# US 12,600,383 B2 · Device and method for generating and transmitting control commands for an autonomously driving motor vehicle > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,600,383 B2 - Document ID: US12600383B2 - Status: Granted - Kind: B2 - Application number: 18/578,288 - Filed: 2022-07-14 - Published: 2025-09-11 - Granted: 2026-04-14 - Earliest claimed: 2021-07-16 - Assignees: Volkswagen Aktiengesellschaft - Applicants: Volkswagen Aktiengesellschaft - Inventors: Eugen Schneider; Hartmut Voge; Timo Dobberphul - Web page: https://patentgrep.com/patent/US12600383B2 ## CPC - B60W 60/00186: {related to the vehicle} - G05D 1/0077: {using redundant signals or controls} - B60W 30/18009: {related to particular drive situations} - B60W 2520/00: Input parameters relating to overall vehicle dynamics - B60W 2530/00: Input parameters relating to vehicle conditions or values, not covered by groups B60W2510/00 or B60W2520/00 - B60W 2552/00: Input parameters relating to infrastructure - B60W 2554/00: Input parameters relating to objects - B60W 2555/00: Input parameters relating to exterior conditions, not covered by groups B60W2552/00, B60W2554/00 - B60W 2720/24: Direction of travel - B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT - G05D: SYSTEMS FOR CONTROLLING OR REGULATING NON-ELECTRIC VARIABLES ## Abstract Technologies and techniques for generating and transmitting control commands for an autonomously driving motor vehicle. A device receives at least surroundings data and vehicle status data, calculates a trajectory on the basis of said data, calculates the control commands required for the implementation of the trajectory and transmits them to at least one actuator. The device includes four sub-systems, wherein a first and a third sub-system operate as master and a second and a fourth sub-system operate as slave. Each of the first/second sub-system receives at least surroundings data and vehicle status data and the third/fourth sub-system transmit at least the control commands to at least one actuator. At least the first/third sub-system are designed to be fail-silent; if individual faults occur in a sub-system, at least one control command is to be generated and transmitted in order to bring the motor vehicle into a safe state. ## Claims ### Claim 1 A device for generating and transmitting control commands for an autonomous motor vehicle, comprising: a first sub-system, configured as a master; a second sub-system, configured as a slave, and operatively coupled to the first sub-system; a third sub-system, configured as a master, and operatively coupled to the first sub-system; and a fourth sub-system, configured as a slave, and operatively coupled to the second sub-system and the third sub-system, wherein the first sub-system and the second sub-system each receive at least surrounding data and vehicle status data, and wherein the third sub-system and the fourth sub-system are configured to transmit control commands for implementing a trajectory of the vehicle to at least one actuator, and wherein at least the first sub-system and the third sub-system are configured to be fail-silent, wherein, in the event of individual faults in any of the sub-systems, a control command is generated and transmitted to bring the motor vehicle into a safe state. ### Claim 2 (depends on 1) The device according to claim 1, wherein the first sub-system and the second sub-system are configured to each calculate at least one trajectory. ### Claim 3 (depends on 2) The device according to claim 2, wherein the first sub-system and the second sub-system are configured to calculate the control commands for the at least one actuator. ### Claim 4 (depends on 1) The device according to claim 1, wherein the second sub-system and/or the fourth sub-system are configured to be fail-silent. ### Claim 5 (depends on 1) The device according to claim 1, wherein, when a double fault is detected that does not affect at least the third sub-system or the fourth sub-system, a control command for an emergency stop is generated by the third sub-system or the fourth sub-system. ### Claim 6 (depends on 1) The device according to claim 1, wherein the control commands for the actuators are calculated and transmitted by the second sub-system and the fourth sub-system during a fault-free operation. ### Claim 7 (depends on 1) The device according to claim 1, wherein the first sub-system is further coupled to the fourth sub-system, and/or the second sub-system is further coupled to the third sub-system. ### Claim 8 (depends on 1) The device according to claim 1, wherein the third sub-system and the fourth sub-system each comprise at least two separate sub-systems. ### Claim 9 A method for generating and transmitting control commands for an autonomous motor vehicle, comprising: configuring a first sub-system and a third sub-system as a fail-silent master; configuring a second sub-system and a fourth sub-system as a slave, the fourth sub-system being operatively coupled to the second sub-system and the third sub-system; receiving at least surrounding data and vehicle status data in the first sub-system and second sub-system; transmitting control commands via the third sub-system and the fourth sub-system for implementing a trajectory of the vehicle to at least one actuator; and generating and transmitting a control command to bring the motor vehicle into a safe state in the event of individual faults in any of the sub-systems. ### Claim 10 (depends on 9) The method according to claim 9, wherein the first sub-system and the second sub-system are configured to each calculate at least one trajectory. ### Claim 11 (depends on 10) The method according to claim 10, wherein the first sub-system and the second sub-system are configured to calculate the control commands for the at least one actuator. ### Claim 12 (depends on 9) The method according to claim 9, wherein the second sub-system and/or the fourth sub-system are configured to be fail-silent. ### Claim 13 (depends on 9) The method according to claim 9, further comprising generating a control command for an emergency stop via the third sub-system or the fourth sub-system when a double fault is detected that does not affect at least the third sub-system or the fourth sub-system. ### Claim 14 (depends on 9) The method according to claim 9, wherein the control commands for the actuators are calculated and transmitted by the second sub-system and the fourth sub-system during a fault-free operation. ### Claim 15 (depends on 9) The method according to claim 9, wherein the third sub-system and the fourth sub-system each comprise at least two separate sub-systems. ### Claim 16 A device for generating and transmitting control commands for an autonomous motor vehicle, comprising: a first sub-system, configured as a fail-silent master; a second sub-system, configured as a slave; a third sub-system, configured as a fail-silent master; and a fourth sub-system, configured as a slave, and operatively connected to the second sub-system and the third sub-system, wherein the first sub-system and the second sub-system each receive at least surrounding data and vehicle status data, and wherein the third sub-system and the fourth sub-system are configured to transmit control commands for implementing a trajectory of the vehicle to at least one actuator, wherein the third sub-system and the fourth sub-system are further configured to selectively generate and transmit control commands that place the motor vehicle into a safe state independently of continued operation of at least one of the first sub-system and the second sub-system. ### Claim 17 (depends on 16) The device according to claim 16, wherein the first sub-system and the second sub-system are configured to each calculate at least one trajectory. ### Claim 18 (depends on 17) The device according to claim 17, wherein the first sub-system and the second sub-system are configured to calculate the control commands for the at least one actuator. ### Claim 19 (depends on 16) The device according to claim 16, wherein the second sub-system and/or the fourth sub-system are configured to be fail-silent. ### Claim 20 (depends on 16) The device according to claim 16, wherein, when a double fault is detected that does not affect at least the third sub-system or the fourth sub-system, a control command for an emergency stop is generated by the third sub-system or the fourth sub-system.