WO2014148976A1

WO2014148976A1 - Device and method for controlling an autonomous vehicle with a fault

Info

Publication number: WO2014148976A1
Application number: PCT/SE2014/050280
Authority: WO
Inventors: Jon Andersson; Joseph Ah-King; Tom NYSTRÖM
Original assignee: Scania Cv Ab
Priority date: 2013-03-19
Filing date: 2014-03-06
Publication date: 2014-09-25
Also published as: SE540269C2; DE112014001059T5; BR112015019996A2; SE1350334A1

Abstract

The invention concerns a device for controlling an autonomous vehicle in connection with a risk of accident. The device comprises a processor unit that is adapted so as to receive one or a plurality of sensor signals S₁-S_k that indicate the state of at least one system or one component in the vehicle. The processor unit is adapted so as to analyze the state based on a first set of rules, and to generate an error signal in dependence upon the results of the analysis, whereupon the error signal indicates a fault in the system or a component, decides on at least one action for the vehicle at least according to a second set of rules for said fault and a third set of rules for the traffic system in which the vehicle is operating; and to generate one or a plurality of control signal(s) SCONTR that realize the action or actions and send SCONTR to at least one control system in the vehicle, whereupon the vehicle is controlled in accordance therewith. The invention also concerns a method for controlling an autonomous vehicle.

Description

Device and method for controlling an autonomous vehicle with a fault

Technical field of the invention

The present invention concerns technology for controlling an autonomous vehicle in a traffic system comprising a plurality of autonomous vehicles according to the introduction to the independent claims.

Background of the invention

A vehicle that can be operated without a driver on the ground is called an

Unmanned ground vehicle (UGV). There are two types of unmanned ground vehicles, those that are remote-controlled and those that are autonomous.

A remote-controlled UGV is a vehicle that is controlled by a human operator via a communication link. All actions are determined by the operator based on either direct visual observation or by means of sensors such as digital video cameras. A remote-controlled toy car is a simple example of a remote-controlled UGV.

There are major variations among remote-controlled vehicles in use today. These vehicles are often used in dangerous situations and environments that are unsuitable for the presence of humans, such as in disarming bombs and in connection with hazardous chemical spills. Remote-controlled unmanned vehicles are also used in connection with surveillance work and the like.

An autonomous vehicle thus refers here to a vehicle that is capable of navigating and maneuvering without human control. The vehicle uses sensors to obtain an understanding of its surroundings. Sensor data are then used by control algorithms to determine what the next step for the vehicle to take is, based on an overarching goal for the vehicle, such as to retrieve and deliver goods at various locations. More specifically, an autonomous vehicle must be able to interpret its surroundings well enough to be able to perform the task it has been assigned, e.g. "move the block of stone from point A to point B via the mine gallery C." The autonomous vehicle needs to plan and follow a route to the selected destination while detecting and avoiding obstacles in its path. The autonomous vehicle must also perform its tasks as quickly as possible, without making mistakes.

Autonomous vehicles have also been developed for use in dangerous

environments, such as in the defense and war industry, and in the mining industry, both open-pit and underground. If people or normal manually controlled vehicles approach the work area of the autonomous vehicles, they normally cause an interruption in the work for safety reasons. The vehicles are ordered to resume their work once the work area is free again.

The vehicle utilizes information about the road, the surroundings and other factors that affect its forward travel in order to automatically control its gas pedal depression, braking and steering. A careful assessment and identification of the planned forward travel is necessary in order to determine whether a route is passable, and necessary to be able to successfully replace human assessments in terms of driving the vehicle.

Road conditions can be complex, and the driver of a normal manned vehicle makes hundred of observations per minute and adjusts the operation of the vehicle based on the perceived road conditions. One aspect of assessing the road conditions is to perceive the road and the surroundings and find a passable route past objects that may be present on the road. The ability to replace the capacity of human perception with an autonomous system involves, among other things, the ability to perceive objects in a precise manner in order to be able to effectively control the vehicle so that it steers past such objects.

The technical methods used to identify an object in connection with the vehicle include the use of one or a plurality of cameras and radar to generate images of the surroundings. Laser technologies, both scanning lasers and fixed lasers, are used to detect objects and measure distances. These are often referred to as LIDAR (Light Detection and Ranging) or LADAR (Laser Detection and Ranging). Various sensors are also used in order to sense velocity and accelerations in various directions. Positioning systems with GPS (Global Positioning System) and other wireless technology can also be used to determine whether the vehicle is, for example, approaching an intersection, a narrowing of the road, and/or other vehicles. Autonomous vehicles are used today as load carriers in, for example, the mining industry, in both open-pit and underground mines. An accident in a bottleneck such as a transport route or in a mine will, in many cases, halt the production chain immediately, resulting in a significant loss of income. In primitive driver- controlled vehicles the driver is usually responsible for listening for unusual sounds and "sensing" the state of the vehicle and, if an imminent accident is suspected, he must immediate drive the vehicle to a safe location where the risk of disruptions in the production system is minimized. For an unmanned

autonomous vehicle, this task poses a challenge. JP-03201 1 1 1 -A describes how a production line can be prevented from being halted by studying the cumulative driven mileage when an autonomous vehicle reaches a station, and determining whether the vehicle is to continue to travel or not, based on the mileage driven. US-201 1/0241862-A1 describes a method and a system for insuring continued operation of a partially autonomous vehicle. A plurality of states is monitored that are necessary for a preferred and reliable use of the partially autonomous vehicle. A fault management and degradation strategy can be initiated that is configured so as to maneuver the vehicle to a preferred state in the even that the driver is unable to control the vehicle manually. The driver is first warned, and the vehicle can then, for example, be maneuvered to the side of the road and stopped.

In a traffic system comprising a plurality of autonomous vehicles, a better system that those described above is needed in order to be able to adapt the control of the autonomous vehicles with major variation so that faults detected in the vehicles will not affect the overall efficiency of the traffic system. The object of the invention is thus to provide an improved system for controlling an autonomous vehicle in a traffic system in connection with a suspected fault in the vehicle, taking into account the overall efficiency of the traffic system. Summary of the invention

According to a first aspect, this object is achieved by means of a device for controlling an autonomous vehicle in connection with a risk of accident according to the introduction to the first independent claim. The device comprises a processor unit that is adapted so as to receive one or a plurality of sensor signals Si-Sk that indicate the state of at least one system or one component in the vehicle. The processor unit is adapted so as to analyze the state based on a first set of rules, and to generate an error signal in dependence upon the result of the analysis, wherein the error signal indicates a fault in at least the system or the component. The processor unit is further adapted so as to determine at least one action for the vehicle at least according to a second set of rules for said fault and a third set of rules for the traffic system in which the vehicle is operating, and to generate one or a plurality of control signal(s) SCONTR that realize the action or actions and send SCONTR to a control system in the vehicle. The vehicle is then controlled in accordance therewith.

Increased overall productivity can be achieved by endowing the vehicle with this functionality, with a view to automatically controlling the vehicle in accordance with a determined action in the event of a risk of production disruption or loss. According to another aspect, the object is achieved with the invention by means of a method for controlling an autonomous vehicle according to the second independent claim.

Preferred embodiments are defined by the dependent claims, which will be described with reference to the accompanying figures.

Brief description of the figures Figure 1 schematically depicts a part of a traffic system, here with three

autonomous vehicles shown.

Figure 2 shows an autonomous vehicle containing a device according to an embodiment of the invention.

Figure 3 shows a device according to an embodiment of the invention.

Figure 4 shows a flow diagram for the method according to an embodiment of the invention.

Detailed description of preferred embodiments of the invention

Figure 1 schematically depicts a traffic system comprising three autonomous vehicles 2 that are advancing along a road. The arrows in the autonomous vehicles 2 indicate their respective directions of travel. The autonomous vehicles 2 can communicate with a control center 1 via, for example, V2I communication (Vehicle-to-lnfrastructure) 3 and/or with one another via, for example, V2V communication (Vehicle-to-Vehicle) 4. This communication is wireless and can occur, for example, via a WLAN protocol (Wireless Local Area Network) IEEE 802.1 1 , such as IEEE 802.1 1 p. Other modes of wireless communication are, however, conceivable. The control center 1 organizes the autonomous vehicles 2 and gives them tasks to perform. When an autonomous vehicle receives a task, the vehicle can independently see to it that the task is performed. A task may consist of, for example, an instruction to retrieve goods at a goods retrieval site A. The vehicle 2 then has the ability to determine its current location, determine a route from the current position to the goods retrieval site A, and take itself there. En route the vehicle must also have the ability to avoid obstacles and manage other autonomous vehicles 2 that may have a more important task and need to be given preference.

Figure 2 shows an autonomous vehicle 2 with a device that will be described next. The device 5 can, for example, be a computer in the vehicle 2, or a control unit (ECU - Electronic Control Unit). The device 5 is adapted so as to communicate with different units and components in the vehicle via one or a plurality of different networks in the vehicle 2, such as a wireless network, via CAN (Controller Area Network), LIN (Local Interconnect Network) or Flexray etc.

Figure 3 shows a device 5 for controlling an autonomous vehicle 2 in connection with a risk of accident. The device 5 comprises a processor unit 6 that is adapted so as to receive one or a plurality of sensor signals Si-Sk that indicate the state of at least one system or one component in the vehicle 2. Sensor signals Si-Sk can come from sensors that monitor systems and/or components in the vehicle, and transferred via any of the networks described above. A system can, for example, be a cooling system, engine system, gearbox, exhaust system or pneumatic system. A component can, for example, be a wheel bearing, a universal joint, a brake drum etc. The one or plurality of sensor signals Si-Sk can, for example, indicate acceleration, temperature, vibrations, frequency, pressure and/or exhaust.

The processor unit 6 is further adapted so as to analyze the state based on a first set of rules, and to generate an error signal in dependence upon the results of the analysis. The error signal indicates a fault in the system or the component. The first set of rules can, for example, include the threshold values for the one or plurality of various sensor signals Si-Sk, depending on the system or component from which they derive. A sensor signal Si can, for example, indicate the engine temperature of the vehicle 2. This engine temperature can then be compared to a threshold value for the engine temperature that should not be exceeded, owing to a risk that the engine will fail. If the temperature exceeds the threshold value, this will be indicated in the error signal. The sensor signals Si-Sk can also contain information about which system or component they are monitoring. In this way, the processor unit 6 can know which analysis is to be performed for each respective sensor signal Si-Sk. Other examples of faults that can be determined include leaking brake fluid from pneumatic systems, hot wheel bearings, leaking coolant, a fault in the exhaust gas purification system, vibrations, unusual noises etc. A fault in the exhaust purification can be determined by sensing and analyzing the exhaust that is coming out of the exhaust system. Vibrations and unusual sounds can be sensed by means of frame-mounted accelerometer. The process or unit 6 can also be adapted so as to perform a more complex analysis. For example, a plurality of sensed parameters can be used to perform a more reliable analysis, and also combined with other vehicle-specific parameters such as which gear is engaged, the number of cogs the gear has, the vehicle velocity etc. For example, when a problem arises in the gearbox, it may first come into the processor unit 6 as a sensed temperature and a sensed frequency in the gearbox. The temperature can be sensed by means of a temperature sensor, and the frequency by means of, for example, an accelerometer. Because the processor unit 6 knows which gear is engaged and how many cogs each gear has, the processor unit 6 can determine the frequency that the gearbox should have. If the sensed frequency exceeds the frequency that the gearbox should have at the same time as the sensed temperature has exceeded a threshold value for the gearbox temperature, it can be deduced from the elevated temperature and the elevated frequency that something is amiss in the gearbox. The error signal can then indicate that there is a fault in the gearbox, and that the gearbox has an elevated frequency and an elevated temperature. Appropriate action can then be taken based on where the fault is localized. The first set of rules can, for example, include prediction methods and/or probability methods for determining whether the system or component will soon break down.

The device 5 can also comprise a computer memory 7 for storing sensor signals Si-S_k over time in order to analyze trends, etc. The computer memory 7 can also contain instructions so that the processor unit 6 will be able to perform the steps described herein. Alternatively, or as a complement, the processor unit 6 can contain memory capacity for storing instructions etc. The processor unit 6 can, for, example, comprise a CPU (Computer Programmable Unit). The processor unit 6 and the computer memory 7 are preferably adapted so as to communicate with one another.

Based on the error signal, the processor unit 6 is then adapted so as to determine at least one action for the vehicle 2 at least according to a second set of rules for the fault and a third set of rules for the traffic system in which the vehicle 2 is operating. The second set of rules for a fault in the system or the component includes rules for which consequence the fault can have for the vehicle 2, depending on which fault has arisen. If the fault is, for example, leaking brake fluid, there is a high risk that the vehicle will, for example, become stalled and block the road for other vehicles. Leaking coolant is also an example of a fault that requires rapid action. The actions are consequently also determined according to a third set of rules for the traffic system in which the vehicle 2 is operating. The third set of rules for the traffic system preferably includes rules for the efficiency of the traffic system, i.e. how the vehicle 2 is to act based on how it is being affected by the fault, taking into account the efficiency of the entire traffic system. In the event that the vehicle 2 is driving along a stretch with heavy traffic, and a fault in the vehicle 2 is detected that entails that the vehicle 2 is at risk of having an acute accident and blocking the traffic, then the vehicle 2 should, according to one embodiment, drive as quickly as possible to a safe location. In the event that the vehicle 2 is driving along a stretch with light traffic when a risk of accident is detected, and it is determined that it would need to drive along a stretch of heavy traffic in order to reach a place where the vehicle 2 can be repaired, it may be more advantageous in terms of the efficiency of the traffic system to let the vehicle 2 break down where it is than to take the risk that the vehicle 2 will begin to travel toward the repair site, break down and block traffic along the stretch with heavy traffic. In the event that the vehicle 2 is in a one-way tunnel when a fault in the vehicle 2 is detected and the vehicle 2 is at risk of breaking down, the vehicle 2 should drive out of the tunnel as quickly as possible to ensure that it is not at risk of blocking the traffic. These rules for the traffic system can be predetermined rules that describe which roads are usually more heavily trafficked, where tunnels are present, where important transportation routes are present, etc. The rules can also include retrieving information about the traffic system, about the traffic in the traffic system etc, and use that information to determine an appropriate action. This can be done via V2V or V2I information, or via an environmental signal SENV that will be described further below. The processor unit 6 is further adapted so as to generate one or a plurality of control signal(s) SCONTR that realize the one or a plurality of actions, and to send the control signals SCONTR to at least one control system 8 in the vehicle 2, whereupon the vehicle 2 is controlled in accordance therewith. In this way the vehicle 2 can act in the best interests of the entire traffic system in the event of a detected fault in the vehicle 2.

An action can, for example, consist of finding a shortest route to a safe location. The control signal SCONTR then indicates a route for the autonomous vehicle 2 to reach a safe location. To find a shortest route to a safe location, the processor unit 6 is adapted so as to receive a position signal SPOS that indicates the position of the vehicle, for example from a GNSS unit (Global Navigation Satellite System) in the vehicle 2. One or a plurality of safe locations can be predetermined, and the processor unit 6 can then be adapted so as to find the nearest safe location based on the position of the vehicle 2. A route can be determined on the basis of, for example, a map of the traffic system, and control signals can be generated so that the vehicle 2 can be controlled so as to take itself there. The rules for the traffic system can, for example, include that the vehicle 2 cannot travel on certain roads when a fault is detected. According to another embodiment, the actions include finding the best route to a safe location from a production standpoint. The control signals SCONTR then indicate a route for the autonomous vehicle 2 to reach said location. For example, the best route from a production perspective may be to take a route around an entire transport route so as not to risk interrupting the shipments.

GNSS is a collective term for a group of worldwide navigation systems that utilize signals from a constellation of satellites and pseudosatellites to enable position measurements for a receiver. The American GPS system is the best-known GNSS system, but others include the Russian GLONASS and the future

European Galileo. The position of the vehicle 2 can also be determined by monitoring signal strengths from a plurality of access points for wireless networks (WiFi) in the vicinity. Another way to determine the position is to measure the number of wheel revolutions and, knowing the circumference of the wheel, determine how far the vehicle 2 has traveled. The position of the vehicle 2 in relation to a map can be determined, and in this way it is possible to know where the vehicle is located at all times.

A safe location can be, for example, a predetermined location in the traffic system where the vehicle 2 can be put without it disturbing other vehicles in the traffic system. It can also be a location where the vehicle 2 can be repaired or visually inspected, automatically or manually. The location can be a building where the entire vehicle 2 is automatically scanned for leaks of various fluids and

photographed with thermal cameras to find areas (wheel bearings, brakes, driveline components) with elevated temperature levels. Data from the scan can then be communicated to the vehicle 2 or the control center 1 , which

subsequently, in combination with vehicle-internal data already downloaded, can make decisions as to whether it is possible to continue working. The processor unit 6 can thus be adapted so as to receive these data, and to analyze and make decisions based on these data as well. Alternatively, the control center 1 can make a decision based on data from the scan plus, optionally, any sensor signals Si-S_k or an analysis already performed in the processor unit 6 and communicated via V21 to the control center 1 . To this end, the device can be equipped with a unit 9 for wireless communication, which unit is adapted so as to receive data from the processor unit 6 and generate wireless signals 3 that the control center 1 can receive. The unit for wireless communication can also be adapted so as to receive wireless signals 3 containing data and transfer said data to the processor unit 6. This decision can then be communicated back to the vehicle 2. Scanning can also, or instead, occur at scheduled times.

The actions can also include determining an advantageous velocity for the autonomous vehicle 2. In the event that the detected fault was excessively hot wheel bearings, as described above, it is feasible for the vehicle in which the fault was detected to drive slowly in order to reach its final destination. However, a higher velocity may be better in terms of the efficiency of the entire traffic system. In the event that the fault is found to be leaking coolant or leaking brake fluid, the velocity of the vehicle 2 must, according to one embodiment, be as high as the vehicle 2 and the traffic system allow. If the vehicle 2 must travel along a road with other vehicles, the vehicle 2 can adapt its velocity based on the velocity of the other vehicles so as not to block the traffic.

The processor unit 6 can also be adapted so as to take into account the distance to the safe location in determining an advantageous velocity for the autonomous vehicle 2. The processor unit 6 can then be adapted so as to determine the distance to the safe location based on the determined route thither. The

determined route is determined based on information about the position of the vehicle, information about where the safe location is, cartographic information, and the third set of rules for the traffic system in which the vehicle 2 is operating. In the event that an excessively high engine temperature has been determined and it is a short distance to the safe location, i.e. a length of road lower than a predetermined limit value, the vehicle 2 can have a proportionally higher velocity than would be the case if the distance to the safe location were greater.

According to one embodiment, the processor unit 6 is also adapted so as to receive an environmental signal SENV that indicates at least one environmental parameter, whereupon a decision regarding at least one action is based on said at least one environmental parameter. The environmental parameter can, for example, comprise information about the number of vehicles along a given route, the road surface, temperature, traffic accidents etc. This information can then be incorporated into the decision regarding action. The environmental signal SENV can, for example, be a wireless signal from another vehicle, from the control center 1 or from a roadside unit adapted for wireless communication. The environmental signal SENV can then be received in the unit 9 for wireless communication. The environmental signal SENV can instead come from a sensing unit in the vehicle 2, such as a camera unit, a laser unit, a radar unit or a temperature unit etc. The information that these units generate can be analyzed, for example in each respective unit, in a separate analysis unit and/or in the processor unit 6 in order to generate one or a plurality of environmental parameters. The environmental signal SENV can also be an integrated signal that contains information from a plurality of the aforementioned units. According to one example, the processor unit 6 receives a sensor signal Si that indicates a temperature of a wheel bearing. This temperature is analyzed according to a first set of rules, which in this case entail comparing the

temperature of the wheel bearing to a predetermined threshold value for the temperature of the wheel bearing. In the event that the temperature of the wheel bearing is greater than the threshold value, an error signal is generated that indicates that the wheel bearing temperature is too high. The processor unit 6 is then adapted so as to decide upon an action for the vehicle based on how the high temperature of the wheel bearing will affect the vehicle 2 according to the second set of rules for the fault and the third set of rules for the traffic system in which the vehicle 2 is operating. The second set of rules can, for example, indicate that the overly high temperature in the wheel bearing poses no risk of an immediate stop of the vehicle 2, but that there is a risk that the vehicle 2 will break down later on, and the wheel bearing should be replaced. The velocity of the vehicle 2 should also be kept low. In the event that the vehicle 2 is, for example, on a road where it is not disturbing another vehicle, then the third set of rules may indicate that the velocity of the vehicle 2 is to be adjusted to a low velocity, and that a fastest route to a safe location is to be determined. The actions for adjusting the velocity of the vehicle 2 to a low velocity and finding a fastest route to a safe location can then be determined. In the event that the vehicle 2 is instead located in the middle of an important production line with heavy traffic, the third set of rules may indicate that the velocity of the vehicle 2 must be adapted based on the velocity of the other vehicles so as not to disturb production. The actions for adjusting the velocity of the vehicle 2 to a velocity adapted based on the other vehicles and finding a route to a safe location that will not disturb the production line can then be determined. The processor unit can be adapted according to the third set of rules so as to match the position of the vehicle 2 with information about where production lines, tunnels, heavy traffic etc are present, and in this way determine whether the vehicle 2 is at risk of disrupting the efficiency of the traffic system.

The invention also concerns a method for controlling an autonomous vehicle 2, which method will now be illustrated with reference to the flow diagram in Figure 4. The method comprises a first step A1 ), which comprises receiving one or a plurality of sensor signals Si-Sk that indicate the state of at least one system or one component in the vehicle 2. Sensor signals Si-Sk can, for example, indicate acceleration, temperature, vibrations, frequency, pressure and/or exhaust etc. In a second step A2) the state is analyzed based on a first set of rules, and an error signal is generated in dependence upon the results of the analysis, whereupon the error signal indicates a fault in said at least one system or one component. In a third step A3) at least one action is decided upon for the vehicle 2 at least according to a second set of rules for the fault and a third set of rules for the traffic system in which the vehicle 2 is operating. According to one

embodiment, the set of rules for the traffic system includes rules for the efficiency of the traffic system. The decision can also be based on an environmental parameter from an environmental signal SENV- The method can then, in step A1 ), also comprise receiving this environmental signal SENV that indicates an

environmental parameter. In a fourth step A4) the vehicle 2 is controlled in accordance with the action or actions.

According to one embodiment, the actions include finding a shortest way to a safe location. According to another embodiment, the actions include finding the best route to a safe location from a production standpoint. Actions can also include determining an advantageous velocity for the autonomous vehicle. The distance to the safe location can be taken into account in determining an advantageous velocity for the autonomous vehicle. Examples and advantages of these embodiments have been clarified in connection with the device.

The invention also concerns a computer program P for an autonomous vehicle, wherein the computer program P contains program code for enabling the device 5 to perform the steps according to the method. Figure 3 shows the computer program P as a part of the computer memory 7. The computer program P is thus stored in the computer memory 7. The computer memory 7 is connected to the processor unit 6 and, when the computer program P is executed by the processor unit 6, at least parts of the methods described herein are performed. The invention further comprises a computer program product containing program code stored on a computer-readable medium for performing the method steps described herein when the program code is run on the device 5. The present invention is not limited to the preferred embodiments described above. Various alternatives, modifications and equivalents can be used. The foregoing embodiments are consequently not to be viewed as limiting the protective scope of the invention, which is defined in the accompanying claims.

Claims

1 . A device (5) for controlling an autonomous vehicle (2) in connection with a risk of accident, wherein the device (5) comprises a processor unit (6) that is adapted so as to receive one or a plurality of sensor signals Si-Sk that indicate the state of at least one system or one component in the vehicle (2);

c h a r a c t e r i z e d i n t h a t the processor unit (6) is adapted so as to:

- analyze said state based on a first set of rules, and generate an error signal in dependence upon the results of the analysis, whereupon the error signal indicates a fault in said at least one system or one component;

- determine at least one action for the vehicle at least according to a second set of rules for said fault and a third set of rules for the traffic system in which the vehicle (2) is operating; wherein said third set of rules for the traffic system includes rules for the efficiency of the traffic system;

- generate one or a plurality of control signal(s) SCONTR that realize said action(s);

- send said control signal(s) SCONTR to at least one control system (8) in the vehicle (2), whereupon the vehicle (2) is controlled in accordance therewith.

2. A device according to claim 1 , wherein the processor unit (6) is also adapted so as to receive an environmental signal SENV that indicates at least one environmental parameter, whereupon said determination regarding at least one action is also based on said at least one environmental parameter.

3. A device according to claims 1 or 2, wherein said actions include finding a shortest route to a safe location, wherein said control signals SCONTR indicate a route for the autonomous vehicle (2) to reach a safe location.

4. A device according to any of claims 1 to 2, wherein said actions include finding the best route to a safe location from a production standpoint, wherein said control signals SCONTR indicate a route for the autonomous vehicle (2) to reach a safe location.

5. A device according to any of claims 3 or 4, wherein said actions also include determining an advantageous velocity for the autonomous vehicle (2).

6. A device according to claim 5, wherein said processor unit (6) is adapted so as to also take the distance to the safe location into account when determining an advantageous velocity for the autonomous vehicle (2).

7. A device according to any of the preceding claims, wherein said one or a plurality of sensor signals Si-Sk indicate acceleration, temperature, vibrations, frequency, pressure and/or exhaust.

8. A method for controlling an autonomous vehicle (2), which method comprises the steps of

- receiving one or a plurality of sensor signals Si-Sk that indicate the state of at least one system or one component in the vehicle (2);

- analyzing said state based on a first set of rules, and generating an error signal in dependence upon the results of the analysis, whereupon the error signal indicates a fault in said at least one system or one component;

- determining at least one action for the vehicle (2) at least according to a second set of rules for said fault and a third set of rules for the traffic system in which the vehicle (2) is operating; wherein said third set of rules for the traffic system includes rules for the efficiency of the traffic system;

- controlling the vehicle (2) in accordance with the action or actions.

9. A method according to claim 8, which comprises the step of receiving an environmental signal SENV that indicates an environmental parameter, whereupon said decision regarding at least one action is also based on said environmental parameter.

10. A method according to any of claims 8 to 9, wherein said actions include finding a shortest route to a safe location.

1 1 . A method according to any of claims 8 to 10, wherein said actions include finding a best route to a safe location from a production perspective.

12. A method according to any of claims 8 to 1 1 , wherein said actions also include determining an advantageous velocity for the autonomous vehicle.

13. A method according to claim 12, which also comprises taking the distance to the safe location into account when determining an advantageous velocity for the autonomous vehicle.

14. A method according to any of claims 8 to 13, wherein said one or a plurality of sensor signals Si-Sk indicate acceleration, temperature, vibrations, frequency, pressure and/or exhaust.

15. A computer program (P) for an autonomous vehicle, wherein said computer program (P) contains program code for enabling a device (5) to perform the steps according to any of claims 8-14.

16. A computer program product comprising a program code stored on a computer-readable medium for performing the method steps according to any of claims 8-14 when said program code is run in a device (5).