particular interrupted. The safe state of the vehicle includes, in particular, parked.

[0013] This results in the technical advantage, for example, that assistance can be implemented safely in that in the event of a fault, the system and thus also the vehicle are brought or transferred to a safe state.

[0014] Infrastructure-assisted assistance of a vehicle means, inter alia, that the vehicle is provided with infrastructure assistance data. Based on the infrastructure assistance data, the vehicle can, for example, derive operating instructions. Based on the infrastructure assistance data, the vehicle can, for example, decide for itself what to do.

[0015] The infrastructure assistance data includes, for example, one or more of the following data elements: control instructions for at least partially automatic control of lateral and / or longitudinal steering of the vehicle, remote control instructions for at least partially automatic remote control of lateral and / or longitudinal steering of the vehicle, authorization instructions for allowing at least partially automatic driving of the vehicle within a particular area of ​​the parking lot and during a particular time, in particular autonomous (i.e. fully automated) driving, a target trajectory for the vehicle, a target position within the parking lot, surrounding data describing the surroundings of the vehicle.

[0016] As used herein, the phrase "in one embodiment of a system according to the first aspect" includes the phrase "an embodiment of a system according to the first aspect, e.g., an embodiment including at least one respective feature of the embodiments described herein." In other words, each feature of the embodiments described herein may be present, e.g., in any combination.

[0017] In one embodiment of the system according to the first aspect, it is contemplated that the communication mechanism comprises a base station and a switch, the switch being, for example, a network switch. In one embodiment of the system based on the first aspect, it is contemplated that the switch is connected between the data processing mechanism and the base station and adapted to receive infrastructure assistance data from the data processing mechanism and forward it to the base station, the base station is adapted to transmit the infrastructure assistance data to the vehicle via a wireless communication network, and the control unit is adapted to turn off an electrical energy source for supplying electrical energy to the switch when an occurrence of an abnormality is detected during assistance using the infrastructure.

[0018] This provides the technical advantage, for example, that the communication mechanism can be efficiently transferred to a safe state, in particular that communication between the communication mechanism and the motor vehicle can be efficiently disrupted, in particular blocked.

[0019] The switching off of the electrical energy source for the electrical energy supply of the switch inter alia makes it impossible for the switch to receive infrastructure assistance data from the data processing arrangement and forward it to the base station, i.e. the base station does not receive the infrastructure assistance data and therefore cannot transmit the infrastructure assistance data via the wireless communication network to the vehicle.

[0020] From the viewpoint of the vehicle, communication is thus disturbed, in particular blocked, so that the vehicle is brought or moved into a safe state, for example to a stop. In one embodiment of the system based on the first aspect, it is contemplated that the data processing mechanism includes a checksum calculation unit adapted to determine a checksum for the infrastructure assistance data, in which case the communication mechanism is adapted to transmit the checksum to the motor vehicle via the communication network.

[0021] In one embodiment of the system according to the first aspect, it is contemplated that the control unit is adapted to switch off an electrical energy source for the electrical energy supply of the checksum calculation unit when an occurrence of an anomaly is detected during infrastructure-based assistance.

[0022] This provides the technical advantage, for example, that the data processing mechanism can be efficiently brought into a safe state, in particular that communication between the system and the vehicle can be efficiently interrupted, in particular blocked.

[0023] The switching off of the electric energy source for the electric energy supply of the checksum calculation unit, among other things, causes the checksum calculation unit to be unable to determine the checksum for the infrastructure assistance data. As a result, there is also no checksum that can be transmitted by the communication mechanism via the communication network to the vehicle. The vehicle therefore does not obtain the checksum for the infrastructure assistance data. From the viewpoint of the vehicle, this means that the communication between the system and the vehicle is at least interrupted, in particular interrupted. As a result, the vehicle will be transferred to a safe state, for example, stationary.

[0024] In one embodiment of the system based on the first aspect, it is contemplated that the data processing mechanism includes a server configured separately from the checksum calculation unit and connected to the checksum calculation unit, the server adapted to determine the infrastructure assistance data and a server checksum for the infrastructure assistance data and to transmit the server checksum to the checksum calculation unit, and the checksum calculation unit adapted to determine the checksum based on the server checksum.

[0025] This provides the technical advantage that, for example, the checksum can be efficiently determined by the checksum calculation unit. That is, the server prepares a checksum for the checksum calculation unit: server checksum. This prepared checksum is received by the checksum calculation unit and used as a basis to determine a checksum, which is finally transmitted by the communication mechanism to the motor vehicle via the communication network. Determining the checksum on the basis of the server checksum includes, for example, processing of the server checksum, i.e. the checksum prepared by the server. Processing of the server checksum includes, for example, inversion of one or more bits of the server checksum. For example, the step of determining the checksum on the basis of the server checksum corresponds to the last step of the calculation of the checksum for the infrastructure assistance data. This means that the checksum is determined for the infrastructure assistance data and the calculation steps required for this are performed by the server, except for the last step of the calculation of the checksum, which is performed by the checksum calculation unit.

[0026] In an embodiment of the system according to the first aspect, it is contemplated that the checksum calculation unit and the server are connected to each other by a bus system, in particular a USB, and / or by a network connection.

[0027] This provides the technical advantage that, for example, checksum calculation units and servers can be efficiently interconnected. The network connection may include, for example, an Ethernet connection.

[0028] In one embodiment of the system according to the first aspect, it is contemplated that the checksum calculation unit is a microcontroller or a single board computer or a PC.

[0029] This provides a technical advantage, for example, that a checksum calculation unit may be implemented efficiently. In one embodiment of the system according to the first aspect, it is provided that an electrical energy source for the electrical energy supply of the switch and / or an electrical energy source for the electrical energy supply of the checksum calculation unit is included in the control unit.

[0030] This provides the technical advantage, for example, that the respective electrical energy source can be efficiently implemented. An electrical energy source in the sense of this specification includes for example a voltage supply and / or a current supply.

[0031] For example, an electrical energy source for the electrical energy supply within the meaning of this specification includes a 24 volt voltage supply. In one embodiment of the system according to the first aspect, it is contemplated that the control unit is a programmable logic controller, a PC, or a microcontroller.

[0032] This provides the technical advantage, for example, that the controller may be implemented efficiently. According to an embodiment of the system according to the first aspect, the control is formed as a safety control, in particular as a safety programmable logic controller (PLC). A safety PLC is certified by the manufacturer for use in safety-critical systems. A safety PLC is used whenever protection mechanisms are controlled to avoid personal injuries, e.g. elevators, high pressure safety systems, etc.

[0033] A "normal" PLC controls simple flows / machines where an anomaly in the PLC has no potential to cause injury to anyone. In one embodiment of the system according to the first aspect, it is contemplated that the system is adapted to execute or perform the method according to the second aspect.

[0034] In one embodiment of the method according to the second aspect, it is contemplated that the method is performed or carried out by a system according to the first aspect, i.e., in other words, the method according to the second aspect is, for example, performed or carried out using a system according to the first aspect.

[0035] An embodiment of the system according to the first aspect contemplates that the communication mechanism is adapted to receive, via the communication network, an ambient environment signal representative of an ambient environment of the motor vehicle.

[0036] The ambient environment signal may include an ambient environment sensor signal, for example, from one of a plurality of ambient environment sensors. An ambience sensor in the sense of this specification is for example one of the following ambience sensors: radar sensor, lidar sensor, ultrasonic sensor, video sensor / camera (both mono and stereo), magnetic field sensor and infrared sensor. The ambience sensor is for example an automobile ambience sensor, i.e. an on-board ambience sensor. The ambience sensor is for example an infrastructure, i.e. a parking lot ambience sensor, i.e. an infrastructure ambience sensor. In case of multiple ambience sensors, for example at least one ambience sensor is an on-board ambience sensor and / or for example: at least one ambience sensor is an infrastructure ambience sensor, i.e. an infrastructure ambience sensor arranged in the parking lot. The infrastructure ambience sensor is arranged in the parking lot, for example in a spatially distributed manner. The explanations given in the context of one ambience sensor apply analogously to multiple ambience sensors and vice versa.

[0037] In other words, among other things, a plurality of ambient environment sensors are spatially distributed within the parking lot, and each of these ambient environment sensors is adapted to capture its ambient environment and transmit an ambient environment signal based on each capture to the system based on the first aspect or to a communication mechanism of this system.

[0038] In one embodiment of the system according to the first aspect, it is contemplated that the system includes one or more of the ambient environment sensors characterized above. In one embodiment of the method according to the second aspect, it is contemplated that the method is a computer-implemented method.

[0039] The technical functionality of the method according to the second aspect is clear from the corresponding technical functionality of the system according to the first aspect, and vice versa. Or, in other words, the features of the method are obvious from the features of the system, and vice versa.

[0040] The abbreviation "bzw." stands for "beziehungsweise (or)". The concept "beziehungsweise (or)" includes the concept "respektive (or)". The concept "respektive (or)" includes the expression "and / or".

[0041] The vehicle is adapted to be at least partially autonomous. The vehicle is, for example, an AVP vehicle. Such a vehicle is adapted, among other things, to perform an AVP process. AVP stands for "Automated Valet Parking", which can be translated into German as "automatische Parkservice".

[0042] The phrase "at least partial autopilot" includes one or more of the following cases: assisted piloting, partial autopilot, advanced autopilot, and full autopilot. Assisted steering means that the driver of the vehicle permanently performs either lateral or longitudinal steering of the vehicle. The other driving task (i.e. longitudinal steering or control of the lateral steering of the vehicle) is performed automatically. In other words, during assisted steering of the vehicle, either the lateral or longitudinal steering is automatically controlled.

[0043] Partial autonomy means that the longitudinal and lateral steering of a vehicle is automatically controlled in certain situations (e.g.: driving on a highway, driving in a parking lot, overtaking objects, driving within a lane defined by lane markings) and / or for a certain amount of time. The driver of the vehicle does not have to manually control the longitudinal and lateral steering of the vehicle himself / herself. However, the driver must permanently monitor the automatic control of longitudinal and lateral steering so that he / she can intervene manually if necessary. The driver must be ready to take over complete control of the vehicle steering at any time.

[0044] High autopiloting means that the longitudinal and lateral steering of a vehicle is automatically controlled for a certain period of time and in certain situations (e.g.: driving on a highway, driving in a parking lot, overtaking objects, driving in a lane defined by lane markings). The driver of the vehicle does not have to manually control the longitudinal and lateral steering of the vehicle himself. The driver does not have to permanently monitor the automatic control of longitudinal and lateral steering to be able to intervene manually when necessary. A handover request to the driver to take over control of longitudinal and lateral steering is output automatically when necessary, and in particular with sufficient time to do so. This means that the driver must potentially be able to take over control of longitudinal and lateral steering. The limits of the automatic control of lateral and longitudinal steering are automatically recognized. With high autopiloting, it is not possible to automatically bring about a minimum-risk situation in every initial situation.

[0045] Fully automatic means that in certain situations (for example: driving on a highway, driving in a parking lot, overtaking an object, driving in a lane defined by lane markings), the longitudinal and lateral steering of the vehicle is automatically controlled. The driver of the vehicle does not have to manually control the longitudinal and lateral steering of the vehicle himself. The driver does not have to monitor the automatic control of longitudinal and lateral steering so that he can manually intervene if necessary. The request to the driver to take over the driving task (the control of the longitudinal and longitudinal steering of the vehicle) is automatically made before the automatic control of lateral and longitudinal steering is terminated, particularly with sufficient time to do so. If the driver does not take over the driving task, the system is automatically returned to a minimum risk state. The limits of the automatic control of lateral and longitudinal steering are automatically recognized. It is possible to automatically return to a minimum risk system state in all situations. In the case of AVP, it can be fully automatic, in which case the driver does not even need to be in the vehicle. The vehicle can actually run unmanned.

[0046] The concepts "support" and "assist" may be used synonymously. A communication network within the meaning of this specification includes for example a mobile radio network and / or a WLAN network.

[0047] A base station within the meaning of this specification is for example a mobile radio base station and / or a WLAN base station. The abbreviation "at least one" means "one or more."

[0048] Exemplary embodiments of the invention are illustrated in the drawings and are explained in more detail in the following description. [Brief description of the drawings]

[0049] [Figure 1] FIG. 4 is a flow diagram of a method according to a second embodiment. [Diagram 2] FIG. 13 illustrates a machine-readable recording medium according to a fourth embodiment. [Diagram 3]FIG. 1 illustrates a first system according to a first embodiment. [Figure 4] FIG. 2 illustrates a second system according to the first embodiment. [Diagram 5] FIG. 2 illustrates a third system according to the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0050] FIG. 1 illustrates a method for infrastructure-based assistance of at least partially autonomously driven vehicles in parking lots, the method comprising the steps of: determining 101 infrastructure assistance data for infrastructure-based assistance of an at least partially autonomously driven vehicle in a parking lot; transmitting 103 the infrastructure assistance data to the vehicle via a communications network; A flow diagram of a method is shown, which includes a step of transitioning to a safe state 105, in particular, where communication with the vehicle is at least disrupted, in particular cut off, when an abnormality is detected during infrastructure-based assistance.

[0051] Figure 2 shows a machine-readable recording medium 201 on which is stored a computer program 203. The computer program 203 comprises instructions which, when executed by a computer, for example by a system according to the first aspect, cause the computer to carry out the method according to the second aspect.

[0052] FIG. 3 shows a first system 301 for infrastructure-based assistance of an at least partially autonomously driven vehicle in a parking lot, comprising: a data processing mechanism 303 adapted to determine infrastructure assistance data for infrastructure-based assistance of the at least partially autonomously driven vehicle in the parking lot; a communication mechanism 305 adapted to transmit infrastructure assistance data to the vehicle via a communication network; A first system 301 is shown, which includes a control unit 307 adapted to transition to a safe state, in particular such that communication between the system and the vehicle is at least disrupted, in particular blocked, when the occurrence of at least one abnormality in the data processing mechanism and the communication mechanism is detected during infrastructure-based assistance.

[0053] FIG. 4 shows a second system 401 for infrastructure-based assistance of an at least partially autonomous vehicle in a parking lot. The system 401 comprises a data processing arrangement 403 adapted to determine infrastructure assistance data for infrastructure-assisted assistance of an at least partially autonomously steered vehicle in a parking lot. The data processing arrangement 403 comprises for this purpose a server 405. In other words, the server 405 determines the infrastructure assistance data.

[0054] The first system 401 further includes a communication mechanism 407 adapted to transmit infrastructure assistance data to the vehicle via a communication network. The communication mechanism 407 includes a base station 409 and a switch 411, the switch 411 being connected between the data processing mechanism 403 and the base station 409.

[0055] The switch 411 is adapted to receive the infrastructure assistance data from the data processing facility 403 and forward it to the base station 409. The base station 409 is adapted to transmit the infrastructure assistance data to the vehicle via a wireless communication network, e.g. WLAN and / or mobile radio.

[0056] The communication mechanism 407 includes a source of electrical energy 413 for the switch 411. In an embodiment not shown, the source of electrical energy 413 is not included in the communication mechanism 407 but is configured separately from the communication mechanism 407 and is included in the second system 401.

[0057] The source of electrical energy 413 is for example a voltage supply, for example a 24 volt voltage supply. An electrical energy source 413 supplies electrical energy to the switch 411. For this purpose, the electrical energy source 413 and the switch 411 are electrically connected to each other.

[0058] The second system 401 comprises a control unit 415 adapted to switch off an electrical energy source 413 for the electrical energy supply of the switch 411, in particular to break the electrical connection between the energy source 413 and the switch 411, if an occurrence of an anomaly is detected during the infrastructure assistance. In this case, the switch 411 is no longer able to receive infrastructure assistance data from the data processing arrangement 403 and forward it to the base station 409. This means that the system 401 will no longer transmit infrastructure assistance data to the vehicle. Thus, the communication between the system 401 and the vehicle is interrupted. In the vehicle, this causes the vehicle to transition to a safe state, e.g. to a stop.

[0059] Turning off the electrical energy source 413 by the control unit 415 provides, among other technical advantages, that communication between the system 401 and the vehicle may be effectively cut off. It may indeed be possible to cut a cable communicating, for example, to a car. For example, a cable from the data processing direction 403 to the base station 409 may be interrupted. If such a cable is interrupted, the car cannot be reached via the base station 409. However, there are usually no relays or other switches to cut such data cables. The necessary shielding of such communication or data cables precludes the use of relays.

[0060] The above-described concept has the technical advantage here that a communication connection can be effectively interrupted without having to cut the data cable for that purpose. FIG. 5 shows a third system 501 for infrastructure-based assistance of an at least partially autonomous vehicle 513 in a parking lot.

[0061] The third system 501 includes a data processing mechanism 503 adapted to determine infrastructure assistance data for infrastructure-assisted assistance of a vehicle 513 that is at least partially autonomously steered in a parking lot.

[0062] The data processing facility 503 includes a server 505 that mirrors the server 405 of the second system 401 in determining infrastructure assistance data. The data processing mechanism 503 further includes a checksum calculation unit 507 adapted to determine a checksum for the infrastructure assistance data.

[0063] The data processing arrangement 503 further comprises an electrical energy source 509 for the electrical energy supply of the checksum calculation unit 507. In an embodiment not shown, the electrical energy source 509 is not included in the data processing arrangement 503 but is configured separately from the data processing arrangement 503 and is thus included in the third system 501.

[0064] The electrical energy source 509 is for example a voltage supply, in particular a 24 volt voltage supply. The third system 501 further includes a communication mechanism 511 adapted to transmit the infrastructure assistance data via a communication network to the vehicle 513. The communication mechanism 511 includes, for example, a base station adapted to receive the infrastructure assistance data from the data processing mechanism 503 and transmit the infrastructure assistance data via a wireless communication network to the vehicle 513. The communication mechanism 511 is, in an embodiment not shown, configured after the communication mechanism 407 of the second system 401.

[0065] The third system 501 includes a control unit 515 adapted to turn off an electric energy source 509 for the electric energy supply of the checksum calculation unit 507 when an occurrence of an anomaly is detected during infrastructure-based assistance, which causes the checksum calculation unit 507 to be unable to determine a checksum for the infrastructure assistance data.

[0066] In the normal case, i.e. if no anomaly is detected, the checksum determined by the checksum calculation unit 507 is transmitted by the communication mechanism 511 to the motor vehicle 513 via the wireless communication network, in particular together with the associated infrastructure assistance data, i.e. the motor vehicle 513 can check, for example, the integrity of the infrastructure assistance data.

[0067] It is contemplated that the checksum calculation unit 507, for example, transmits the determined checksum directly to the communication mechanism 511. For this purpose, a communication connection may be provided between the checksum calculation unit 507 and the communication mechanism 511, which is not shown for the sake of clarity. Additionally or alternatively, it is contemplated that, for example, the checksum calculation unit 507 transmits the determined checksum back to the server 505, which then transmits, for example, the determined checksum to the communication mechanism 511, which in turn transmits the determined checksum to the motor vehicle 513.

[0068] If, on the other hand, an anomaly is detected, the electrical energy source 509 is switched off by the control unit 515. In such a case, the checksum calculation unit 507 is no longer able to determine the checksum, or in other words, the checksum cannot be transmitted to the vehicle 513, which in turn receives the infrastructure assistance data as the case may be, but without the associated checksum. The vehicle 513 evaluates this as a disruption of communication, so that the vehicle reacts by going into a safe state, for example to a stop.

[0069] The control unit 515 is formed as, for example, a programmable logic controller. For example, it is contemplated that all steps of the calculation of the checksum for the infrastructure assistance data are performed by the server 505 except for the last step, which is performed by the checksum calculation unit 507. In other words, before the last step, the server 505 transmits the checksum determined by then, which is the server checksum in the sense of this specification, to the checksum calculation unit 507, which then performs the last step of the checksum calculation, for example performing an inversion of one or more bits of the server checksum. That is, by performing the last step, the checksum for the infrastructure assistance data has been determined.

[0070] Upon detection of an anomaly, i.e. if the checksum calculation unit 507 is switched off or the electrical energy source 509 is switched off in the case of an anomaly, this last step of the checksum calculation cannot be carried out, i.e. the vehicle 513 possibly obtains infrastructure assistance data, which are however invalid for the vehicle 513 since no checksum is present, and the vehicle 513 is accordingly transferred to a safe state as already explained above.

[0071] An advantage of this embodiment can be found, inter alia, in that in case of an anomaly, i.e. upon detection of an anomaly, communication between the system 501 and the vehicle 513 is still possible, i.e. status messages can still be exchanged. Furthermore, this embodiment works regardless of the communication technology used, e.g. WLAN, 4G, 5G.

[0072] In summary, the concept described here includes, inter alia, two possibilities by which a safe state of infrastructure and vehicles can be achieved by being able to disrupt, and in particular block, communications to vehicles.

[0073] Possibility 1 - (Network) Switch is Off The system includes a computer network that includes a network switch that is looped in or otherwise connected to a data connection between, for example, a server and a base station, particularly a WLAN access point, and that receives, for example, an Ethernet data packet at a port and then transmits the Ethernet data packet (based on the recipient address presented in the packet) on a port to which the recipient (or the network segment on which the recipient resides) is attached.

[0074] In the normal case, i.e. without any anomaly detection, the switch (which may for example be called a "fail-safe switch") transfers data (infrastructure support data) from the server to the WLAN / mobile radio network. If the voltage supply (for example 24V) for the switch is switched off, the switch is unable to fulfill this task.

[0075] The control unit, for example a PLC (Programmable Logic Controller), monitors the infrastructure for abnormalities. If an abnormality is detected, the control unit switches off the voltage supply to the switch, which in turn cuts off the data connection to the car. Commands from the infrastructure, i.e. from the system, can no longer reach the car, and the car transitions to a safe state accordingly.

[0076] Possibility 2 - Blocking or turning off communication by disrupting checksum calculations In this possibility, a recognized anomaly in the infrastructure would disrupt the checksum calculation for a safety-critical command, causing the vehicle to recognize the command's checksum as incorrect and transition to a safe state.

[0077] For this purpose, a server in the infrastructure calculates one checksum for each security-critical command, the last step of which is performed on a separate device (the checksum calculation unit) (e.g. inversion of the individual bits of the checksum).

[0078] If this other device is then switched off in the event of an anomaly, the last step of the checksum calculation cannot be carried out, and the vehicle will therefore not be able to receive valid safety-critical commands.

[0079] The advantage of this possibility is that the communication channel to the vehicle continues to exist in the event of an anomaly: only safety-critical communications are interrupted, which puts the vehicle into a safe state; the exchange of status messages is still possible.

[0080] The background is that the car will only accept complete data with a correct checksum: if the checksum is wrong or not present, the data (infrastructure support data) will be incomplete or none will be accepted by the car, and the car will transition to a safe state (among other things, stop) in each of these cases.

[0081] If the server does not get the checksum from the checksum calculation unit, there are the following possibilities: 1. The server doesn't send anything to the car. 2. The server sends the data to the car without a checksum. 3. The server sends the car the data with a checksum (but this checksum is incorrect because the "last" calculation step could not be performed by the checksum calculation unit; or: if the checksum calculation unit performs the entire checksum calculation, the server writes the value "zero" as checksum in the data packet anyway).

[0082] Each of the possibilities 1., 2., and 3. described above are provided as exemplary embodiments. These configurations work regardless of the communication technology used (WLAN, 4G, 5G).

[0083] Various devices can be used as checksum calculation units: A microcontroller connected to a server via USB and receiving its voltage supply from a control unit. The server sends the prepared checksum to the microcontroller via USB and receives the processed checksum in response. If the voltage supply of the microcontroller is switched off, the microcontroller cannot respond.

[0084] A mini PC / single board computer that gets its voltage supply from the control unit. The server sends the prepared safety-critical commands to the PC, where the checksums are processed accordingly and then either sent directly to the car or back to the server, which then sends them to the car.

Claims

1. A system (301, 401, 501) for infrastructure-based assistance of an at least partially autonomously driven vehicle (513) in a parking lot, comprising: a data processing mechanism (303, 403, 503) adapted to determine infrastructure assistance data for infrastructure-assisted assistance of the vehicle (513) at least partially automatically steered in the parking lot; a communication mechanism (305, 407, 511) adapted to transmit said infrastructure assistance data to said vehicle (513) via a communication network; a control unit (307, 415, 515) adapted to transition to a safe state when an occurrence of an abnormality in at least one of the data processing mechanism (303, 403, 503) and the communication mechanism (305, 407, 511) is detected during the assistance using the infrastructure, thereby at least disrupting communication between the system and the vehicle (513); The system (301, 401, 501), wherein the communication mechanism (305, 407, 511) has a base station (409) and a switch (411), the switch (411) is connected between the data processing mechanism (303, 403, 503) and the base station and adapted to receive the infrastructure assistance data from the data processing mechanism (303, 403, 503) and transfer it to the base station (409), the base station (409) is adapted to transmit the infrastructure assistance data to the vehicle (513) via a wireless communication network, and the control unit (307, 415, 515) is adapted to turn off an electrical energy source (415) for supplying electrical energy to the switch (411) when an abnormality is detected during assistance using the infrastructure.

2. A system (301, 401, 501) for infrastructure-based assistance of an at least partially autonomous vehicle (513) in a parking lot, comprising: a data processing mechanism (303, 403, 503) adapted to determine infrastructure assistance data for infrastructure-assisted assistance of the vehicle (513) at least partially automatically steered in the parking lot; a communication mechanism (305, 407, 511) adapted to transmit said infrastructure assistance data to said vehicle (513) via a communication network; a control unit (307, 415, 515) adapted to transition to a safe state when an occurrence of an abnormality in at least one of the data processing mechanism (303, 403, 503) and the communication mechanism (305, 407, 511) is detected during the assistance using the infrastructure, thereby at least disrupting communication between the system and the vehicle (513); the data processing mechanism (303, 403, 503) comprises a checksum calculation unit (507) adapted to determine a checksum for the infrastructure assistance data, the communication mechanism (305, 407, 511) is adapted to transmit the checksum to the vehicle (513) via the communication network, and the control unit (307, 415, 515) is adapted to switch off an electrical energy source (509) for supplying electrical energy to the checksum calculation unit (507) when an abnormality is detected during the assistance using the infrastructure, A system (301, 401, 501), wherein the data processing mechanism (303, 403, 503) includes a server (405, 505) configured separately from the checksum calculation unit (507) and connected to the checksum calculation unit (507), the server (405, 505) is adapted to determine the infrastructure support data and a server checksum for the infrastructure support data, and to transmit the server checksum to the checksum calculation unit (507), and the checksum calculation unit (507) is adapted to determine the checksum based on the server checksum.

3. The system (301, 401, 501) according to claim 2, wherein the checksum calculation unit (507) and the server (405, 505) are interconnected by a bus system, in particular USB, and / or by a network connection.

4. The system (301, 401, 501) according to claim 2 or 3, wherein the checksum calculation unit (507) is a microcontroller or a single board computer or a PC.

5. The system (301, 401, 501) according to claim 1, wherein the electrical energy source (415) for the electrical energy supply of the switch (411) is included in the control unit (307, 415, 515).

6. A system (301, 401, 501) described in any one of claims 2 to 4, wherein the electrical energy source (509) for supplying electrical energy to the checksum calculation unit (507) is included in the control unit (307, 415, 515).

7. The system (301, 401, 501) of any one of claims 1 to 6, wherein the control unit (307, 415, 515) is a programmable logic controller (307, 415, 515), a PC, or a microcontroller.

8. A method implemented by a system for infrastructure-based assistance of an at least partially autonomously steered vehicle (513) in a parking lot, said system including a data processing mechanism (303, 403, 503), a communication mechanism (305, 407, 511) and a control unit (307, 415, 515), comprising the following steps: said data processing mechanism (303, 403, 503) determining (101) infrastructure assistance data for infrastructure-assisted assistance of said vehicle (513) at least partially autonomously steered in said parking lot; a step of the communication mechanism (305, 407, 511) transmitting (103) the infrastructure assistance data to the vehicle via a communication network; and when an occurrence of an abnormality in at least one of the data processing mechanism (303, 403, 503) and the communication mechanism (305, 407, 511) is detected during the assistance using the infrastructure, a step of transitioning (105) to a safe state, whereby communication with the vehicle (513) is at least interrupted; The communication mechanism (305, 407, 511) has a base station (409) and a switch (411), the switch (411) is connected between the data processing mechanism (303, 403, 503) and the base station, and receives the infrastructure assistance data from the data processing mechanism (303, 403, 503) and transfers it to the base station (409), the base station (409) transmits the infrastructure assistance data to the vehicle (513) via a wireless communication network, and the control unit (307, 415, 515) turns off an electrical energy source (415) for supplying electrical energy to the switch (411) when an abnormality is detected during assistance using the infrastructure.

9. A method implemented by a system for infrastructure-based assistance of an at least partially autonomous vehicle (513) in a parking lot, said system including a data processing mechanism (303, 403, 503), a communication mechanism (305, 407, 511) and a control unit (307, 415, 515), comprising the steps of: said data processing mechanism (303, 403, 503) determining (101) infrastructure assistance data for infrastructure-assisted assistance of said vehicle (513) at least partially autonomously steered in said parking lot; a step of the communication mechanism (305, 407, 511) transmitting (103) the infrastructure assistance data to the vehicle via a communication network; and when an occurrence of an abnormality in at least one of the data processing mechanism (303, 403, 503) and the communication mechanism (305, 407, 511) is detected during the assistance using the infrastructure, a transition (105) to a safe state is made, whereby communication between the system and the vehicle (513) is at least interrupted; the data processing mechanism (303, 403, 503) includes a checksum calculation unit (507) adapted to determine a checksum for the infrastructure assistance data, the communication mechanism (305, 407, 511) transmits the checksum to the vehicle (513) via the communication network, and the control unit (307, 415, 515) turns off an electrical energy source (509) for supplying electrical energy to the checksum calculation unit (507) when an abnormality is detected during the assistance using the infrastructure, The method, wherein the data processing mechanism (303, 403, 503) includes a server (405, 505) configured separately from the checksum calculation unit (507) and connected to the checksum calculation unit (507), the server (405, 505) determines the infrastructure support data and a server checksum for the infrastructure support data, transmits the server checksum to the checksum calculation unit (507), and the checksum calculation unit (507) determines the checksum based on the server checksum.

10. A computer program (203) comprising instructions for causing a computer system including a data processing mechanism (303, 403, 503), a communication mechanism (305, 407, 511), and a control unit (307, 415, 515) to execute the method described in claim 8 or 9.

11. A machine-readable recording medium (201) having stored thereon the computer program (203) according to claim 10.

Images