Device and method for generating and transmitting control commands for an autonomously driving motor vehicle

[0001] The present application claims priority to International Patent Application No. PCT/EP2022/069783 to Schneider et al., filed Jul. 14, 2022, titled “Device and Method for Generating and Transmitting Control Commands for an Autonomously Driving Motor Vehicle,” which claims priority to German Pat. App. No. DE 10 2021 207 578.9, filed Jul. 16, 2021, to Schneider, et al., the contents of each being incorporated by reference in their entirety herein.

[0002] The present disclosure relates to a device and a method for generating and transmitting control commands for an autonomously driving motor vehicle.

[0003] Devices of this type must be fault-tolerant with regard to individual faults, i.e., the device must be able, for example, to bring the motor vehicle to a safe standstill or to continue to guide it safely in some other way. Such maneuvers are also known as limb home, limb aside or break in lane. One possible approach is full redundancy, e.g., two systems working in parallel.

[0004] The present disclosure is based on the technical problem of creating an improved device for generating control commands for an autonomously driving motor vehicle, and of making available a suitable method.

[0005] The technical problem is solved by a device with the features of the independent claims recited below. Further advantageous configurations of the invention result from the dependent claims.

[0006] In some examples, a device is disclosed for generating and transmitting control commands for an autonomously driving motor vehicle is designed in such a way that it receives at least environment data and vehicle status data, calculates at least one trajectory therefrom, calculates the control commands required for the implementation of the trajectory for at least one actuator and transmits it to the at least one actuator, whereby the device comprises at least a first sub-system, a second sub-system, a third sub-system and a fourth sub-system. The first sub-system and the third sub-system work as masters and the second sub-system and the fourth sub-system work as slaves, whereby the first sub-system and the second sub-system are connected via at least one data connection and the third sub-system and the fourth sub-system are connected to one another via a further data connection are connected, whereby the first sub-system and the third sub-system are additionally connected to one another via at least one data connection and the second sub-system and the fourth sub-system are connected to one another via a data connection. The first sub-system and the second sub-system each receives at least environment data and vehicle status data and the third sub-system and the fourth sub-system transmit at least the control commands to the at least one actuator, whereby at least the first sub-system and the third sub-system are designed to be fail-silent, whereby the device is further designed such that in the event of individual faults in a sub-system, at least one control command is generated and transmitted to bring the motor vehicle in a safe state.

[0007] In some examples, the first to fourth sub-systems can also be viewed as nodes in a network. The surrounding data can come from an environmental sensor system in the vehicle, which has cameras and/or radar sensors and/or lidar sensors and/or ultrasonic sensors, for example. Alternatively, or additionally, the surroundings data can come from external sensors of a traffic infrastructure and/or from other motor vehicles. The vehicle status data are in particular the location, speed and direction of the autonomously driving motor vehicle. The first sub-system and the second sub-system can receive the same surrounding data and/or vehicle status data or data from different data sources. The fact that the first sub-system and the third sub-system are fail-silent means that they are “silent” in the event of a fault and no longer participate in the communication. A first power supply is preferably assigned to the first and third sub-systems and a second power supply is assigned to the second and fourth sub-systems, the first and second power supplies being independent of one another. However, it is also possible to assign each sub-system its own, independent power supply.

[0008] Using a master-slave configuration, the third and fourth sub-systems can control the same actuator system without conflicts occurring, while the ring structure ensures that the control commands can always be calculated and transmitted. The safe state also means that the motor vehicle can continue to drive autonomously (either for a limited distance or with limited performance or speed).

[0009] The first and second sub-systems preferably each calculate the at least one trajectory and more preferably also the control commands, with the third and fourth sub-system are responsible only for the transmission to the actuators. As a result, they can then be configured very simply and robustly.

[0010] In one embodiment, the second and/or fourth sub-system may also be configured to be fail-silent, so that the relevant monitoring by the master can be omitted. Different realizations of fail-silent are possible. Different realizations can also be made in the sub-systems. Thus, for example, a watchdog circuit with a hardwired AND connection (aka shutoff path) can be used, with the watchdog also being able to be arranged in a sub-controller that monitors a main controller.

[0011] In some examples, the device may be configured such that in the event of a double fault that does not affect at least the third sub-system or the fourth sub-system, a control command for an emergency stop is generated by the third sub-system or the fourth sub-system.

[0012] In a further example, the device may be configured in such a way that, in fault-free operation, the control commands for the actuators are calculated and transmitted by the second or fourth sub-system. In this case, the second and fourth sub-systems can be designed with higher computing power compared to the first and third sub-systems. The first and third sub-systems can then be designed to be simpler in structure, so that their reliability and fail-safety are increased accordingly.

[0013] In a further example, the first sub-system may be additionally connected to the fourth sub-system and/or the second sub-system is connected to the third sub-system. In this way, on the one hand, data traffic can be accelerated in the event of a fault.

[0014] In a further example, the third sub-system and the fourth sub-system each include at least two separate sub-systems. The sub-systems are, for example, control units for a steering, braking, drive or transmission system.

[0015] With regard to the procedural design of the invention, reference is made in full to the contents of the present disclosure.

[0020] FIG. 1 shows a device 1 for generating control commands for an autonomously driving motor vehicle. The device 1 comprises a first sub-system CM (Commander Master), a second sub-system CS (Commander Slave), a third sub-system EM (Executor Master) and a fourth sub-system ES (Executor Slave). The first sub-system CM and the second sub-system CS are connected to one another via a data connection IC (Inter Commander). Likewise, the third sub-system EM and the fourth sub-system ES are connected to one another in terms of data technology via a data connection IE (Inter Executor Connection). Furthermore, the first sub-system CM and the third sub-system EM are connected to one another via a data connection CEM (Commander-Executor Connection Master). Finally, the second sub-system CS and the fourth sub-system ES are connected to one another via a data connection CES (Commander-Executor Connection Slave). All four sub-systems CM, CS, EM and ES are designed to be fail-silent.

[0021] The first sub-system CM and second sub-system CS receive surrounding data and vehicle status data and use them to calculate a respective trajectory. The two sub-systems CM, CS can receive the same data or they can receive the data from different sensor systems or data sources. The sensor systems or data sources can be on the vehicle and/or external. The first sub-system CM transmits its trajectory to the third sub-system EM via the data connection CEM and the second sub-system CS transmits its trajectory to the fourth sub-system ES. The third and fourth sub-systems EM, ES then each calculate control commands for the actuators. In fault-free operation, preferably only the control commands of the fourth sub-system ES are used to control the actuators. Alternatively, the first sub-system CM and the second sub-system CS can also calculate the control commands and then transmit the control commands to the third sub-system (EM) or fourth sub-system (ES), which then transmit the control commands to the actuators.

[0022] There are basically three types of control commands, namely control commands SB for fault-free operation, control commands SSS (System Safe State) to transfer the motor vehicle to a safe state in the event of a single fault, and control commands ESS (Executor Safe State) for an emergency stop, which are generated only by the third or fourth sub-system EM, ES. In fault-free normal operation, the data from the second and fourth sub-systems CS, ES are used to control the motor vehicle. In the event of a single fault, a control command SSS can always be initiated and implemented due to the structure, which is shown in the table below.

[0023]

					further response
					for ESS, if due to
	faulty	detected			double faults no
fault	component	by	response for SSS	control path	SSS is detected
—	—	—	—	CS-CES-ES	—
Failure	CM	CS, EM	CS initiates SSS	CS-CES-ES	EM initiates ESS
	CS	CM, ES	CM initiates SSS	CM-CEM-EM	EM initiates ESS
			EM switches on CEM
	EM	CM, ES	CM informs CS	CS-CES-ES	ES initiates ESS
			ES informs CS
			ES acts alone
			CS initiates SSS
	ES	CS, EM	CS informs CM	CS-IC-CM-	EM initiates ESS
			EM informs CM	CEM-EM
			EM switches on CEM
			CM/CS switches on
			CEM
			CS initiates SSS
	IC	CM, CS	CM initiates SSS	CM-CEM-EM	EM initiates ESS
			CS initiates SSS
			EM switches on CEM
	CEM	CM, EM	CM informs CS	CS-CES-ES	EM initiates ESS
			CS initiates SSS
	CES	CS, ES	CS informs CM	CS-IC-CM-	EM initiates ESS
			CM/CS switches on	CEM-EM
			CEM
			CS initiates SSS
			EM switches on CEM
	IE	EM, ES	EM informs CM	CS-IC-CM-	ES initiates ESS
			ES informs CS	CEM-EM
			CM/CS switches on
			CEM
			EM switches on CEM
			ES acts alone
			CS initiates SSS
	DC-Master	CS, ES	CS initiates SSS	CS-CES-ES	ES initiates ESS
	(power		ES acts alone
	supply)
	DC-Master	CM, EM	CM initiates SSS	CM-CEM-EM	EM initiates ESS
	(power		EM switches on CEM
	supply)
	CM and CS	EM, ES	double fault	EM initiates ESS
	CM and	EM, ES	double fault	EM initiates ESS
	CES
	EM and ES	double fault, not possible
faulty	CM	CM	CM switches on	CS-CES-ES	EM initiates ESS
operation			CS initiates SSS
	CS	CS	CS switches on	CM-CEM-EM	EM initiates ESS
		(algorithmic)	CM initiates SSS
			EM switches on CEM
	CS	CM	CM initiates SSS	CM-CEM-EM	EM initiates ESS
		(semantic)	EM switches on CEM
	EM	EM	EM switches on	CS-CES-ES	ES initiates ESS
			CM informs CS
			ES informs CS
			ES acts alone
			CS initiates SSS
	ES	ES	ES switches on	CS-IC-CM-	EM initiates ESS
			EM informs CM	CEM-EM
			EM switches on CEM
			CM/CS switches on
			CEM
			CS initiates SSS
	CM and CS	EM, ES	double fault	EM initiates ESS
	EM and ES	double fault, not possible

[0024] Based on the table, the functions of the individual sub-systems and their connections have become even clearer and can be summarized as follows:

• • [0025] First sub-system CM: checks the second sub-system CS and the third sub-system EM, transmits commands to the third sub-system EM and generates commands for control commands SSS if necessary;
  • [0026] Second sub-system CS: checks first sub-system CM and fourth sub-system ES, generates control commands for normal operation or control commands SSS, if necessary;
  • [0027] Third sub-system EM: checks first sub-system CM and fourth sub-system ES, decides which control path is used, executes control commands ESS if necessary;
  • [0028] Fourth sub-system ES: checks the third sub-system EM and second sub-system CS, transmits slave commands to the third sub-system and executes commands from the third sub-system, executes control commands from the second sub-system CS in normal operation and executes control commands ESS alone if the master EM is not present;
  • [0029] Connection IC: CM→CS: transmits the status of the first sub-system CM and the third sub-system EM to the second sub-system CS;
    • [0030] CS→CM: transmits the status of the second sub-system CS and the fourth sub-system ES to the first sub-system, transmits commands and status information on control commands SSS to the first sub-system;
  • [0031] Connection IE: EM→ES: transmits status from the third sub-system, decides on the execution of the control commands from the third or the fourth sub-system;
    • [0032] ES→EM: transmits status from fourth and second sub-system, status of control commands SSS from second sub-system, commands from second sub-system;
  • [0033] Connection CEM: CM→EM: status of the first sub-system, status of the control commands SSS, control commands;
    • [0034] EM→CM: status of the third and fourth sub-systems;
  • [0035] Connection CES: CS→ES: status of the second sub-system, status of the control commands SSS, control commands;
    • [0036] ES→CS: status of the third and fourth sub-systems;

[0037] FIG. 2 shows an alternative embodiment that has two additional data connections, namely a data connection CEMS between the first sub-system CM and the fourth sub-system ES and a data connection CESM between the second sub-system CS and the third sub-system EM. This enables a direct exchange of status signals and control commands between these sub-systems, which speeds up the process.

[0038] A further alternative embodiment of the device 1 is shown in FIG. 3. The third and fourth sub-systems each consist of separate sub-systems EM1-EM4 and ES1-ES4. For example, the two sub-systems EM1 and ES1 are used to control a steering actuator or steering system, the sub-systems EM2 and ES2 are used to control a brake actuator or brake system, etc. The data connection IE can also be divided into data connections IE1-IE4, as shown. The advantage is then that the device 1 can be expanded more easily.