DE102020001677A1 - Method for securing communication between a service and monitoring unit external to the vehicle and an autonomously driving vehicle, preferably a commercial vehicle transporting goods - Google Patents

Abstract

The invention relates to a method for securing communication between a service and monitoring unit external to the vehicle and an autonomously driving vehicle, preferably a commercial vehicle transporting goods, between which wireless data is continuously exchanged while the autonomously driving vehicle (1, 19) is traveling. In a method in which a monitoring functionality of the autonomously driving vehicle can be carried out continuously by a service and monitoring unit, a maximum time (tmax) is specified for checking a communication connection (3) within which at least one exchange of data between the autonomously driving vehicle Vehicle (1, 19) and the service and monitoring unit (5, 21) must take place, a safety function being initiated if the data is not exchanged within this period (tmax)

Description

The invention relates to a method for securing communication between a service and monitoring unit external to the vehicle and an autonomously driving vehicle, preferably a commercial vehicle transporting goods, between which wireless data is continuously exchanged while the autonomously driving vehicle is traveling.

The DE 10 2015 010 667 A1 discloses a method for data communication between a vehicle in a road network and a communication device. A time is predicted at which point in time an existing communication connection between the vehicle and the communication device breaks down. Based on historical data or currently determined communication parameters, "dead spots" in the environment can be learned.

Autonomous commercial vehicles with a certain degree of automation are regarded as self-propelled machines that transport goods. They require monitoring and an option to stop the operation of the autonomous commercial vehicle.

The object of the invention is to provide a method for securing communication between a service and monitoring unit external to the vehicle and an autonomously driving vehicle, preferably a commercial vehicle transporting goods, in which a monitoring functionality of the autonomously driving vehicle is carried out continuously by a service and monitoring unit can.

The invention results from the features of the independent claims. Advantageous further developments and refinements are the subject of the dependent claims. Further features, possible applications and advantages of the invention result from the following description and the explanation of exemplary embodiments of the invention, which are shown in the figures.

The object is achieved with a method in that a maximum period of time is specified for checking a communication connection within which at least the data must be exchanged between the autonomously driving vehicle and the service and monitoring unit, with the data not being exchanged within the vehicle Period a safety function is initiated. This has the advantage that safe operation of the autonomously driving vehicle can be guaranteed continuously.

The maximum time period is advantageously varied depending on the ambient conditions of the autonomously driving vehicle. The safe operation of the autonomously driving vehicle is improved while the reliability is increased by evaluating the communication with the service and monitoring unit according to the situation.

In one embodiment, the data is exchanged between the autonomously driving vehicle and the service and monitoring unit with a cycle time that is shorter than the maximum predetermined period. Since the usual data communication must take place several times within the specified period, it can be assumed that if there is no data exchange in the maximum period, a fault in the data communication can be safely concluded.

In a variant, the specified period of time is stored on a card control device of the vehicle and / or the service and monitoring unit. Since the route of the autonomously driving vehicle is predetermined, this assignment can be used to determine a position of the autonomously driving vehicle even when data communication has failed.

In one embodiment, a vehicle reaction is initiated as a safety function. This vehicle reaction is dimensioned in such a way that a hazard to road traffic is largely avoided.

It is advantageous if the vehicle reaction consists of a vehicle stop.
In a further embodiment, if the exchange of data between the autonomously driving vehicle and the service and monitoring unit is interrupted by a radio hole, the remaining autonomously driving vehicle is recognized by another vehicle with its vehicle sensors, which stores this information and after leaving it sends the radio hole to a backend, which forwards the information to the service and monitoring unit. This avoids dangers caused by the autonomous vehicle that has been left behind.

In a further embodiment, the service and monitoring unit issues a hazard warning to vehicles that are in the vicinity of the autonomously driving vehicle. These vehicles can then adapt their driving behavior to this traffic situation.

In a further variant, the networked, autonomously driving vehicle cyclically generates data on its system status and on one Route monitoring unit is sent transit information to the service and monitoring unit, and if the maximum period of time within which at least the data has to be exchanged between the autonomously driving vehicle and the service and monitoring unit is exceeded, a route closure is initiated as a safety reaction. In addition to increasing traffic safety and gathering information, legally prescribed safety requirements are met and the confidence of road users in autonomously driving vehicles is increased.

Further advantages, features and details emerge from the following description, in which - if necessary with reference to the drawing - at least one exemplary embodiment is described in detail. Described and / or illustrated features can form the subject matter of the invention individually or in any meaningful combination, possibly also independently of the claims, and can in particular also be the subject of one or more separate applications. Identical, similar and / or functionally identical parts are provided with the same reference symbols.

• 1 ein erstes Ausführungsbeispiel des erfindungsgemäßen Verfahrens,
• 2 ein weiteres Ausführungsbeispiel des erfindungsgemäßen Verfahrens,
• 3 ein weiteres Ausführungsbeispiel des erfindungsgemäßen Verfahrens,
• 4 ein weiteres Ausführungsbeispiel des erfindungsgemäßen Verfahrens.

Show it:

• 1 a first embodiment of the method according to the invention,
• 2nd another embodiment of the method according to the invention,
• 3rd another embodiment of the method according to the invention,
• 4th a further embodiment of the method according to the invention.

In 1 a first embodiment of the method according to the invention is shown. There is a commercial vehicle 1 in a wireless communication link 3rd with a service and monitoring center 5 . The autonomous commercial vehicle 1 has a high degree of automation and is used as a self-propelled machine that transports goods.

Because the autonomous commercial vehicle 1 on his route from the service and monitoring center 5 The communication link must be monitored continuously 3rd between the commercial vehicle 1 and the vehicle-external service and monitoring center 5 , which is used for bidirectional data exchange, are constantly monitored. In the commercial vehicle 1 is a counter for this purpose 7 available, which is set with a maximum period tmax. Within this period tmax there must be a data exchange between the autonomously driving commercial vehicle 1 and the service and monitoring center 5 be carried out. About the data from the commercial vehicle 1 to the service and monitoring center 5 Position data or user data such as vehicle status, tank level and the like are continuously sent. The service and monitoring center 5 confirms receipt of the data. The data transmission can take place encrypted. Encryption mechanisms such as message counters, checksums, security mechanisms and others can be used. Data communication takes place several times within the specified maximum time period tmax. Receives the commercial vehicle 1 a feedback from the service and monitoring center 5 , the counter 7 reset. Exceeds the counter 7 the maximum time tmax, there is a vehicle reaction.

This vehicle reaction can result in the commercial vehicle stopping 1 consist. A distinction can be made between an emergence stop, a safe stop and a section stop. The commercial vehicle stops at an emergency stop 1 immediately. In the event of a safe stop, the commercial vehicle stops 1 at the next opportunity to avoid, for example, the flow of traffic. If a section stop is carried out, the commercial vehicle stops 1 at the next waypoint that was previously defined on a map.

The maximum time tmax for monitoring the communication link 3rd can be variable depending on the environmental conditions of the commercial vehicle 1 can be set and is therefore based on the location of the commercial vehicle 1 . The respectively set maximum period tmax is on a card control device 9 of the commercial vehicle 1 saved. This creates a connection to the position of the commercial vehicle 1 established, which is why if the communication link fails 3rd the location of the commercial vehicle 1 can be located more easily.

In an urban environment, high communication reliability is required. Here the maximum period tmax e.g. can be set to 5 seconds.

On motorways, the maximum period tmax can be increased drastically if there are no exits where the commercial vehicle 1 could possibly leave.

The maximum time tmax can also be increased in tunnels, since there are no changes in the route planning of the commercial vehicle 1 can be made. The background to this assumption is the fact that the commercial vehicle 1 in the event of a communication link failure 3rd can be located quickly. Will the maximum Period tmax set to a value that the commercial vehicle 1 must send its next location after passing through the tunnel, it can be assumed that the commercial vehicle that has been left behind 1 is inside the tunnel.

Another exemplary embodiment of the method according to the invention is intended in connection with 2nd are explained. It is assumed that the autonomous commercial vehicle 1 can no longer continue and stops. If the communication link fails 3rd like a radio hole 11 , the service and monitoring center 5 not be informed. Inside the radio hole 11 recognizes another vehicle 13 based on its in-vehicle sensors 15 that the commercial vehicle 1 stayed put. The other vehicle 13 saves this sensor data inside the vehicle and sends it after leaving the radio hole 11 to its backend server 17th .

At the same time, you can use the backend server 17th other vehicles in the area before the danger of the broken down commercial vehicle 1 be warned. These vehicles can be asked to check their speed in the area of the dead zone 11 to reduce.

In 3rd and 4th A further exemplary embodiment of the method according to the invention is shown, in which a procedure in the event of a communication failure between a networked, autonomously driving vehicle 19th and the service and monitoring center, which has multiple section control units 5 is shown. The networked autonomous vehicle 19th cyclically sends data about its system status. The communication link is in different sections x , y , e.g. divided, with each section x , y , e.g. a section control unit 21x , 21y , 21z located. At the same time, route monitoring bridges send 23 Passage information of the autonomously driving vehicle 19th to the section control units 21x , 21y , 21z . The section control units 21x , 21y , 21z thus know which vehicle 19th in which section x , y , e.g. stops and how the traffic situation and the flow rate of the vehicles 25th in the respective section x , y , e.g. designed. In addition, they manage the position and status messages of the vehicles 19th , 25th . In the event that the cyclical information from the vehicle 19th the section control unit locks 21x , 21y , 21z the access roads so that subsequent traffic is not endangered. Furthermore, a route control vehicle or a towing vehicle can be dispatched. Failure of the vehicle's cyclical information 19th can occur due to a communication disruption or failure and is indicated when the maximum time tmax is exceeded.

The other vehicles 25th that are in the sections 21x , 21y , 21z stop, are warned and may be given instructions on how to reduce the speed or even assume a safe state in which the journey is interrupted. Even the vehicles can 25th get a "search order" in which the license plate of the vehicle 19th to these vehicles 25th is issued. Will the vehicle 19th Based on the license plate, the route control is informed.

Although the invention has been illustrated and explained in detail by means of preferred exemplary embodiments, the invention is not restricted by the disclosed examples and other variations can be derived therefrom by a person skilled in the art without departing from the scope of protection of the invention. It is therefore clear that there are a variety of possible variations. It is also clear that exemplary embodiments are only examples that are not to be interpreted in any way as a limitation of the scope, the possible applications or the configuration of the invention. Rather, the preceding description and the description of the figures enable the person skilled in the art to specifically implement the exemplary embodiments, the person skilled in the art being able to make various changes, for example with regard to the function or the arrangement of individual elements mentioned in an exemplary embodiment, without knowing the disclosed inventive concept To leave the scope of protection, which is defined by the claims and their legal equivalents, such as further explanation in the description.

Reference list

1

autonomous commercial vehicle

3rd

Communication link

5

Service and monitoring center

7

counter

9

Card control device

11

Radio hole

13

vehicle

15

Sensors

17th

Backend server

19th

connected vehicle

21

Section control unit

23

Route monitoring unit

25th

vehicle

QUOTES INCLUDE IN THE DESCRIPTION

This list of documents listed by the applicant has been generated automatically and is only included for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• DE 102015010667 A1 [0002]

Claims (9)

Method for securing communication between a service and monitoring unit external to the vehicle and an autonomously driving vehicle, preferably a commercial vehicle transporting goods, between which wireless data is continuously exchanged while the autonomously driving vehicle (1, 19) is traveling, characterized in that for testing a communication connection (3) is given a maximum period of time (tmax) within which at least the data must be exchanged between the autonomously driving vehicle (1, 19) and the service and monitoring unit (5, 21), if the exchange does not take place a safety function is initiated within this period (tmax). Procedure according to Claim 1 , characterized in that the period (tmax) is varied depending on the ambient conditions of the autonomously driving vehicle (1, 19). Procedure according to Claim 1 or 2nd characterized in that the exchange of data between the autonomously driving vehicle (1, 19) and the service and monitoring unit (5, 21) takes place with a cycle time shorter than the maximum predetermined period (tmax). Procedure according to Claim 1 , 2nd or 3rd , characterized in that the predetermined period (tmax) is stored on a card control device (9) of the autonomously driving vehicle (1) and / or the service and monitoring unit (5). Method according to at least one of the preceding claims, characterized in that a vehicle reaction is initiated as a safety function. Procedure according to Claim 5 , characterized in that the vehicle reaction consists in a vehicle stop. Procedure according to Claim 6 characterized in that if the exchange of data between the autonomously driving vehicle (1) and the service and monitoring unit (5) is interrupted by a radio hole (11), the stationary autonomously driving vehicle (1) is interrupted by another vehicle ( 13) is detected with the vehicle's own sensor system (15), which stores this information and sends it to a backend (17) after leaving the radio hole (11). Method according to at least one of the preceding claims, characterized in that the service and monitoring unit (5, 21) issues a hazard warning to vehicles (25) which are in the vicinity of the autonomously driving vehicle (1, 19). Method according to at least one of the preceding claims, characterized in that data relating to its system status are sent cyclically by the autonomously driving networked vehicle (19) and transit information is sent to the service and monitoring unit (21) by a route monitoring unit (23), wherein if the The maximum time period (tmax) within which at least data exchange between the networked vehicle (19) and the service and monitoring unit (21) must take place, a route closure is initiated as a safety response.

Images