DE102016212326A1 - Method for processing sensor data for a position and / or orientation of a vehicle - Google Patents

Abstract

The present invention relates to a method for processing sensor data for a position and / or orientation of a vehicle (100), wherein at least sensor data of a first sensor (111, 112, 113, 114, 115) are used as first sensor data and sensor data of a second sensor (111 , 112, 113, 114, 115) are detected as second sensor data, wherein from the first sensor data first pose information is determined, which describe the position and / or orientation of the vehicle (100) at a reference time, and wherein the second sensor data second pose information determining the position and / or orientation of the vehicle (100) at the reference time.

Description

The present invention relates to a method for processing sensor data for a position and / or orientation of a vehicle as well as to a computing unit and a computer program for carrying it out.

State of the art

For driving assistance functions of a vehicle, such as e.g. Lane departure warning system, adaptive cruise control, automatic longitudinal guidance, etc., can be controlled by sensors such as Camera, radar, Lidargerät etc. the environment of the vehicle are detected metrologically. Corresponding sensor data acquired with the sensors can be evaluated and interventions in the vehicle guidance can be carried out on the basis of these evaluated sensor data, for example by correspondingly controlling actuators of the vehicle. In the course of the so-called autonomous moving away, a vehicle controls itself automatically without the intervention of a driver. Analogous to driver assistance functions, a variety of vehicle functions such as steering, braking, drive, etc. are automatically controlled by the vehicle.

For such driver assistance functions and for autonomous movement, it is important that the sensor data based on which is intervened in the vehicle guidance, are integer to prevent endangering occupants of the vehicle or other road users and damage to the vehicle and other vehicles. Sufficient data integrity (degree of confidence of the data information) is necessary in order to be able to perform secure active interventions in the vehicle guidance.

Data integrity includes different types of integrity, in particular correct content (this type of integrity occurs when real-world issues are mapped correctly), unmodified state (this type of integrity occurs when messages are delivered unaltered, and programs and processes proceed as intended) and detection of modification (This type of integrity occurs when unwanted modifications that can not be prevented are at least detected).

For example, is from the DE 10 2012 215 343 A1 a method for performing a safety function of a vehicle known, for example, an emergency brake assist or an evasive assistant. Data required for performing the safety function is transmitted to a control unit of the vehicle, and the control unit generates control signals in response to these transmitted data. In this case, diagnostic tests are repeatedly carried out at intervals, with which it is checked whether there is a fault in one or more electrical, electronic and / or programmable systems used to carry out the method, which can impair the performance of the safety function. For this purpose, metadata of the data is transferred to the control unit, which contains information about the systems used to carry out the method. Using this information, at least one reliability value of the data is determined, which depends inter alia on the probability of the occurrence of disturbances. In dependence on the at least one reliability value, it is checked whether the transmitted data are sufficiently reliable for performing the safety function.

Disclosure of the invention

According to the invention, a method for processing sensor data for a position and / or orientation of a vehicle as well as a computing unit and a computer program for carrying it out with the features of the independent patent claims are proposed. Advantageous embodiments are the subject of the dependent claims and the following description.

The vehicle may conveniently be designed as a land vehicle, in particular a power, hybrid or electric vehicle, passenger or commercial vehicle, e.g. As a car, truck, motorcycle, bus, train, etc. It is also conceivable that the vehicle is designed as a vehicle operable away from paved roads, e.g. as an off-road vehicle (Unimog, amphibious vehicle, snowcat, etc.), ATV (all-terrain vehicle, for example a quad) or snowmobile. In particular, the vehicle may also be designed as an aircraft or watercraft, e.g. as aircraft, helicopters, boats, jet skis, etc. The vehicle may be controlled by a driver or may also be an unmanned, remotely controlled vehicle, e.g. a drone.

Within the scope of the method, at least sensor data of a first sensor are detected as first sensor data and sensor data of a second sensor as second sensor data. From the first sensor data first pose information is determined, which describe the position and / or orientation of the vehicle at a reference time. Analog second pose information is determined from the second sensor data, which also describe the position and / or orientation of the vehicle at the reference time. The pose information thus describes in each case in particular, at which specific position and / or in which specific orientation with respect to a Reference coordinate system, the vehicle is at the reference time.

As part of the method, sensor data from various sensors are calibrated, in particular temporally and locally, i. brought into a temporal and local context or defined spatially and temporally in a fixed grid. Different sensor data are thus comparable and can be compared representatively and meaningfully with each other. Local calibration ensures that the sensors at least partially monitor the same area and thus capture sensor data of the same area. Thus, a first overlap of the sensor data can be achieved. By time calibration is also ensured that this common area is detected by the sensors at the same specific time. Thus, a further overlap of the sensor data is achieved.

By temporal calibration in particular a temporal integrity of the sensor data can be achieved. In particular, a first time interval between the time when an (optical) information is transmitted and the time at which the information is detected by the corresponding sensor (optical-electrical conversion) can be compensated. Furthermore, in particular a second time interval between excitation of the sensor and generation of a corresponding electrical signal (physical-electrical conversion) and the respective signal propagation time of this signal can be compensated.

Depending on the number of pose information or sensors now advantageously offer different ways, how to proceed with the information on.

According to a preferred refinement, the first and second pose information originating from different sensors are compared with one another, and from this comparison, an integrity or data integrity of the first sensor data and the second sensor data is determined. It goes without saying that sensor data from more than two sensors can also be compared with one another and an integrity of this multiplicity of sensor data can be determined.

The sensor data can thus be made plausible. Ideally, the position or orientation of the vehicle, which is described by the pose information derived from different sensors, should be identical and reflect the actual position or orientation of the vehicle. Thus, the more accurate the pose information derived from different sensors, the higher the data integrity of the corresponding sensor data. One way of determining integrity is based on determining an amount of overlap of information contained in the sensor data. If different sensors detect the same in time and space, ie if the corresponding sensor data overlap temporally and spatially, these data have an increased degree of integrity.

For example, a corresponding integrity value can be determined, which can be, for example, between 0 (bad) and 1 (good) or between 0% and 100%. A threshold can be defined, with the sensor data rated as insufficient integer if the integrity value does not reach this threshold. In particular, this makes it possible to include fuzzy "sensor" data (e.g., neural network output data, Kalman filters, other statistical collected data, etc.) in the integrity determination.

Furthermore, the method can easily detect attacks on the vehicle, in particular on the vehicle guidance. In order to gain access to the vehicle and to influence it in the course of an attack on the vehicle guidance, an attacker would have to be able to introduce data into the vehicle which matches the sensor data acquired by the sensors and can be made plausible with this sensor data. The attacker would thus have to replicate what the different sensors capture at each specific time. Otherwise, it could be immediately noticed by comparing the sensor data that it is not a real sensor data, but an attack. However, it is almost impossible for an attacker to accurately replicate the sensor data at any given time, making an attack almost impossible.

Preferably, further metadata of the first sensor and / or the second sensor are taken into account for determining the integrity. In this context, metadata should be understood in particular as meaning information describing with which quality or accuracy the respective sensor can metrologically record sensor data and / or with which quality or accuracy this acquired sensor data is evaluated by the vehicle or its control unit (s) can be. For example, these metadata can be determined as part of a manufacturing or development process of the individual sensors by the sensor is precisely measured. For example, in the course of the manufacturing process, these metadata can be stored in the sensor itself and, in particular, by the sensor to the corresponding arithmetic unit, which has the integrity in the sensor Determined under the procedure. This metadata can also be determined during product validation as a specific characteristic.

For example, the metadata may describe error rates, diagnostic coverage (DC) and / or bus transit times of the sensors, or other implemented malicious measures and their efficiency. For example, the metadata may also describe probabilities, e.g. Probabilities of occurrence of faults, such as system-related hardware or software faults. Preferably, the integrity value of the first and second sensor data can be determined as a function of this metadata, in particular as a function of such probabilities for the occurrence of errors or / and as a function of such error rates.

For a detailed explanation of such metadata is at this point on the publication DE 10 2012 215 343 A1 directed. Examples of possible errors and corresponding error rates are given, for example, in paragraph [0030] of this publication. Furthermore, detailed explanations of metadata, such as error rates, diagnostic coverage, corresponding probabilities, as well as the determination of an integrity value of data as a function of such metadata are explained in this publication, in particular in paragraphs [0010] to [0040], to which at this point is fully referenced.

According to an advantageous embodiment, the first pose information and / or the second pose information are compared with environmental information describing an environment of the vehicle at the reference time. From this comparison, preferably the integrity of the first and second sensor data is determined. In particular, it is thus possible to evaluate how reliably the sensor data describe the position and the surroundings of the vehicle.

For example, the environmental information may describe the road on which the vehicle is moving at the reference time. Such environmental information can be obtained, for example, from map data of a navigation system of the vehicle or from the Internet or via a wireless data connection or also from other vehicles.

For example, the position at the reference time point relative to a reference point of the surroundings of the vehicle can be determined from the sensor data. Thus, both a reference time point and a spatial reference point or reference space point (in particular a prominent point in the surroundings of the vehicle) are predefined, to which the sensor data can be referred. The sensor data can thus, as described above, expediently be brought into a concrete temporal and spatial context or defined spatially and temporally in a fixed grid. The sensor data are thus comparable, representative and meaningful.

Sensors can be effectively made plausible, in particular by navigation data, so that high integrity can be achieved in the vehicle independently of other sensor systems. By comparing it with secured infrastructure information, the sensor data can effectively be used independently of current environmental conditions, such as: As the current vehicle speed, air pressure, weather conditions, etc., are plausibility. Such different environmental conditions may possibly have an effect on the sensor data due to the physical measurement principles of the sensors.

Preferably, a distance of the vehicle to a reference point of the environment is determined as first pose information and / or second pose information. This reference point can be conveniently taken from the environment information. For example, a distinctive, uniquely identifiable point in the environment may be selected, such as a bridge, a pillar, an intersection, a junction, a tree, a lane marker, etc.

For example, if the environment in front of the vehicle is detected by means of sensors, the respective reference point can be identified in corresponding recordings of such sensors, e.g. by means of an object recognition program, and the distance can be calculated respectively. Thus, it can be assessed on the basis of specific reference points of the environment, how precise and reliable the sensors position and environment of the vehicle can determine.

In particular, the current situation, for example current weather conditions, can be automatically taken into account for determining the integrity in this way. If, for example due to rain, fog, snow, etc., poor visibility, this is automatically detected in the process. If in such poor visibility conditions, for example, a 100 m in front of the vehicle lying reference point (such as a bridge) of optical, especially on-board, sensors (such as camera, radar, Lidargerät) can not be detected and thus a corresponding distance as pose information can not be determined , the sensor data as correspondingly unreliable classified. Analogously, the sensor data can be assessed as unreliable, if, for example, the lane marking is selected as the reference point and if the lane marking can only be detected up to a distance of 50 m in front of the vehicle with the optical sensors, in particular the vehicle's own, due to poor visibility conditions.

Preferably, a position and / or orientation of the vehicle in a coordinate system is determined as first pose information and / or second pose information. The coordinate system can be an absolute coordinate system, e.g. the world coordinate system, or a time variable coordinate system, e.g. relative to a reference point in the environment as the origin.

By means of the coordinate system (as a spatial reference) at the reference time (as time reference), the sensor data can be brought into a spatial and temporal context, as described above, or spatially and temporally defined in a fixed grid.

Preferably, the reference time is determined by a data delay of the first sensor data and / or the second sensor data. For different sensors, different, sensor-specific data run times (latency) may apply. That is, it can take different lengths of time for different sensors to evaluate measured sensor data and determine the respective usable information. In this context, such a data runtime should be understood as meaning, in particular, a time interval between a first time and a second time, wherein the corresponding sensor data is expediently recorded at this first time. At the first time, the corresponding sensor is in particular excited (optical-electrical or physical-electrical conversion), for example because a voltage or current pulse is generated in the sensor. During the time interval, these sensor data are forwarded to a computing unit, for example via a bus system to a control unit, and evaluated. At this second time, the sensor data are expediently evaluated and the corresponding pose information is determined in particular.

The data delay may depend, for example, on bus transit times or data transfer times, which are required to transfer the sensor data acquired by the sensor into a corresponding computing unit, e.g. into a control unit, which evaluates the sensor data. Furthermore, the data runtime may depend on a runtime, which may be e.g. a executed in the arithmetic unit program needed to evaluate the sensor data and to determine the appropriate information.

For sensor data of different sensors, which are detected simultaneously at the same first time, the corresponding evaluated information can therefore be present in the arithmetic unit at different second times. By means of the method, these different data transit times can be compensated by different sensors. Thus, pose information which is obtained at the same second time is not compared with one another, since these are based, if appropriate, on sensor data which were acquired at different first times by the respective sensors. Instead, pose information is compared with each other describing the position / orientation of the vehicle at the same reference time.

The reference time may in particular be in the past, for example at least one time interval before the current time, which corresponds to the largest data runtime of the compared sensors. Thus, the data delay of different sensors can be compensated and it can be ensured that only synchronous sensor data are compared with each other, which can be related to a common temporal reference time.

It is also conceivable that the reference time is preferably in the future. In particular, for this purpose, a future position or orientation of the vehicle can be extrapolated as pose information from the sensor data. By comparing this corresponding pose information can thus be assessed how reliable the future position of the vehicle can be predicted by means of the sensor data and how strongly based on this extrapolated position interventions on the vehicle management may be performed.

The method thus offers the possibility of being able to representatively evaluate how integer sensed sensor data are. In particular, it can thus be assessed how precisely the actual position of the vehicle can be determined by the sensors. In particular, based on the determined integrity, it can be evaluated whether the sensor data is integer enough to be used for vehicle functions. The method is therefore particularly suitable for driver assistance functions (for example lane departure warning, proximity control, automatic longitudinal guidance etc.) and particularly advantageous for an autonomous movement of the vehicle, in which the vehicle controls itself, in particular without intervention of a driver.

Advantageously, an automatic intervention in the vehicle guidance is performed as a function of the first and second sensor data. This intervention is particularly preferably carried out in the course of autonomous movement. It is also conceivable that the intervention is advantageously carried out by a driver assistance function. The first and second sensor data are, for example, evaluated and further processed to generate input data, based on which the intervention on the vehicle guidance or corresponding activation data for actuators is determined. For example, in the course of the autonomous movement by means of the sensors, the surroundings of the vehicle, in particular a special area in front of the vehicle, can be detected metrologically. The corresponding sensor data are evaluated in order to be able to recognize, for example, the road, the roadside, lane markings and other road users. Furthermore, the relative position and the distance of the vehicle to such objects of the environment are expediently determined in the course of this evaluation. Depending on this, automatic interventions in the vehicle guidance (steering, brake, drive, etc.) are expediently carried out in order to move the vehicle safely on the road (land / water / air) at a safe distance from the other road users. Thus, the vehicle can be safely moved in any, even foreign infrastructure.

Here, high safety guidelines apply, as by appropriate automatic intervention in the vehicle management no danger to the occupants of the vehicle and other road users, buildings, etc. may take place. By evaluating the integrity of the sensor data, it is possible to ensure that automatic interventions, particularly in the course of autonomous transportation, are carried out safely and reliably without jeopardizing occupants and other road users and without damaging the vehicle or other vehicles or the surroundings , In particular, automatic intervention by the method according to the safety standards of Standard ISO 26262 or according to the ASIL (Automotive Safety Integrity Level) defined therein. Furthermore, it is possible to prove the correct function in terms of product liability.

Advantageously, depending on the specific integrity of the first sensor data and the second sensor data, it is determined how strongly the automatic intervention in the vehicle guidance is carried out, in particular how much influence is exerted on actuators of the vehicle. Thus, a differentiated evaluation is made possible and it can be determined how much intervention may be made in the course of the autonomous movement or in the course of driver assistance functions on the vehicle guidance.

The more integrated the sensor data, the stronger this intervention may be. For example, different thresholds may be defined, with the intervention severity being reduced each time the particular integrity value reaches one of these thresholds. For example, a continuous adjustment of the intervention strength is also conceivable if the integrity value defined in particular between 0 and 1 is multiplied by the corresponding engagement strength. The reduced dynamics significantly reduce the risk of possible incorrect operations.

With low integrity of the sensor data, no or only very weak interventions in the vehicle guidance are accordingly allowed, for example only a comparatively low maximum speed, no abrupt steering or braking maneuvers, but only very gentle corrections of the longitudinal and transverse guidance. Thus, for example, in the course of autonomous travel, the vehicle is automatically moved slowly and carefully in poor visibility conditions.

For example, the current speed of the vehicle can also be reduced in order to achieve a reduction of a potential extent of damage in the event of accidents. For example, the driving speed can be reduced to a maximum value of 20 km / h, in which no life-threatening injuries are possible. Furthermore, it can be achieved by a reduced speed that more data per unit of time can be collected, since a time interval for covering a certain distance increases. In particular, more precise and reliable data can thus be collected. Also, more time is available for the plausibility of the sensor data.

Preferably, as such an autonomous intervention in the vehicle guidance, an intervention is made on a longitudinal and / or transverse guidance of the vehicle and / or on a brake and / or on a drive in dependence on the first sensor data and on the second sensor data. In order to carry out such interventions in the course of autonomous driving or in the course of driver assistance functions safely and without danger, it is of particular importance that the sensors can precisely and reliably determine the current position and the current environment of the vehicle.

According to a preferred development, further pose information originating from other sensors is compared with the first and second pose information. For this comparison Advantageously, sensor data is determined with increased data integrity compared to the first and second sensor data. Preferably, a vote (so-called "voting") on the sensor data of the sensors is performed to increase the data integrity. In particular, it is checked whether at least a certain number of the sensor data or its pose information match or substantially match. In particular, these matched sensor data have increased data integrity compared to the first and second sensor data.

For example, a so-called 2 out of 3 voting ("2 out of 3 voting", "2oo3") may be performed, during which at least two out of three sensor data must match. There may also be a 70 out of 100 vote ("70 out of 100 voting", "70oo100"), during which at least 70 out of 100 sensor data must match. Thus, a high fault tolerance and a high reliability of the sensor data can be achieved. For example, blurred sensor data, sensor data with different data transit times or noisy sensor data can also be introduced into the tuning.

For example, it is also conceivable to carry out a tuning for actuators, in particular if different control units or functions act on two independent actuators or actuator systems, e.g. to a first and a second actuator system for braking the wheels of the front axle or the rear axle, or e.g. to two independent actuator systems in the form of two independent pairs of windings in an electric machine. Based on the integrity can be suitably tuned, which control units or functions act on the actuators.

If the vehicle comprises a security architecture with a multiplicity of sensors, it is also conceivable to select from this plurality, in particular, special sensors whose sensor data are compared with one another. For example, those sensors can be selected which are most suitable under current environmental and / or locomotion conditions (good visibility - poor visibility, fast locomotion - slow travel, highway driving - highway driving - city driving, brightness - darkness, etc.), sensor data regarding the respective Capture pose information. Individual sensors can be used, for example, as guide sensors and other sensors for plausibility. In particular, individual sensors can be selected during operation and it can be switched during operation between different sensors.

The first sensor and / or the second sensor are each preferably designed as a vehicle-specific or vehicle-external sensor. In this context, an on-board sensor should be understood to mean a sensor which is part of the vehicle, e.g. internal camera, radar, Lidargerät, GPS device, navigation system, steering angle sensor, wheel speed sensor, acceleration sensor, rotation rate sensor, inertial sensor, etc. In particular, sensor data of such an in-vehicle sensor are detected anyway in the course of regular operation of the vehicle. By means of such an acceleration sensor, in particular a longitudinal and / or lateral acceleration of the vehicle can be determined. By means of a yaw-rate sensor, it is expedient to determine a yaw, roll and / or pitch rate of the vehicle.

In this context, a sensor external of the vehicle is to be understood as meaning a sensor which is not part of the vehicle, e.g. external cameras, radars, eyelids, etc. Such a vehicle-external sensor is located outside the vehicle and is particularly used in other vehicles or in an environment of the vehicle, e.g. on a street, in a restricted-traffic area or in a parking or stopping zone, permanently installed and monitored this environment or part of the environment.

Advantageously, in each case an interface of a computing unit is provided for the first sensor data and for the second sensor data, which is designed in particular as a control unit of the vehicle. The first sensor data and the second sensor data are read in and processed by the arithmetic unit via the respective interface. Preferably, the integrity of the sensor data is determined by the computing unit. Preferably, the metadata described above are also read by the arithmetic unit via the respective interface.

Advantageously, these interfaces can be designed as a deterministic interface, or a deterministic scanning of the interface can preferably be made possible. In this context, a deterministic interface should be understood to mean an interface by means of which sensor data can be transmitted deterministically between the sensor and the arithmetic unit. In particular, it can be ensured by means of such a deterministic interface that sensor data can be transmitted in real time. By such a determinism (temporally stable fixed frame, when the sensor data are available to the arithmetic unit), the compensation of data delays can be facilitated because in particular a maximum data runtime and a Guaranteed existence of captured sensor data, evaluated sensor data or specific pose information can be granted at a specific time.

An arithmetic unit according to the invention, e.g. a control device of a vehicle, is, in particular programmatically, adapted to perform a method according to the invention.

Also, the implementation of the method in the form of a computer program is advantageous because this causes very low costs, especially if an executive controller is still used for other tasks and therefore already exists. Suitable data carriers for providing the computer program are in particular magnetic, optical and electrical memories, such as e.g. Hard drives, flash memory, EEPROMs, DVDs, etc. It is also possible to download a program via computer networks (Internet, intranet, etc.).

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

The invention is illustrated schematically by means of embodiments in the drawing and will be described below with reference to the drawing.

Brief description of the drawings

1 schematically shows a vehicle that is adapted to perform a preferred embodiment of a method according to the invention.

2 schematically shows a control unit of a vehicle, which is adapted to perform a preferred embodiment of a method according to the invention.

3 schematically shows a vehicle that is adapted to perform a preferred embodiment of a method according to the invention, on a road.

4 also schematically shows a vehicle that is adapted to perform a preferred embodiment of a method according to the invention, on a road.

Embodiment (s) of the invention

In 1 is a vehicle 100 shown schematically, which is designed for example as a passenger car. The vehicle 100 has a plurality of sensors, such as a camera 111 and a radar device 112 , by means of which in each case an environment or an area in front of the vehicle 100 can be detected metrologically.

Furthermore, the vehicle 100 a speed sensor 113 on to a wheel speed of the vehicle 100 metrologically to capture. By means of a steering angle sensor 114 can be a current steering angle of the vehicle 100 be detected and by means of an inertial sensor 115 can yaw, roll and pitch angles (ie, an orientation) of the vehicle 100 be recorded.

Furthermore, the vehicle includes 100 a plurality of actuators, such as a brake actuator 121 to brake the vehicle 100 to operate, a motor actuator 122 (Eg fuel metering system) to speed or power of an engine vehicle 100 to steer, and a steering angle actuator 123 to the steering angle of the vehicle 100 to change and thus the longitudinal or transverse guidance of the vehicle 100 to influence.

It is understood that the vehicle 100 still further sensors and actuators and other elements may have, which are not shown explicitly for reasons of clarity.

The sensors 111 . 112 . 113 . 114 . 115 as well as the actors 121 . 122 . 123 are via a communication system of the vehicle 100 , For example, via a bus system, in particular CAN, with a control unit 130 connected. Furthermore, a navigation system 140 provided, which also via the bus system with the control unit 130 connected is.

The control unit 130 is particularly adapted to autonomous driving as a form of autonomous vehicle movement 100 perform. In the course of this the vehicle becomes 100 autonomous by the control unit 130 controlled without a driver having to intervene as a driver. For this purpose, the controller reads 130 Sensor data, which from the sensors 111 . 112 . 113 . 114 . 115 are detected, evaluates this sensor data and determines in dependence thereon control data for the actuators 121 . 122 . 123 to the vehicle 100 depending on the detected sensor data.

For such autonomous driving, it is important that the sensor data are integer or precise and reliable in order to prevent endangering of passengers and other road users. The control unit 130 is therefore, in particular programmatically, set up to carry out a preferred embodiment of a method according to the invention.

The control unit 130 is in 2 shown schematically. As in 2 to recognize is the control unit in each case via a (in particular separate) interface 211 . 212 . 213 . 214 respectively. 215 with the individual sensors 111 . 112 . 113 . 114 respectively. 115 connected. However, several sensors can also be connected to the control unit via a same (in particular serial) interface, eg LIN, SENT or SPI. Via this interface (s) 211 . 212 . 213 . 214 respectively. 215 reads the controller 130 each from the corresponding sensor 111 . 112 . 113 . 114 respectively. 115 recorded sensor data.

Furthermore, in individual or all sensors 111 . 112 . 113 . 114 . 115 each deposited metadata, which describe the quality and accuracy of each sensor can capture sensor data by measurement. For example, these metadata can describe error rates and diagnostic coverage (Diagnostic Coverage DC) of the respective sensor.

About the interface (s) 211 . 212 . 213 . 214 respectively. 215 reads the controller 130 in particular also these metadata from the corresponding sensor 111 . 112 . 113 . 114 respectively. 115 one.

In a logic unit 220 of the control unit 130 As a function of these sensor data and these metadata, in the course of a preferred embodiment of the method according to the invention, an integrity of the sensor data is determined, as described below with reference to FIG 3 is described.

In 3 is the vehicle 100 out 1 shown schematically. In the 1 shown elements (sensors, actuators, etc.) are in 3 not shown explicitly for the sake of clarity.

The vehicle 100 moves on a street 300 on a lane 310 , The lane 310 is through a median strip 321 and a side lane marker 322 limited. In the illustrated example, the vehicle is moving 100 on a bridge 330 to.

Conveniently, this can be an inertial system 341 of the vehicle 100 define in which the vehicle 100 not moved. This inertial system 341 moves with the speed of the vehicle 100 relative to a fixed coordinate system 342 the street 300 as reference coordinate system.

The following is an example of how, in the course of a preferred embodiment of the method according to the invention, an integrity of sensor data of the camera 111 and the radar 112 can be determined.

The environment in front of the vehicle 100 in particular, continuously by means of the camera 111 and the radar 112 metrologically recorded, so it will be particularly continuous pictures with the camera 111 and with the radar 112 made of the environment in front of the vehicle. The camera 111 captures images as the first sensor data (also referred to below as camera data) and the radar 112 captures corresponding recordings as second sensor data (also referred to below as radar data).

The corresponding pictures or sensor data as well as the metadata are taken by the camera 111 and the radar 112 via the appropriate interface 211 respectively. 212 to the control unit 130 transmitted.

In the control unit 130 the sensor data are evaluated. First and second pose information are respectively determined from these first and second sensor data, which respectively determine the position of the vehicle 100 describe.

As continuously sensor data from the camera 111 and the radar 112 are detected, suitably also corresponding pose information is determined continuously. However, the camera data and the radar data may have different data transit times, ie it may take a different amount of time until the corresponding first or second pose information is ultimately determined from camera and radar data acquired at a specific time.

Therefore, the camera and radar data are time calibrated or related to a reference time. For this purpose, the controller determines 130 from the camera or radar data in each case the position of the vehicle at a specific time, which lies in particular in the past. To compensate for the data delays, this specific time can be determined in particular by the data delays. For example, this specific time may be 0.5 seconds before the current time.

Furthermore, the camera and radar data are locally calibrated or referenced to a spatial reference point. Preferably, for this purpose, a prominent point of the environment, which in particular with the camera 111 and the radar 112 easy to identify, be selected. The distance of the vehicle 100 to this reference point can preferably be determined from the camera and radar data as corresponding pose information.

For example, via the navigation system 140 Obtaining environmental information describing the environment of the vehicle, in particular the area of the road 300 in front of the vehicle. Such environment information can in the navigation system 140 For example, be stored as a map data. Based on this environment information, a corresponding reference point can be selected. In this example will be a specific point of the bridge 330 , For example, a center of a pillar or the like, selected as the reference point.

From the camera and radar data the distance of the vehicle 100 can be determined as corresponding pose information to this reference point, by the control unit 130 an object recognition are performed to the abutment o.ä. as the concrete point in the pictures of the camera 111 and the radar 112 to recognize. If the pillar o.ä. detected by the object recognition, the distance of the vehicle 100 to the pillar or similar determined from the first and second sensor data.

Overall, therefore, from the continuously acquired camera data from the controller 130 the distance of the vehicle 100 before 0.5 s (as reference time) to the pillar or similar the bridge 330 (as a spatial reference point) determined as the first pose information. Analogously, this distance is determined from the radar data as second pose information.

From this first and second pose information and the corresponding metadata, an integrity value is determined by the controller, which may for example be between 0 and 1.

Furthermore, the controller determines 130 depending on this integrity value, how strongly in the course of the autonomous driving interventions in the vehicle guidance may be made and how strongly the actuators 121 . 122 . 123 may be controlled. For example, for this purpose, the control values for the actuators 121 . 122 . 123 multiplied by the determined integrity value.

For example, if the camera has a defect and the environment in front of the vehicle 100 do not capture precisely and the abutment o.ä. the bridge 330 only partially or not at all can be detected by the image recognition, the corresponding sensor data are thus classified as unreliable and allowed only very weak intervention in the vehicle.

Conveniently, it is thus also possible to respond automatically to poor visibility in the course of autonomous driving. If the pillar o.ä. the bridge 330 Due to fog can not be detected by the image recognition, also very weak intervention in the vehicle control are allowed.

It is also conceivable, for example, the images of the camera 111 and the radar 112 as a first and second sensor data with further sensor data to plausibility and according to a preferred embodiment of the method to determine a corresponding integrity of this sensor data. In the following, it will be explained by way of example how a preferred embodiment of the method according to the invention results in an integrity of sensor data of the camera 111 , the radar 112 , the steering angle sensor 114 and the inertial sensor 115 can be determined.

The steering angle of the vehicle is thereby by means of the steering angle sensor 114 recorded as third sensor data. Rolling, yawing and pitching angles of the vehicle are referred to as fourth sensor data by means of the inertial sensor 115 detected. As environment information can in this example via the navigation device 140 the fixed coordinate system 342 the street 300 can be obtained from map data.

By evaluating the sensor data, the orientation of the vehicle 100 relative to the road 300 be determined. Thus, preferably from the first, second, third and fourth sensor data respectively a relative position of the vehicle in the inertial system 341 of the vehicle 100 relative to the fixed coordinate system 342 the street 300 at the reference time, that is, 0.5 seconds ago, as corresponding first, second, third and fourth pose information are determined. The stationary coordinate system 342 thus acts as a spatial reference point and the concrete time described above as the reference time

From these first, second, third, and fourth pose information, as well as the corresponding metadata, are received by the controller 130 the integrity value and the strength of Aktoransteuerung determined.

By comparing the pose information and determining the integrity value, an attacker can also be prevented from gaining access to the vehicle 100 procures and intervenes in the vehicle guidance. An attacker would have to manage data in the vehicle 100 which exactly reproduce what the sensors are 111 . 112 . 114 and 115 capture what is almost impossible.

An example of how the method can advantageously contribute to the safe performance of autonomous driving is described below with reference to FIG 4 explained. In 4 is the vehicle 100 analogous to 3 shown. The vehicle is moving 100 in the course of autonomous driving straight out on the street 400 or on a corresponding lane 410 ,

So that the vehicle 100 in the course of autonomous driving safely on the road 400 and in his lane 410 Moves and does not depart, for example, security corridors can be defined, which in 4 with the reference numerals 421 . 422 and 423 are designated.

The one with 421 For example, the designated corridor defines an allowable nominal range in which the vehicle is located 100 for safe driving on the lane 410 should move. The corridor 423 is a restricted area in which the vehicle is 100 may not move in the course of autonomous driving.

With 422 designated corridors are tolerance ranges in which the vehicle 100 still on his lane 410 moves, but the road boundary or the median strip and thus in particular the restricted area 423 approaches. When the vehicle 100 into one of these tolerance ranges 422 moved, is counteracted in the course of autonomous driving accordingly to the vehicle 100 back to the nominal permissible range 421 to move.

For example, such corridors may be required by standards and safety guidelines, such as the ISO 26262 , The method for determining an integrity of sensor data can ensure that the sensor data of the vehicle 100 , by means of which in the course of autonomous driving the road is detected metrologically, are reliable and that the vehicle 100 safely in the permitted range 421 emotional.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102012215343 A1 [0005, 0018]

Cited non-patent literature

• Standard ISO 26262 [0035]
• ISO 26262 [0094]

Claims (17)

Method for processing sensor data for a position and / or orientation of a vehicle ( 100 ), wherein at least sensor data of a first sensor ( 111 . 112 . 113 . 114 . 115 ) as first sensor data and sensor data of a second sensor ( 111 . 112 . 113 . 114 . 115 ) are detected as a second sensor data, wherein from the first sensor data first pose information is determined which the position and / or orientation of the vehicle ( 100 ) are described at a reference time, and wherein from the second sensor data second pose information is determined which the position and / or orientation of the vehicle ( 100 ) at the reference time. The method of claim 1, wherein the first pose information and the second pose information are compared with each other, and wherein from this comparison, an integrity of the first sensor data and the second sensor data is determined. Method according to claim 2, wherein the first pose information and / or the second pose information are compared with environment information representing an environment ( 300 ) of the vehicle ( 100 ) at the reference time, and from this comparison, the integrity of the first and second sensor data is determined. Method according to claim 2 or 3, wherein for the determination of the integrity further metadata of the first sensor ( 111 . 112 . 113 . 114 . 115 ) and / or the second sensor ( 111 . 112 . 113 . 114 . 115 ). Method according to one of the preceding claims, wherein a distance of the vehicle ( 100 ) to a reference point ( 330 ) the environment ( 300 ) are determined as first pose information and / or second pose information. Method according to claim 5, wherein a position and / or orientation of the vehicle ( 100 ) in a coordinate system ( 341 . 342 ) are determined as first pose information and / or second pose information. Method according to one of the preceding claims, wherein the reference time is determined by a data delay of the first sensor data and / or the second sensor data. Method according to one of the preceding claims, wherein an automatic intervention in the vehicle guidance is performed in dependence on the first sensor data and the second sensor data. The method of claim 8 in reference to at least claim 2, wherein it is determined in dependence on the specific integrity of the first sensor data and the second sensor data, how much this automatic intervention in the vehicle guidance is performed. A method according to claim 8 or 9, wherein an engagement on a longitudinal and / or transverse guide of the vehicle ( 100 ) and / or on a brake and / or a drive in response to the first sensor data and the second sensor data is performed as an automatic intervention in the vehicle guidance. Method according to one of the preceding claims, in which further pose information originating from other sensors is compared with the first and second pose information and a tuning via the sensor data of the sensors is carried out. Method according to one of the preceding claims, wherein the first sensor is an on-board sensor or a vehicle-external sensor and / or wherein the second sensor is an on-board or a vehicle-external sensor. Method according to one of the preceding claims, wherein the first sensor and / or the second sensor each as a steering angle sensor ( 112 ) and / or wheel speed sensor ( 113 ) and / or acceleration sensor and / or yaw rate sensor and / or inertial sensor ( 115 ) and / or camera ( 111 ) and / or radar device ( 112 ) and / or Lidargerät are formed. Method according to one of the preceding claims, wherein for each of the first sensor data and for the second sensor data an interface ( 211 . 212 . 213 . 214 . 215 ) of a computing unit ( 130 ) is provided, wherein the first sensor data and the second sensor data from the computing unit ( 130 ) via the respective interface ( 211 . 212 . 213 . 214 . 215 ) are processed. Arithmetic unit ( 130 ), which is adapted to perform a method according to any one of the preceding claims. Computer program comprising a computing unit ( 130 ) to perform a method according to any one of claims 1 to 14, when it on the computing unit ( 130 ) is performed. A machine-readable storage medium having a computer program stored thereon according to claim 16.

Images