DE102019128531A1 - Method for controlling an autonomously operated vehicle and error control module - Google Patents

Abstract

The invention relates to a method for controlling an autonomously operated vehicle (1) in the event of an error (Fm; m = 1,2, ... N0), with at least the following steps: Detection of an error (Fm) in the vehicle (1 - Assessment of the detected error (Fm) and, as a function thereof, outputting an error assessment result (EF), the error assessment result (EF) indicating a significance of the detected error (Fm); - Determination of a local environment (Uk; k = 1, 2, ..., N3), in which the vehicle (1) is located; - Selecting and activating an emergency operating mode depending on the determined local environment (Uk) as well as the output evaluation result (EF) and / or the importance of the detected error (Fm); and- autonomous control of the vehicle (1) as a function of the selected and activated emergency operating mode using at least one movement system (100; 101, 102, 103) and / or environment detection system (300; 301, 302, 303, 304, 305) in Vehicle (1).

Description

The invention relates to a method for controlling an autonomously operated vehicle in the event of an error and an error control module for carrying out the method.

When vehicles move autonomously in a certain local environment, reactions to errors that occur within the autonomous vehicle must be found in order not to endanger the own vehicle or the surrounding traffic. Errors can occur, for example, in movement systems and / or environment detection systems of the vehicle that are relevant for autonomous driving. The respective systems can output errors that occur via status signals, for example to a movement coordination module that coordinates the autonomous driving operation.

There are different environmental properties for the various local environments in which the autonomously operated vehicle moves, so that a specific reaction to an error does not make sense in the same way in every environment. For example, a truck that drives autonomously on a motorway in a public traffic area can react differently to an error than when the truck drives autonomously in a depot, i.e. on an enclosed area. While emergency braking in the event of a fault is very problematic on the autobahn due to the surrounding traffic, emergency braking is definitely possible on an enclosed area such as a depot, since overall driving is slower there and the traffic density is usually not that high. The local environment can also play a role in steering maneuvers. While the hard shoulder can be approached on the motorway, a defined location or the edge of the factory premises can be approached in a depot, port area or mine so as not to disrupt the operational process.

Such an environment-related reaction to a fault in an autonomously operated vehicle has not been taken into account so far. Rather, only the significance of a fault is normally taken into account and, depending on this, an emergency operating mode is activated in order to drive the vehicle autonomously in accordance with the severity of the fault.

Autonomous control of a vehicle in response to a recognized event is already known, for example from DE 10 2014 217 453 A1 , according to which it is provided that if the driver is identified as being unable to drive, the roadside is approached autonomously in order to wait for help. Also in DE 10 2016 218 382 A1 it is provided to steer the vehicle autonomously to an emergency destination if the driver is in an emergency situation. Also in EP 2 860 078 B1 a parking strategy is determined, which then starts when an inability to drive the motor vehicle on the part of the driver has been recognized. However, there is no provision for autonomous activation of a fault in the vehicle itself.

In DE 10 2015 102 108 A1 Provision is made for decelerating or stopping an autonomous vehicle as a function of a sensor failure, the error having previously been detected in an error detection module.

In DE 10 2015 223 429 A1 describes a monitoring system for an autonomous vehicle that can report malfunctions to external bodies. In the event of a malfunction, the hazard warning lights, the horn or the headlights can be activated automatically or the vehicle can be brought to a standstill.

In DE 10 2011 015 130 A1 Autonomous driving is only possible to a limited extent if the monitored driver cannot take over manual driving and sensors have failed or there is a malfunction. In this case, the vehicle is maneuvered into a preferred state, for example to the side of the road.

In DE 10 2011 115 854 A1 it is provided that in an emergency mode when a serious error is detected, autonomous driving is activated, the activated control system driving the vehicle autonomously to the next emergency stop.

The object of the invention is therefore to specify a method with which an autonomous driving operation can be ensured safely and efficiently in the event of a fault. The object of the invention is also to specify a fault control module and a vehicle.

This object is achieved by a method according to claim 1 and a fault control module and a vehicle according to the further independent claims.

• - Erkennen eines Fehlers im Fahrzeug, beispielsweise durch ein Fehlererkennungsmodul im Fahrzeug;
• - Bewerten des erkannten Fehlers, beispielsweise durch ein Fehlerbewertungsmodul im Fahrzeug, und in Abhängigkeit davon Ausgeben eines Fehler-Bewertungsergebnisses, wobei das Fehler-Bewertungsergebnis eine Bedeutsamkeit des erkannten Fehlers angibt;
• - Ermitteln einer lokalen Umgebung, in der sich das Fahrzeug befindet, beispielsweise durch Auswerten von Positions-Informationen und/oder Umgebungs-Informationen;

• - Auswählen und Aktivieren eines Notfall-Betriebsmodus in Abhängigkeit der ermittelten lokalen Umgebung sowie des ausgegebenen Bewertungs-Ergebnisses und/oder der Bedeutsamkeit des erkannten Fehlers, beispielsweise durch ein erfindungsgemäßes Fehler-Steuermodul im Fahrzeug; und
• - autonomes Steuern des Fahrzeuges in Abhängigkeit des ausgewählten und aktivierten Notfall-Betriebsmodus unter Verwendung mindestens eines Bewegungssystems und/oder Umgebungserfassungssystems im Fahrzeug.

According to the invention, a method for controlling an autonomously operated vehicle in the event of an error is provided, with at least the following steps:

• - Detection of an error in the vehicle, for example by an error detection module in the vehicle;
• - Evaluation of the detected fault, for example by a fault evaluation module in the vehicle, and depending on this, outputting a fault evaluation result, wherein the error evaluation result indicates a significance of the detected error;
• Determining a local environment in which the vehicle is located, for example by evaluating position information and / or environment information;

• - Selecting and activating an emergency operating mode as a function of the determined local environment as well as the output evaluation result and / or the significance of the detected error, for example by an error control module according to the invention in the vehicle; and
• - Autonomous control of the vehicle as a function of the selected and activated emergency operating mode using at least one movement system and / or environment detection system in the vehicle.

This method sequence advantageously makes it possible to autonomously control the vehicle as a function of the local environment if an error occurs, in particular an error which can at least to a certain extent have an effect on the own vehicle and / or on an environment around the own vehicle Taxes. This is particularly advantageous when autonomous vehicles are operated not only in a single local environment, but in different local environments. Depending on the local environment, the efficiency and the possibility of reacting to an error can turn out to be different, so that it is advantageous to select or activate different emergency operating modes depending on the environment.

The respective vehicle can, depending on whether the local environment is a motorway, a country road, an urban environment, a depot, a construction site or a port area, or in general an environment with a public traffic area or an environment with an enclosed area can be controlled autonomously in different ways in order to react to a recognized and assessed error in a meaningful and efficient manner.

It is preferably provided that the error is derived from status signals transmitted in the vehicle via a vehicle-internal data transmission system, for example a CAN bus, or directly. From these it is easy to infer the presence of an error, the errors also being available decentrally via the CAN bus at several points in the vehicle or being fed into the CAN bus. A fault can therefore be recognized and evaluated at a central position and then promptly and autonomously intervened.

It is preferably provided that the status signals from the movement system (s) of the vehicle and / or the environment detection system (s) and / or from other sources, for example a V2X module (V2X, vehicle-to-everything ), are output, the status signals indicating whether the respective movement system and / or environment detection system has an error. Via the V2X module, for example, a status signal can be output to the vehicle-internal data transmission system or directly to the error detection module, which relates to a vehicle-internal error detected from outside the vehicle. The status signal from the V2X module can therefore be used to report that one or more systems in the vehicle are defective. This is recognized by other road users or infrastructure facilities outside the vehicle and reported to the vehicle for further processing via the V2X module.

Accordingly, relevant systems in the vehicle that are necessary for smooth autonomous driving can be used for error detection and error assessment. These are designed to generate a corresponding status signal, from which it can be seen whether the respective system is working properly or has a defect and is therefore impaired in its function to a certain extent. This can then be evaluated below in order to select and activate a correspondingly appropriate emergency operating mode.

It can preferably also be provided that a fault in the vehicle is derived from a lack of or limited communication. This can be determined, for example, by the fact that status signals are no longer transmitted to or from the individual movement systems and / or environment detection systems via the vehicle-internal data transmission system for a certain period of time, although this is to be expected with functioning systems. In this way too, conclusions can be drawn about a fault in the vehicle from the status signals, which fault can be assessed and assessed.

Provision is also preferably made for at least one elementary, serious error or a moderately serious error or a non-safety-critical error to be recognized as an error. Accordingly, a subdivision into three basic categories of errors can be provided. Based on this, an emergency operating mode can then be used for the most important types of errors that occur the respective local environment can be selected. In principle, however, several error subdivisions can still be selected in order to enable a more finely graded selection of the emergency operating modes.

It is preferably also provided that the error evaluation result output is that there is an error with high significance or medium significance or low significance. Accordingly, depending on the cause of the error and the location of the error, an assessment can advantageously take place as to what effect or what significance a recognized error has for autonomous driving. Moderately serious errors in one of the vehicle's systems may have less influence on the autonomous driving mode than medium-serious errors in another system, which is why the importance of the autonomous driving mode can advantageously also be included in the selection of the emergency operating mode. A fault in one of the autonomously controllable movement systems (drive, brake, steering) or a data transmission or communication from or to these systems is preferably assigned a high level of significance, since it is assumed that these are frequently used for safe autonomous driving are relevant.

• - eines Fehlers mit hoher Bedeutsamkeit und/oder eines elementaren, schwerwiegenden Fehlers in Abhängigkeit der lokalen Umgebung ein erster Notfall-Betriebsmodus aktiviert wird, um das Fahrzeug unter Verwendung des mindestens einen Bewegungssystems und/oder Umgebungserfassungssystems im Fahrzeug vorzugsweise so schnell wie möglich autonom in einen Stillstand zu befördern, oder
• - eines Fehlers mit mittlerer Bedeutsamkeit und/oder eines mittelschweren Fehlers in Abhängigkeit der lokalen Umgebung ein zweiter Notfall-Betriebsmodus aktiviert wird, um das Fahrzeug autonom bis zu einem Haltebereich in der näheren Umgebung zu bewegen, oder
• - eines Fehlers mit geringer Bedeutsamkeit und/oder eines sicherheitsunkritischen Fehlers in Abhängigkeit der lokalen Umgebung ein dritter Notfall-Betriebsmodus aktiviert wird, um die autonome Fahrt des Fahrzeuges fortzusetzen.

It is also preferably provided that, if present

• - an error with high significance and / or an elementary, serious error depending on the local environment, a first emergency operating mode is activated in order to autonomously switch the vehicle into a vehicle using the at least one movement system and / or environment detection system in the vehicle, preferably as quickly as possible To convey a standstill, or
• - an error of medium significance and / or a medium-serious error depending on the local environment, a second emergency operating mode is activated in order to move the vehicle autonomously to a stopping area in the immediate vicinity, or
• a third emergency operating mode is activated in order to continue the autonomous driving of the vehicle in the event of an error of little significance and / or a non-safety-critical error depending on the local environment.

In this way, an emergency operating mode can be selected for the respective environment depending on the error or the significance of the error on the autonomous driving mode, with more than just three emergency operating modes being able to be provided here as well. The three operating modes mentioned relate only to the three most important types of errors or categories and can be further subdivided depending on the defined level of detail of the error or application.

It is preferably provided that in the first emergency operating mode at least one brake system and / or drive system is controlled autonomously in order to bring the vehicle to a standstill, and depending on the local environment, a steering system is further controlled autonomously in order to avoid a secure one Allow area, e.g. a hard shoulder, before the vehicle comes to a standstill. In addition, a drive system can also be activated in order to additionally decelerate the vehicle to a standstill, for example by braking the engine. This advantageously means that in the event of a serious error or an error of great importance, depending on the local environment, it is possible to react differently. For example, on a freeway or in a public traffic area, autonomous steering onto a hard shoulder or hard shoulder, while only emergency braking is carried out on an enclosed area. Thus, depending on the local environment, the most sensible and at the same time most efficient way for an autonomous control can be selected, which is also relevant for the respective detected error. In addition, failure of individual movement systems can be reacted to in this way. For example, in the event of a failure or a communication disruption to the steering system, the brake system can brake the steering or, in the event of a failure or a communication disruption to the brake system, the drive system can brake the motor in order to still be able to come to a standstill.

Preferably, it can also be provided that in the second emergency operating mode a drive system and / or a braking system and / or a steering system of the vehicle are controlled autonomously in such a way that the vehicle can autonomously drive along a specified driving path at reduced speed and / or with reduced engine power. Moved trajectory to the holding area. Accordingly, depending on the situation, an autonomous control of the movement systems can be provided in order to reach the stopping area, the neck area and / or the reduced speed and / or the motor power being preferably selected as a function of the local environment. Accordingly, a stopping area on a freeway can be a rest stop that is to be approached at a different reduced speed along the defined travel trajectory than a stopping area in a depot, for example on the edge of the site or in a geofence area, whereby due to the another level of danger reduced to another Speed can be selected for a specified travel trajectory.

It is also preferably provided that the first emergency operating mode is fixed and unchangeable, ie its control behavior cannot be changed, and / or the second emergency operating mode can be expanded and / or the third emergency operating mode and / or further emergency operating modes can be changed and / or expanded can be. This ensures that legally prescribed or safety-relevant emergency operating modes cannot be changed by the vehicle operator, etc. for any reason and safe operation can be guaranteed in such error cases. The further emergency operating modes (greater than three), for example, cannot “overwrite” the first and possibly also the second emergency operating modes, so that at least the safety-relevant emergency operating modes take place at least according to the fixed specifications.

It is preferably also provided that the local environment is determined as a function of position information and / or environment information, the position information based on automatically provided position data and / or on manually entered position data and the environment information Environment data that are output, for example, by the or the environment detection system (s) is based. Accordingly, different possibilities are provided, for example how the fault control module obtains the position information or environment information in order to select an emergency operating mode based thereon, i.e. based on the local environment. In this way, depending on the systems present in the vehicle, a decision can be made as to how the position information or the environment information that characterizes the local environment is provided.

It is preferably provided that the automatically provided position data are output by a position detection device and contain a global position of the vehicle and / or are output by a telematics system, the telematics system responding to external information that is transmitted via a local data interface, falls back. In this way, the information about the position can be provided, for example, by satellite navigation, e.g. GPS, from which, for example, map data can be used to infer the local environment. Depending on the movement environment, a telematics system can also automatically output where the vehicle is, for example in a local network of a depot. This position information can also be linked or checked for plausibility with the environment information.

It is preferably provided that the vehicle is controlled autonomously and / or driverless according to an autonomy level equal to three or more, i.e. there is no provision for a driver to intervene in the driving operation. This means that no driver assistance or an autonomy level one or two is provided in which the driver takes over the main driving operations and the system only intervenes temporarily or automatically depending on the situation.

It is preferably also provided that the error and / or the error evaluation result is output after the detection and evaluation of the error via a communication module and / or via the V2X module, for example to a vehicle operator, a dispatcher, to the staff of a depot and / or to other people, or to other autonomous or non-autonomously operated vehicles in the area. Accordingly, in addition to the autonomous control, a warning can also be issued to external persons or vehicles if, for example, the vehicle is driving without any occupants.

• - einen Notfall-Betriebsmodus in Abhängigkeit einer aus Positions-Informationen und/oder Umgebungs-Informationen ermittelten lokalen Umgebung, in der sich das Fahrzeug befindet, sowie eines von einem Fehlerbewertungsmodul ausgegebenen Bewertungs-Ergebnisses und/oder einer Bedeutsamkeit eines von einem Fehler-Erkennungsmodul erkannten Fehlers auszuwählen und zu aktivieren, und
• - das Fahrzeug autonom in Abhängigkeit des ausgewählten und aktivierten Notfall-Betriebsmodus unter Verwendung mindestens eines Bewegungssystems und/oder Umgebungserfassungssystems im Fahrzeug zu steuern.

According to the invention, an error control module is also provided for the autonomous control of a vehicle in the event of an error, in particular according to the method according to the invention, the error control module being designed

• an emergency operating mode as a function of a local environment in which the vehicle is located, determined from position information and / or environment information, as well as an evaluation result output by an error evaluation module and / or a significance of one recognized by an error detection module Select and activate error, and
• - to control the vehicle autonomously as a function of the selected and activated emergency operating mode using at least one movement system and / or environment detection system in the vehicle.

According to the invention, a vehicle is also provided, with a movement coordination module for coordinating and controlling movement systems and / or environment detection systems in the vehicle for autonomous control of the vehicle, an error detection module for detecting an error in the vehicle, an error evaluation module for evaluating the detected error and for outputting a Evaluation result and with an error control module according to the invention for autonomous control of the vehicle, in particular via the movement coordination module, in the event of an error, in particular according to the method according to the invention.

• 1 eine schematische Ansicht eines autonom betriebenen Fahrzeuges in einer lokalen Umgebung mit einem öffentlichen Verkehrsraum;
• 2 eine schematische Ansicht eines autonom betriebenen Fahrzeuges in einer lokalen Umgebung mit einem abgeschlossenen Gelände; und
• 3 ein Flussdiagramm des erfindungsgemäßen Verfahrens.

The invention is explained in more detail below using an exemplary embodiment. Show it:

• 1 a schematic view of an autonomously operated vehicle in a local environment with a public traffic area;
• 2 a schematic view of an autonomously operated vehicle in a local environment with an enclosed area; and
• 3 a flow chart of the method according to the invention.

In 1 and 2 is one vehicle at a time 1 , in particular a commercial vehicle, shown, which is in a public traffic area Ö ( 1 ) or in an enclosed area G ( 2 ) is located and is in an autonomous driving mode AF emotional. Under an autonomous driving mode AF is to be understood that motion systems 100 of the vehicle 1 , for example a braking system 101 , a drive system 102 and a steering system 103 , fully automated without any human intervention to control the vehicle 1 even in normal driving over a longer period of time autonomously along a given driving trajectory T to move. In autonomous driving AF is therefore a driverless operation of the vehicle 1 provided, for example with an autonomy level AS > = 3. Under autonomous driving AF is therefore not a situational or temporary automated intervention within the framework of a driver assistance system (autonomy level AS 1 ) or partial automation (autonomy level AS 2 ) meant.

About autonomous driving AF to enable is in the vehicle 1 a central movement coordination module 10 provided that the different movement systems 100 coordinated. The central movement coordination module 10 for example motion control units 100a , 101a , 102a , 103a the respective movement systems 100 , 101 , 102 , 103 control and monitor to the vehicle 1 safely on the given driving trajectory T respectively. In addition, the movement coordination module 10 on environmental detection systems 300 , for example cameras 301 , Infrared sensors 302 , Ultrasonic sensors 303 , Laser sensors 304 (LIDAR), radar sensors 305 , etc. in the vehicle 1 resorted to to coordinate the movement.

As part of the movement coordination module 10 is an error detection module 20th provided that is designed to have a bug Fm , with m = 1, 2, 3, ..., N0, in the vehicle 1 to recognize. As a mistake Fm there are any mistakes Fm on your own vehicle 1 in question, the driving of your own vehicle 1 as well as surrounding vehicles 2 can affect. These are errors in particular Fm in the motion systems 100 , 101 , 102 , 103 and / or the environment detection systems 300 , 301 , 302 , 303 , 304 , 305 of the vehicle 1 . The error detection module 20th is to do this with the motion control units 100a , 101a , 102a , 103a of the respective movement system 100 , 101 , 102 , 103 as well as environmental sensing control units 300a , 301a , 302a , 303a , 304a , 305a of the respective environment detection system 300 , 301 , 302 , 303 , 304 , 305 directly or indirectly connected, for example via an in-vehicle data transmission system 30th , for example a CAN bus 31 .

Via the vehicle's internal data transmission system 30th can the respective control unit 100a , 101a , 102a , 103a , 300a , 301a , 302a , 303a , 304a , 305a automates a status signal So , with o = 1, 2, 3, ..., N4 (N4 = number of sources that send a status signal So can output) output. The respective status signal So contains the information whether the respective movement system 100 , 101 , 102 , 103 or environment detection system 300 , 301 , 302 , 303 , 304 , 305 an error Fm and is therefore impaired in its function to a certain extent. The mistake Fm can for example be in the form of an error code C. via the respective status signal So transmitted and from the error detection module 20th be included. The error detection module 20th can then depending on the error code C. initiate appropriate measures.

Further status signals So who have favourited more relevant errors Fm in your own vehicle 1 can be from other sources in the vehicle 1 to the error detection module 20th be transmitted. The other sources can, for example, V2X modules 3 (V2X, vehicle-to-everything) in the own vehicle 1 be with that of your own vehicle 1 with other vehicles 2 or surrounding infrastructure facilities 200 via a short-range data connection 4th , e.g. WLAN 4a , DSRC (Dedicated Short Range Communication) 4b. This can also be used to provide information about errors Fm of your own vehicle 1 received and via the respective status signal So to the error detection module 20th be transmitted. For example, from outside of another vehicle 2 or an infrastructure facility 200 It can be recognized via a camera or similar that a tire of the own vehicle 1 burst or the exhaust of your own vehicle 1 smokes a lot. This can be done via the short-range data connection 4th are reported, whereupon the V2X module 3 in its own vehicle 1 a status signal So regarding this error information to the error detection module 20th is issued.

Furthermore, a plausibility check or check can also be carried out via the vehicle-internal data transmission system 30th , 31 sent data are carried out to indicate a (partial) failure or a Defect in the vehicle's internal data transmission system 30th , 31 or in the individual systems connected to it. For example, it can be checked whether the individual movement systems 100 ; 101 , 102 , 103 Status signals So as expected via the vehicle's internal data transmission system 30th , 31 transmit, this conventionally taking place permanently within fixed intervals of, for example, 10 ms. Will these signals So not sent within the specified interval, it is a time-out, ie it is sent too late or not at all. The error detection module 20th can recognize this.

In an error assessment module 40 , which is part of the error detection module 20th can be, but also elsewhere in the vehicle 1 can be arranged and for example via the vehicle's internal data transmission system 30th or directly with the error detection module 20th is communicated to the error detection module 20th present error Fm rated, for example classified. The error assessment module 40 then gives an error evaluation result EF for further processing. The failure assessment result EF gives a meaning, for example Bi , with i = 1, 2, ... N1, of the detected error and thus the severity of the error, which results from the respective status signal So or the error code C. results.

The importance Bi is doing in a number N1 divided or classified at levels, with the number N1 can be set variably. Is based on the status signals So for example an elementary or fatal error F1 is recognized as an error evaluation result EF issued that an error Fm with very high significance B1 is present. An elementary mistake F1 can be present, for example, when individual environment detection systems 300 , 301 , 302 , 303 , 304 , 305 and / or individual motion systems 100 , 101 , 102 , 103 including which actuators and control units have completely failed or these systems via the status signals So Recognize a time-out or individual systems no longer via the vehicle-internal data transmission 30th , 31 can be achieved and therefore no longer function in such a way that safe, autonomous driving of the vehicle 1 via the movement coordination module 10 can be guaranteed.

Is based on the status signals So a moderate mistake F2 is recognized as an error evaluation result EF issued that an error Fm of medium importance B2 is present, with a moderate error F2 for example, when individual motion systems 100 , 101 , 102 , 103 and / or environment detection systems 300 , 301 , 302 , 303 , 304 , 305 although their functionality is impaired, however, a safe, autonomous driving operation of the vehicle 1 via the movement coordination module 10 , possibly at a reduced speed vred and reduced engine power ML , is still guaranteed. For example, there can be a moderate fault in the transmission of the drive system 102 or excessive wear on one of the brakes 101b the braking system 101 , e.g. due to incorrect resetting or jamming of the brakes 101b , or a leak in the braking system 101 or a functional impairment of the transmission actuator of the drive system 10 , whereby the switching function is impaired, or an excessively high pressure difference in the tires and thus possibly a burst tire as a moderately serious error F2 be recognized.

Is based on the status signals So a non-security-critical error F3 is recognized as an error evaluation result EF issued that an error Fm with little significance B3 is present, with a non-safety-critical error F3 for example, when a brake light of the brake system 101 has failed or there is a fault in the vehicle's ventilation, air conditioning, radio (if these systems are still available in autonomous vehicles) or an exhaust gas control lamp lights up, e.g. because the particle filter has to be burned free or a slight deviation in the tire pressure, e.g. 0.1 - 0.3 bar from the setpoint is present. At the time they are detected, these errors have no direct safety-critical influence on the autonomous driving operation.

For the mistakes Fm or the failure evaluation results EF can based on the status signals So also other categories or other meanings Bi be determined.

After evaluating the bugs Fm can these and / or the error assessment results based on them EF via a communication module 50 and / or the V2X module 3 can be output, for example to the vehicle operator K1 , the dispatcher K2 , the court staff K3 a depot U4 and / or other persons K4 and / or to other vehicles 2 and / or the infrastructure facilities 200 .

After according to 3 from the error detection module 20th in a first step ST1 a mistake Fm recognized this in a second step ST2 from the fault assessment module 40 evaluated and in a third step ST3 an error evaluation result EF is issued in a fifth step ST5 in a fault control module 60 an emergency mode of operation NBnk ; with n = 1, 2, 3, ..., N2 and k = 1, 2, 3, ..., N3, depending on one in a fourth step ST4 determined position information PI and / or environmental information UI selected and activated. The error control module 60 can here via the CAN bus 31 or the vehicle's internal data transmission system 30th or directly with the error evaluation module 40 be connected. The error assessment module 40 can also be part of the fault control module 60 or vice versa (not shown). The position information PI and / or the environment information UI indicate or characterize in which local environment Uk , with k = 1, 2, 3, ..., N3, own vehicle 1 currently located. Depending on this, the emergency operating mode is subsequently used NBnk set how the vehicle 1 depending on the importance Bi of a recognized error (error evaluation result EF ) in a sixth step ST6 should be controlled autonomously.

The position information PI can be based on automatically provided or manually entered position data DPa , DPm based. Position data provided automatically DPa for example, an automatically determined global position Pg of your own vehicle 1 be that via a position detection device 70 is determined automatically. The global position Pg can be determined for this, for example, by a GPS or by a GNSS (Global Navigation (al) Satellite System). Depending on the global position Pg can then be determined in which local environment Uk your own vehicle 1 is located, for example based on map data KD a navigation system 7th , for example via the CAN bus 31 or the vehicle's internal data transmission system 30th be available.

This can be based on the automatically provided data DPa (global position Pg ) as position information PI be determined whether the own vehicle 1 on a freeway U1 , on a country road U2 , in a city setting U3 , at a depot U4 , on a construction site U5 , on a port area U6 , etc. is located. Thus, according to this embodiment, there are a number N3 of six different distinctions for the local environment Uk possible to use as position information PI serve. However, further subdivisions are also possible depending on the application.

Position data provided automatically DPa but can also from a telematics system 400 in the vehicle 1 , for example a fleet management system 401 , come. This can, for example, automatically output a whereabouts, so that based thereon again as position information PI it can be determined in which local environment Uk your own vehicle 1 is located. This can be supplemented by external information IX can be accessed by the vehicle 1 via a local data interface 8th are preferably transmitted wirelessly, for example from a local network 9 a depot U4 , a construction site U5 or a port area U6 in which the vehicle is located 1 dialed in beforehand.

The position information PI but can also be based on manually entered position data DPm based, for example, from an occupant of the vehicle 1 can be entered. This can, for example, directly enter in which local environment Uk the vehicle 1 is currently located. This is then called position information PI reused.

The environment information UI can be automated from environmental data YOU obtained from the environment detection systems 300 ; 301 , 302 , 303 , 304 , 305 output, whereby these can also be combined with one another. For example, using the camera 301 alone or in combination with the other sensors 302 , 303 , 304 , 305 be determined as the local environment Uk is constituted, for example a number of lanes, the presence of a hard shoulder, speed limits or traffic signs (motorway signs, town entrance signs, etc.). From this it can also be deduced in which local environment Uk the vehicle 1 and how to react depending on it. The environment information UI can also use the position information PI linked or checked for plausibility.

Depending on the position information given accordingly PI and / or environmental information UI is subsequently in the fault control module 60 an emergency mode of operation NBnk activated. In addition to the position information PI and / or environmental information UI becomes the error evaluation result EF or the importance Bi one in advance in the error detection module 20th recognized and in the error assessment module 40 assessed error Fm considered. Depending on the local environment Uk who have made the index k of the emergency operating mode NBnk depends on the detected error Fm a number N2 different emergency operating modes NBnk , with n = 1, 2, 3 ..., N2, possible, where the type of error is the index n specifies.

It is preferred for any local environment Uk , ie for each index k , at least a minimum number N2min = 3 (for N2) of emergency operating modes NB1k, NB2k, NB3k for the major failure cases that occur in all local environments Uk are relevant. In addition, depending on the local environment Uk further emergency operating modes NBnk , ie with n> 3, can be set variably. However, it is provided that these additional emergency operating modes NBnk with n> 3, the emergency operating modes NBnk for n <= 3 do not overwrite or override.

For example, the error control module 60 for any local environment Uk obtained from the position information PI follows, activate a first emergency operating mode NB1k if the error evaluation result FE indicates that an error Fm with very high significance B1 is present, ie an elementary or serious error F1 is present.

In the first emergency operating mode NB1k, the error control module 60 the motion systems 100 , 101 , 102 , 103 directly or via the movement coordination module 10 accordingly, your own vehicle 1 to a standstill as quickly as possible H to be promoted, as an elementary, serious mistake F1 is present. The exact implementation, ie like your own vehicle 1 to a standstill H is promoted, then depends on the respective local environment Uk or the following index k . This is justified by the fact that in the event of such a serious error F1 in different local environments Uk different measures depending on the surrounding environment are useful to bring the standstill H as soon as possible.

On the highway U1 as well as the country road U2 and in the urban environment U3 are for example in addition to the corresponding control of the brake system 101 to brake the vehicle 1 in addition, switching to a secured area BS , e.g. a hard shoulder BS1 , necessary to the following traffic in the public traffic area Ö not to endanger. Accordingly, in this first emergency operating mode, NB11, NB12, NB13, there is also an autonomous control of the steering system 103 of your own vehicle 1 intended.

On the site U5 , the depot U4 or the port area U6 there is a different risk level for the surrounding area, as this is a closed area G are that are not open to the public Ö like the other local environments U1 , U2 , U3 exhibit. Accordingly, it is possible to use your own vehicle 1 in the case of elementary or serious errors F1 to bring it to a halt immediately, ie by emergency braking, in order, for example, to prevent engine damage or to avoid or reduce the risk to the environment from failed or impaired systems. The danger from the stationary vehicle 1 is in these operational areas or environments U4 , U5 , U6 without a public traffic area Ö low, so that a control of the braking system 101 in the first emergency operating modes NB14, NB15, NB16 in these local environments U4 , U5 , U6 is sufficient.

If there are individual movement systems 100 ; 101 , 102 , 103 have failed, they can also be replaced by others in the first emergency operating modes NB1k, for example the steering system 103 by performing steering braking with the braking system 101 or if the braking system fails 101 by braking the engine via the drive system 102 .

• In dem zweiten Notfall-Betriebsmodus NB2k wird die autonome Fahrt des Fahrzeuges 1 bis zum nächstmöglichen Haltebereich HB mit reduzierter Geschwindigkeit vred, die wiederum abhängig von der lokalen Umgebung Uk sein kann, erlaubt. Ähnlich wie in aktuell verwendeten Motorschutzschaltungen kann eine Motorleistung ML in diesem Fall zusätzlich auf bspw. 30% gedrosselt werden, um keinen Motorschaden zu provozieren und/oder um die Geschwindigkeit des Fahrzeuges 1 durch Motorbremsung zu reduzieren und damit die Gefahr, welche von dem Fahrzeug 1 ausgeht, zu reduzieren, wobei dies durch eine autonome Ansteuerung des Antriebssystems 102 geschieht.

Will the fault control module 60 a moderate mistake F2 transmitted, ie it is transmitted by the error evaluation module 40 as an error evaluation result EF issued that an error Fm of medium importance B2 is present, a second emergency operating mode NB2k is activated, which also depends on the local environment Uk to different controls of the vehicle 1 leads:

• In the second emergency operating mode NB2k, the vehicle is driven autonomously 1 to the next possible stop HB at reduced speed vred which in turn depends on the local environment Uk can be allowed. Similar to the currently used motor protection circuits, a motor power ML In this case, it can also be throttled to, for example, 30% in order not to provoke engine damage and / or to reduce the speed of the vehicle 1 by engine braking and thus reduce the risk posed by the vehicle 1 goes out to reduce, this by an autonomous control of the drive system 102 happens.

In this way it can be ensured that the autonomously operated vehicle 1 not just in a secure area BS , e.g. the hard shoulder BS1 the highway U1 or in the middle of the country road U2 must stop, but to the next normally accessible stopping area HB , for example the next rest stop HB1 /Departure HB2 / Holding bay HB3 , can continue. At construction sites U5 , Depots U4 and port areas U6 can this next possible stopping area HB a factory site edge HB4 , an access-free building wall HB5 , ie without a door or gate, or a defined geofencing area HB6 or a workshop area HB7 be in that the vehicle in question 1 in the event of such an error, it is automatically shunted to the operational process for other vehicles 2 not to bother.

Accordingly, in this second emergency operating mode, NB2k, there is both an autonomous control of the braking system 101 , the drive system 102 as well as an autonomous control of the steering system 103 of your own vehicle 1 intended. The travel trajectory determined autonomously by the second emergency operating mode NB2k T differs depending on the local environment Uk as described above to move to the next possible stopping area HB to get.

• In dem dritten Notfall-Betriebsmodus NB3k wird die autonome Fahrt des Fahrzeuges 1 normal fortgesetzt, wobei das Fahrzeug 1 nicht unmittelbar aus dem Verkehr zu ziehen ist. Der Fehler kann bei der nächstmöglichen Gelegenheit behoben werden. Über das Kommunikationsmodul 50 kann ergänzend an den Fahrzeugbetreiber K1 und/oder den Disponenten K2 eine Meldung ausgegeben werden. Dieser dritte Notfall-Betriebsmodus NB3k kann übergreifend für jede lokale Umgebung Uk vorgesehen sein.

Will the fault control module 60 a non-security-critical error F3 transmitted, ie it is transmitted by the error evaluation module 40 as an error evaluation result EF issued that an error Fm with little significance B3 is present, a third emergency operating mode NB3k is activated:

• In the third emergency operating mode NB3k, the vehicle is driven autonomously 1 continued normally with the vehicle 1 is not to be withdrawn from circulation immediately. The error can be corrected at the earliest opportunity. Via the communication module 50 can also be sent to the vehicle operator K1 and / or the dispatcher K2 a message will be issued. This third emergency operating mode NB3k can cover each local environment Uk be provided.

In addition to these three essential emergency operating modes NB1k, NB2k, NB3k mentioned, the vehicle operator K1 own emergency operating modes NBnk with n> 3 for the respective local environment Uk defined or the existing emergency operating modes NBnk at least partially supplemented or changed. It should be noted, however, that the first emergency operating mode NB1k is for an elementary, serious error F1 in any local area Uk , ie for no index k , can be changed, supplemented or overwritten. In addition, all other essential emergency operating modes are included NBnk , ie for the index n = 2, 3, in public traffic areas Ö , ie for the index k = 1, 2, 3 and possibly other local environments Uk with a public transport area Ö , not changeable but at least expandable. The reason for this is that not every person should be allowed unlimited access or parameterization of security-relevant systems. The manufacturer must therefore ensure that there are safety-relevant areas, especially in public traffic areas Ö , there that cannot be changed. A change or addition is therefore only possible if, for example, the situation and the reaction options of the road users can be assessed in a delimited area, for example at a depot. For emergency operating modes NBnk with n> 3 are the vehicle operators K1 therefore free in the configuration of the necessary sequences of action when an error is detected Fm .

For the second emergency operating mode NB2k, for example, the instruction can be added as to which next possible stopping area HB depending on the local environment Uk should be approached, this can possibly also taking into account the severity or the importance Bi of the error Fm happen when, for example, further subdivisions of importance Bi be made.

List of reference symbols

1

vehicle

2

different vehicle

3

V2X module

4th

short-range data connection

4a

WIRELESS INTERNET ACCESS

4b

DSRC

7th

navigation system

8th

local data interface

9

local network

10

Movement coordination module

20th

Error detection module

30th

in-vehicle data transmission system

31

CAN bus

40

Fault assessment module

50

Communication module

60

Error control module

70

Position detection device

100

Motion system

100a

Control unit of the motion system 100

101

Braking system

101a

Brake system control unit 101

101b

Braking the braking system

102

Drive system

102a

Control unit of the drive system 102

103

Steering system

103a

Steering system control unit 103

300

Environment detection system

300a

Control unit of the environment detection system 300

301

camera

301a

Control unit of the camera 301

302

Infrared sensor

302a

Control unit of the infrared sensor 302

303

Ultrasonic sensor

303a

Control unit of the ultrasonic sensor 303

304

Laser sensor

304a

Control unit of the laser sensor 304

305

Radar sensor

305a

Radar sensor control unit 305

200

Infrastructure facility

400

Telematics system

401

Fleet management system

AF

autonomous driving

AS

Level of autonomy

Bi

significance

B1

high importance

B2

medium importance

B3

little importance

BS

secured area

BS1

Hard shoulder

C.

Error code

DPa

position data provided automatically

DPm

manually entered position data

YOU

Environment data

EF

Failure evaluation result

Fm

error

F1

elementary, fatal error

F2

moderate mistake

F3

non-safety-critical error

G

closed area

H

Standstill

HB

Holding area

HB1

Rest stop

HB2

Departure

HB3

Holding bay

HB4

Factory site edge

HB5

access-free building wall

HB6

Geofencing area

HB7

Workshop area

IX

external information

K1

Vehicle operator

K2

Dispatcher

K3

Court staff

K4

other people

KD

Card data

ML

Engine power

N0

Number of errors Fm

N1

Number of meanings Bi

N2

Number of emergency operating modes NBnk depending on the local environment Uk

N2min

Minimum number of emergency operating modes NBnk depending on the local environment Uk

N3

Number of local environments Uk

N4

Number of status signals So

NBnk

Emergency operating mode n , k

Ö

Public traffic space

PI

Position information

Pg

global position of your own vehicle 1

So

Status signal

T

Driving trajectory

Uk

local environment

UI

Environment information

U1

Highway

U2

Country road

U3

Urban environment

U4

Depot

U5

construction site

U6

Port area

vred

reduced speed

i, k, m, n, o

index

ST1, ST2, ST3, ST4, ST5, ST6

Steps of the process

QUOTES INCLUDED IN THE DESCRIPTION

This list of the documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• DE 102014217453 A1 [0005]
• DE 102016218382 A1 [0005]
• EP 2860078 B1 [0005]
• DE 102015102108 A1 [0006]
• DE 102015223429 A1 [0007]
• DE 102011015130 A1 [0008]
• DE 102011115854 A1 [0009]

Claims (19)

Method for controlling an autonomously operated vehicle (1) in the event of an error (Fm; m = 1,2, ... N0), with at least the following steps: - Detection of a fault (Fm) in the vehicle (1) (ST1); - Assessment of the detected fault (Fm) (ST2) and, as a function thereof, outputting a fault evaluation result (EF) (ST3), the fault evaluation result (EF) having a significance (Bi; i = 1,2 ... N1) of the detected fault (Fm); - Determination of a local environment (Uk; k = 1,2, ..., N3) in which the vehicle (1) is located (ST4); - Selecting and activating an emergency operating mode (NBnk; n = 1,2, ..., N2) as a function of the determined local environment (Uk) and the output evaluation result (EF) and / or the significance (Bi) of the detected error (Fm) (ST5); and - Autonomous control of the vehicle (1) as a function of the selected and activated emergency operating mode (NBnk) using at least one movement system (100; 101, 102, 103) and / or environment detection system (300; 301, 302, 303, 304, 305 ) in the vehicle (1) (ST6). Procedure according to Claim 1 , characterized in that the error (Fm) from in the vehicle (1) via a vehicle-internal data transmission system (30), for example a CAN bus (31), or from directly transmitted status signals (So, o = 1, 2 ,. .., N4) is derived. Procedure according to Claim 2 , characterized in that the status signals (So) from the at least one movement system (100; 101, 102, 103) of the vehicle (1) and / or the environment detection system (300; 301, 302, 303, 304, 305) of the vehicle (1) and / or from further sources (3) of the vehicle (1), for example a V2X module (3), the status signals (So) indicating whether the respective movement system (100; 101, 102 , 103) and / or environment detection system (300; 301, 302, 303, 304, 305) has an error (Fm). Method according to one of the preceding claims, characterized in that at least - an elementary, serious error (F1) or - a moderate error (F2) or - a non-safety-critical error (F3) are recognized as the error (Fm). Method according to one of the preceding claims, characterized in that the error evaluation result (EF) output is at least that there is an error (Fm) of high importance (B1) or medium importance (B2) or low importance (B3). Procedure according to Claim 4 or 5 , characterized in that if there is an error (Fm) of high significance (B1) and / or an elementary, serious error (F1) depending on the local environment (Uk), a first emergency operating mode (NB1k) is activated in order to the vehicle (1) using the at least one movement system (100; 101, 102, 103) and / or environment detection system (300; 301, 302, 303, 304, 305) in the vehicle (1) autonomously to a standstill (H) convey, or - an error (Fm) with medium significance (B2) and / or a medium-serious error (F2) depending on the local environment, a second emergency operating mode (NB2k) is activated to the vehicle (1) using the at least to move a movement system (100; 101, 102, 103) and / or environment detection system (300; 301, 302, 303, 304, 305) in the vehicle (1) autonomously up to a stopping area (HB), or an error (Fm ) with little significance (B3) and / or a non-safety-critical error lers (F3), depending on the local environment (Uk), a third emergency operating mode (NB3k) is activated in order to allow the vehicle (1) to travel autonomously using the at least one movement system (100; 101, 102, 103) and / or environment detection system (300; 301, 302, 303, 304, 305) in the vehicle (1). Procedure according to Claim 6 , characterized in that in the first emergency operating mode (NB1k) at least one brake system (101) and / or a drive system (103) for reducing the engine power (ML) is controlled autonomously in order to bring the vehicle (1) to a standstill (H) and, depending on the local environment (Uk), a steering system (103) continues to be controlled autonomously in order to enable an evasion to a secured area (BS), e.g. a hard shoulder (BS1), before the standstill (H) is reached . Procedure according to Claim 6 or 7th , characterized in that in the second emergency operating mode (NB2k) a drive system (102) and / or a braking system (101) and / or a steering system (103) of the vehicle (1) are controlled autonomously in such a way that the vehicle (1 ) moves at reduced speed (vred) and / or with reduced engine power (ML) autonomously along a defined driving trajectory (T) to the stopping area (HB). Procedure according to Claim 8 , characterized in that the neck region (HB) and / or the reduced speed (vred) and / or the Motor power (ML) is selected depending on the local environment (Uk). Method according to one of the Claims 6 to 9 , characterized in that the first emergency operating mode (NB1k) is fixed and unchangeable and / or the second emergency operating mode (NB2k) can be expanded and / or the third and / or further emergency operating modes (NBnk, for n> = 3) can be changed and / or expanded. Method according to one of the preceding claims, characterized in that a motorway (U1), a country road (U2), an urban environment (U3), a depot (U4), a construction site (U5) or a port area ( U6) can be determined. Method according to one of the preceding claims, characterized in that an environment with a public traffic area (Ö) or an environment with an enclosed area (G) is determined as the local environment (Uk). Method according to one of the preceding claims, characterized in that the local environment (Uk) is determined as a function of position information (PI) and / or environment information (UI), the position information (PI) being based on automatically provided positions -Data (DPa) and / or on manually entered position data (DPm) and the environment information (UI) is based on provided environment data (DU), for example from environment detection systems (300; 301, 302, 303, 304 , 305) are issued in the vehicle (1). Procedure according to Claim 13 , characterized in that the automatically provided position data (DPa) are output by a position detection device (70) and contain a global position (Pg) of the vehicle (1) and / or are output by a telematics system (400), wherein the telematics system (400) accesses external information (IX) which is transmitted via a local data interface (8). Procedure according to Claim 13 or 14th , characterized in that the local environment (Uk) is extracted from the automatically provided position data (DPa) via map data (KD), in particular a navigation system (7). Method according to one of the preceding claims, characterized in that the autonomously and / or driverlessly controlled vehicle (1) is controlled according to an autonomy level (AS) equal to three or more. Method according to one of the preceding claims, characterized in that the error (Fm) and / or the error evaluation result (EF) after the detection (ST1) and evaluation (ST2, ST3) of the error (Fm) via a communication module (50 ) and / or a V2X module (3) is output, for example to a vehicle operator (K1), a dispatcher (K2), to yard staff (K3) of a depot (U4) and / or to other people (K4) and / or to another vehicle (2) and / or to infrastructure facilities (200). Error control module (60) for the autonomous control of a vehicle (1) in the event of an error (Fm), in particular according to a method according to one of the preceding claims, wherein the error control module (60) is designed - An emergency operating mode (NBnk; n = 1,2 .. N2) as a function of a local environment (Uk) determined from position information (PI) and / or environment information (UI), in which the vehicle (1 ) and to select and activate an evaluation result (EF) output by an error evaluation module (40) and / or a significance (Bi) of an error (Fm) recognized by an error detection module (20), and - The vehicle (1) autonomously depending on the selected and activated emergency operating mode (NBnk) using at least one movement system (100; 101, 102, 103) and / or environment detection system (300; 301, 302, 303, 304, 305) to control in the vehicle (1). Vehicle (1) with a movement coordination module (10) for coordinating and controlling movement systems (100; 101, 102, 103) and / or surrounding systems (300; 301, 302, 303, 304, 305) in the vehicle (1) for autonomous control of the vehicle (1), an error detection module (20) for detecting an error (Fm) in the vehicle (1), an error evaluation module (40) for evaluating the detected error (Fm) and for outputting an evaluation result (EF) and with a Error control module (60) Claim 18 for autonomous control of the vehicle (1), in particular via the movement coordination module (10), in the event of an error (Fm).

Images