A method for controlling a driving function. In the method, input data relevant for the driving function are conveyed to a cluster, output data are respectively generated by redundant processing of the input data on at least a first processing unit and a second processing unit in the cluster, the respective output data are supplemented by control fields by each processing unit, the output data of the processing units are conveyed to a comparison and a result of the comparison is ascertained, and depending on the result, the output data are utilized on a case-by-case basis together with the respective control fields for the driving function if the output data and control fields bear the comparison, or are marked as erroneous if the output data or control fields deviate.

A method for controlling a driving function. In the method, input data relevant for the driving function are conveyed to a cluster, output data are respectively generated by redundant processing of the input data on at least a first processing unit and a second processing unit in the cluster, the respective output data are supplemented by control fields by each processing unit, the output data of the processing units are conveyed to a comparison and a result of the comparison is ascertained, and depending on the result, the output data are utilized on a case-by-case basis together with the respective control fields for the driving function if the output data and control fields bear the comparison, or are marked as erroneous if the output data or control fields deviate.

Provided is a mobile object control system mounted on a mobile object in which driver assistance control is executed based on information on a to-be-monitored object, comprising a first control system including a first processor configured to acquire information from at least one or more first sensors and to calculate first information on a to-be-monitored object from the acquired information, where the first control system can deliver a calculation result of the first information to a second control system, where the second control system includes a second processor configured to acquire information acquired from at least one or more second sensors different from the first sensors and to calculate second information on a to-be-monitored object based on the calculation result delivered from the first control system and information acquired from the second sensors.

The invention relates to a method for locating a vehicle (1) in a surrounding area, comprising the following steps: providing a primary sensor system (2, 34, 41, 52); providing a secondary sensor system (4, 35, 44, 56), the secondary system being configured in such a manner as to provide a backup to the primary system, the primary sensor system and the secondary sensor system being configured in such a manner as to completely control the vehicle; detecting environment data by means of the primary sensor system and the secondary sensor system; creating maps of the surroundings from the environment data from the primary sensor system and the secondary sensor system by means of a computer system; transferring the maps of the surroundings created from the primary sensor system and the maps of the surroundings created from the secondary sensor system to the computer system; generating at least one plausibility-checked primary sensor system sub-map and at least one plausibility-checked secondary sensor system sub-map by means of the computer system; transferring the plausibility-checked primary sensor system sub-map to the primary sensor system and transferring the plausibility-checked secondary sensor system sub-map to the secondary sensor system; locating the vehicle in the surrounding area by matching the environment data from the primary sensor system with the plausibility-checked primary sensor system sub-map and by matching the environment data from the secondary sensor system with the plausibility-checked secondary sensor system sub-map; comparing the location of the vehicle determined by the primary sensor system with the location of the vehicle determined by the secondary sensor system.

A microcontroller system for safety-critical motor vehicle systems is provided. The microcontroller system includes a plurality of subsystems arranged on a common chip. At least one of the subsystems has more than one channel and is designed to carry out a plurality of operating modes. The subsystems, in a first operating mode, are operated independently of each other and communicate with each other via an on-chip interface. In a second operating mode, at least one of the subsystems is operated by data transmission means and using non-local resources of at least one further subsystem and/or at least one of the subsystems is operating and at least one further subsystem is inactive. A method for operating such a microcontroller system and to the use thereof is also provided.

A microcontroller system for safety-critical motor vehicle systems is provided. The microcontroller system includes a plurality of subsystems arranged on a common chip. At least one of the subsystems has more than one channel and is designed to carry out a plurality of operating modes. The subsystems, in a first operating mode, are operated independently of each other and communicate with each other via an on-chip interface. In a second operating mode, at least one of the subsystems is operated by data transmission means and using non-local resources of at least one further subsystem and/or at least one of the subsystems is operating and at least one further subsystem is inactive. A method for operating such a microcontroller system and to the use thereof is also provided.

A vehicle control system includes a central ECU configured to calculate target outputs of actuators, and relay devices each disposed in a communication path between the central ECU and a corresponding actuator among the actuators. The relay devices include a specific relay device capable of communicating with a specific actuator related to driving control, braking control, or steering control of a vehicle. The specific relay device among the relay devices includes a specific abnormality diagnosis unit configured to diagnose an abnormality in the specific relay device, and a backup calculation unit capable of calculating a control amount of the specific actuator coupled to the specific relay device. A relay device other than the specific relay device among the relay devices does not have a self-diagnosis function.

In one example, a method for resolving sensor conflicts in autonomous vehicles includes monitoring conditions around the autonomous vehicle by analyzing data received from a plurality of sensors, detecting a conflict in the data received from two sensors of the plurality of sensors, sending a first instruction to an auxiliary sensor of the autonomous vehicle that is not one of the plurality of sensors, wherein the first instruction instructs the auxiliary sensor to gather additional data about the conditions around the autonomous vehicle, receiving the additional data from the auxiliary sensor, and making a decision regarding operation of the autonomous vehicle, wherein the decision is based at least in part on the additional data.

Even in a case where an operation abnormality occurs in the arithmetic processing unit of the control device, control is safely shifted to the degeneration control microcomputer, and a vehicle control device capable of improving safety is realized. There are provided an outside world recognition microcomputer 10b, a control microcomputer 11b that outputs a control command to the actuator control device, and a degeneration control microcomputer 12b to which control is shifted in a case where an abnormality occurs in the control microcomputer 11b. The outside world recognition microcomputer 10b calculates a collision potential based on information from the outside world, and determines whether to reset the control microcomputer 11b when an abnormality occurs in the control microcomputer 11b or to shift control to the degeneration control microcomputer 12b.

Even in a case where an operation abnormality occurs in the arithmetic processing unit of the control device, control is safely shifted to the degeneration control microcomputer, and a vehicle control device capable of improving safety is realized. There are provided an outside world recognition microcomputer 10b, a control microcomputer 11b that outputs a control command to the actuator control device, and a degeneration control microcomputer 12b to which control is shifted in a case where an abnormality occurs in the control microcomputer 11b. The outside world recognition microcomputer 10b calculates a collision potential based on information from the outside world, and determines whether to reset the control microcomputer 11b when an abnormality occurs in the control microcomputer 11b or to shift control to the degeneration control microcomputer 12b.