A control system of a vehicle includes a network, a first control module, and a second control module. The first control module measures a voltage of a battery of the vehicle and supplies power from the battery to an actuator of the vehicle based on commands received via the network. The second control module is external to the first control module, transmits the commands to the first control module via the network, and, in response to diagnosing a loss of communication with the first control module, controls an alternator of the vehicle to increase the voltage of the battery. In response to diagnosing a loss of communication with the second control module, the first control module supplies power to the actuator based on predetermined data stored in the first control module.

Method and apparatus for using components of a vehicle. The apparatus includes a computing device and a memory for instructions and an interface for components of the vehicle. The computing device is designed to control the components of the vehicle when the instructions are executed by the computing device. A first component is required for an automated driving mode of the vehicle and a second component are designed in a redundant manner with respect to one another. At least one load of the second component for an automated driving mode is either switched on or at least partially switched off depending on a condition. The condition characterizes the need for redundant operation of the first component and of the second component.

A fault tolerant controller system includes a first controller and a second controller. One of the first and second controllers designated as a primary controller for generating control signals intended to control actuation devices on a vehicle under non-fault operating conditions, and the other of the first and second controllers designated as a secondary controller generating control signals intended to control actuation devices on the vehicle. The actuation devices are responsive only to the designated primary controller. An error is detected in the primary controller and a message is transmitted from the faulty controller to the non-faulty controller identifying the error. The non-faulty controller is subsequently designated as the primary controller. The control signals including an identifier that identifies the non-faulty controller as the designated primary controller. In response to detecting the error, the faulty controller is reset to operate in a safe operating mode as the secondary controller.

A device for carrying out at least one vehicle function, including: a first control unit having a first main unit and a first redundant unit, the first control unit being for controlling a first vehicle function; a second control unit having a second main unit and a second redundant unit, the second control unit being for controlling a second vehicle function; and a first electrical system to connect the first main unit to the second redundant unit and a second electrical system separated from the first electrical system, which for connecting the second main unit to the first redundant unit, the second main unit being for controlling the first redundant unit if the first electrical system fails and/or the first main unit being for controlling the second redundant unit if the second electrical system fails. Also described are a related method, control apparatus, and computer readable medium.

A device for carrying out at least one vehicle function, including: a first control unit having a first main unit and a first redundant unit, the first control unit being for controlling a first vehicle function; a second control unit having a second main unit and a second redundant unit, the second control unit being for controlling a second vehicle function; and a first electrical system to connect the first main unit to the second redundant unit and a second electrical system separated from the first electrical system, which for connecting the second main unit to the first redundant unit, the second main unit being for controlling the first redundant unit if the first electrical system fails and/or the first main unit being for controlling the second redundant unit if the second electrical system fails. Also described are a related method, control apparatus, and computer readable medium.

A method for operating an autonomous vehicle. The method includes the transmission of status data to a processing unit, which is independent of the autonomous vehicle, using a wireless communications link. The method furthermore includes monitoring of the function of the autonomous vehicle by the independent processing unit while taking the status data into account, and when a malfunction of the autonomous vehicle is detected, the independent processing unit determines target data for guiding the autonomous vehicle to a stopping position. The target data are transmitted to the autonomous vehicle, and the autonomous vehicle is guided to the stopping position with the aid of the target data. A position of the autonomous vehicle is determined using signals from the wireless communications link and is taken into account when determining the target data.

A method for operating an autonomous vehicle. The method includes the transmission of status data to a processing unit, which is independent of the autonomous vehicle, using a wireless communications link. The method furthermore includes monitoring of the function of the autonomous vehicle by the independent processing unit while taking the status data into account, and when a malfunction of the autonomous vehicle is detected, the independent processing unit determines target data for guiding the autonomous vehicle to a stopping position. The target data are transmitted to the autonomous vehicle, and the autonomous vehicle is guided to the stopping position with the aid of the target data. A position of the autonomous vehicle is determined using signals from the wireless communications link and is taken into account when determining the target data.

Technologies and techniques for the at least the partially automated driving of a motor vehicle. A first application and at least one redundant second application provide output data depending on motor vehicle operating data and/or environmental data. Vehicle driving data for the at least partially automated driving of the motor vehicle are determined depending on the output data. Vehicle operating data from another vehicle are received, and, depending on the vehicle operating data, the at least one redundant second application switches from an active state to a standby state in which a computer instance of a computer unit used by the at least one redundant second application is at least executed at a lower frequency than in the active state.

A control device is for controlling an autonomous motor vehicle in order to modify a steering angle of a steered wheel of the autonomous motor vehicle and/or a braking force generated by the brake fitted to a wheel of the autonomous motor vehicle. The control device includes an automatic piloting system, which is configured to generate an automatic driving instruction for automatically driving the vehicle, a primary command chain, which includes a primary controller configured to generate a primary command according to the automatic driving instruction, and at least one primary actuator configured to generate a torque that confers a steering angle to the steered wheel, or configured to actuate the brake based on the primary command obtained directly from the primary controller. A secondary command chain is also included.

An on-vehicle control apparatus (130) switches an operating state of an on-vehicle control system (100) from a regular state to a partially checking state in a case where a cyber-attack has been detected in a part of a plurality of driving control apparatuses (110 and 120). The regular state is an operating state in which autonomous driving is performed by using at least one of the plurality of driving control apparatuses. The partially checking state is an operating state in which the autonomous driving is performed by using at least one of normal driving control apparatuses where the cyber-attack has not been detected, and security of each of the driving control apparatuses where the cyber-attack has been detected is checked.