Asymmetric failsafe system architecture

An autonomous vehicle system for controlling a vehicle, the autonomous vehicle system comprising:

• an autonomous operating driving system configured to control at least one vehicle actuator of the vehicle to perform a dynamic driving task during fault-free operation of said autonomous operating driving system;
• a redundancy driving system configured to perform a reduced driving task;
• said autonomous operating driving system being configured to carry out trajectory planning to obtain a planned reduced trajectory for the reduced driving task and to provide the planned reduced trajectory to said redundancy driving system;
• said autonomous operating driving system and said redundancy driving system being mutually separate systems which are interconnected;
• said redundancy driving system being configured to determine whether there is a first fault in said autonomous operating driving system;
• said autonomous operating driving system being configured to determine whether there is a second fault in said redundancy driving system;
• and,
• said redundancy driving system being configured to control the at least one vehicle actuator to perform the reduced driving task on detecting the first fault of said autonomous operating driving system using said planned reduced trajectory;
• wherein the autonomous operating driving system has at least one primary sensor for determining sensor data, a central control unit connected to said primary sensors, and a main power supply for the autonomous operating driving system;
• and, said central control unit is configured to carry out trajectory planning to obtain a planned trajectory using the sensor data if there is no first fault;
• wherein, if there is no first fault, the central control unit carries out operational trajectory planning to obtain an operational trajectory, and provides the operational trajectory to an operational controller and a redundancy controller;
• and, at least one of the operational controller and the redundancy controller controls at least one of the vehicle actuators to keep the vehicle on the operational trajectory;
• wherein a central redundancy control unit provides the planned trajectory or the planned reduced trajectory of the reduced driving task to the operational controller and the redundancy controller;
• at least one of the operational controller and the redundancy controller controls at least one of the vehicle actuators to keep the vehicle on the planned reduced trajectory of the reduced driving task if there is no operational trajectory in the event of a fault of the operating driving system;
• wherein the reduced trajectory, in comparison to the planned trajectory, has at least one of the following features:
• using a reduced parameter set;
• performing, based on at least one of qualitative and quantitatively reduced data;
• and,
• limiting with respect to at least one of a maximum length and maximum time duration, which the vehicle requires to drive the trajectory.

A vehicle comprising:

• an autonomous vehicle system for controlling the vehicle;
• said autonomous vehicle system including an autonomous operating driving system and a redundancy driving system;
• said autonomous operating driving system being configured to control at least one vehicle actuator of the vehicle to perform a dynamic driving task during fault-free operation of said autonomous operating driving system;
• said redundancy driving system being configured to perform a reduced driving task;
• said autonomous operating driving system being configured to carry out trajectory planning to obtain a planned reduced trajectory for the reduced driving task and to provide the planned reduced trajectory to said redundancy driving system;
• said autonomous operating driving system and said redundancy driving system being mutually separate systems which are interconnected;
• said redundancy driving system being configured to determine whether there is a first fault in said autonomous operating driving system;
• said autonomous operating driving system being configured to determine whether there is a second fault in said redundancy driving system;
• said redundancy driving system being configured to control the at least one vehicle actuator to perform the reduced driving task on detecting the first fault of said autonomous operating driving system using said planned reduced trajectory;
• and,
• wherein said autonomous vehicle system is configured to:
• control, via said redundancy driving system, said at least one vehicle actuator in order to carry out the reduced driving task using the planned reduced trajectory after detecting the first fault of said autonomous operating driving system;
• wherein said autonomous operating driving system has one or more primary sensors configured to provide sensor data to a central control unit of said autonomous operating driving system;
• and, said central control unit performs the trajectory planning using the sensor data;
• wherein, if there is no first fault, said central control unit carries out operational trajectory planning to obtain an operational trajectory, and provides the operational trajectory to an operational controller and a redundancy controller;
• and, at least one of said operational controller and said redundancy controller controls said at least one vehicle actuator to keep the vehicle on the operational trajectory;
• and,
• wherein a central redundancy control unit provides the planned reduced trajectory of the reduced driving task to said operational controller and said redundancy controller;
• at least one of said operational controller and said redundancy controller controls said at least one vehicle actuator to keep the vehicle on the planned reduced trajectory of the reduced driving task if there is no operational trajectory in the event of a fault of said autonomous operating driving system;
• wherein the reduced trajectory, in comparison to the planned trajectory, has at least one of the following features:
• using a reduced parameter set;
• performing, based on at least one of qualitative and quantitatively reduced data;
• and,
• limiting with respect to at least one of a maximum length and maximum time duration, which the vehicle requires to drive the trajectory.