Provided is an autonomous driving assistance system for vehicles that has redundancy without posing any problem in diversity. The autonomous driving assistance system includes: a sensor configured to acquire surroundings information; a downstream device including an actuator configured to control a vehicle; and a driving assistance device configured to calculate a control amount for the downstream device on the basis of the surroundings information. The downstream device further includes a diagnosis unit configured to: perform comparison between at least two control amounts that include the control amount calculated in the driving assistance device and a control amount calculated in the downstream device on the basis of the surroundings information; and determine, if the control amounts are equal to each other, that the control amounts are normal, and determine, if the control amounts are different from each other, that the control amounts are abnormal.

A device for controlling an automated driving operation of a vehicle may have at least two brake systems, at least two steering systems, an engine controller, a first automated drive controller, a second automated drive controller, a surroundings sensor assembly, and inertial sensors. A third automated drive controller at least controls the vehicle into a standstill. The device is configured such that the automated driving operation is initiated and/or maintained only when the brake systems, steering systems, and at least two of the automated drive controllers are functional and such that the automated driving operation is interrupted if only one of the automated drive controllers is functional and/or if one of the brake systems and/or steering systems is not functional and/or if the engine controller is not functional, in which case the still functional automated drive controller assumes control of the vehicle and guides the vehicle into a standstill.

A device for controlling an automated driving operation of a vehicle may have at least two brake systems, at least two steering systems, an engine controller, a first automated drive controller, a second automated drive controller, a surroundings sensor assembly, and inertial sensors. A third automated drive controller at least controls the vehicle into a standstill. The device is configured such that the automated driving operation is initiated and/or maintained only when the brake systems, steering systems, and at least two of the automated drive controllers are functional and such that the automated driving operation is interrupted if only one of the automated drive controllers is functional and/or if one of the brake systems and/or steering systems is not functional and/or if the engine controller is not functional, in which case the still functional automated drive controller assumes control of the vehicle and guides the vehicle into a standstill.

A vehicle control system has a first communication network, a first operation component, a first vehicle control unit connected to the communication network and to the first operation component, wherein the first vehicle control unit is configured to control a first data connection between the first operation component and the first vehicle control unit by a first signal to the first operation component, and a second vehicle control unit connected to the first operation component, wherein the second vehicle control unit is configured to control a second data connection between the first operation component and the second vehicle control unit by a second signal to the first operation component. The first data connection and the second data connection can be controlled so that at least one of the first data connection and the second data connection is enabled or disabled.

A vehicle control system has a first communication network, a first operation component, a first vehicle control unit connected to the communication network and to the first operation component, wherein the first vehicle control unit is configured to control a first data connection between the first operation component and the first vehicle control unit by a first signal to the first operation component, and a second vehicle control unit connected to the first operation component, wherein the second vehicle control unit is configured to control a second data connection between the first operation component and the second vehicle control unit by a second signal to the first operation component. The first data connection and the second data connection can be controlled so that at least one of the first data connection and the second data connection is enabled or disabled.

An example operation includes one or more of determining a sensor on a transport is not functioning properly, determining a severity of the malfunction, responsive to the severity exceeding a threshold, lowering an autonomous level of the transport, and responsive to the severity continuing to exceed the threshold, limiting an operation of the transport based on an intended output of the malfunctioning sensor.

A storage device (301) stores a failure correspondence table (405) that indicates a countermeasure for a time when a failure occurs in an apparatus mounted on a vehicle (100). A failure countermeasure update unit (404) updates the countermeasure indicated in the failure correspondence table (405) in accordance with a change in a traveling environment of the vehicle (100).

A high voltage traction system for a vehicle includes two independently controllable power sub-systems being a powertrain power sub-system, PPS, and a vehicle power sub-system, VPS. The PPS comprising a plurality of PPS secondary power consumers and a PPS master controller being configured to arbitrate power limits among the PPS secondary power consumers by a first arbitration logic, and the VPS comprising a plurality of VPS secondary power consumers and a VPS master controller being configured to arbitrate power limits among the VPS secondary power consumers by a second arbitration logic, different to the first arbitration logic. A master interface is between the PPS master controller and the VPS master controller enabling communication exchange between the PPS and VPS including system-shared instructions of prioritization of the PPS and VPS secondary power consumers limiting the first arbitration logic and/or the second arbitration logic in a limited state.

A vehicle control system includes a first actuator that is configured to perform at least any of driving, braking, or steering of a host vehicle, a first controller that is configured to perform traveling control of the host vehicle by controlling the first actuator, a second actuator that is configured to perform at least any of driving, braking, or steering of the host vehicle, a second controller that is configured to perform traveling control of the host vehicle by controlling the second actuator, and a communication line that is interposed between the first controller and the second controller. The first controller is configured to determine whether an operating state of the first actuator satisfies a predetermined condition, and limit, in a case where it is determined that the operating state of the first actuator satisfies the predetermined condition, control of the first actuator as compared to a case where it is determined that the predetermined condition is not satisfied, and transmits a predetermined signal to the second controller through the communication line, and in a case where the predetermined signal is received from the first controller through the communication line, the second controller performs traveling control of the host vehicle in place of at least a portion of a function of the first controller by controlling the second actuator.

The invention relates to a method for the dynamic, context-based distribution of program codes in a control system of a vehicle. The control system has a plurality of control apparatuses for executing the program codes. The program codes are assigned to the corresponding control apparatuses of the control system by a global placement graph. In doing so, the global placement graph is calculated in a computing unit that is located outside of the control system. The data of the global placement graph are transmitted to the control system. It is provided for the global placement graph to be calculated based on the current configuration as well as known reconfigurations, wherein the selection of the next node of the global placement graph to be calculated is calculated using the probability of occurrence of an error as well as the effect of the error.