DE102019115330A1 - Real-time safety path generation for highly automated vehicle fallback maneuvers - Google Patents

Abstract

In order to bring an at least partially automated vehicle (1) into a state of minimal danger, the surroundings (5) of the vehicle (1) are monitored by means of a sensor system (3) during a normal operating mode. A control unit (4) is used to determine a safety trajectory during the normal operating state as a function of a result of the monitoring. A triggering event is detected and, in response to the triggering event, the vehicle is switched from the normal operating state to a safety mode and the vehicle (1) is controlled in such a way that it automatically follows the safety trajectory.

Description

The present invention relates to a method for bringing an at least partially automated vehicle into a state of minimal danger, the surroundings of the vehicle being monitored by means of a sensor system of the vehicle during a normal operating mode of the vehicle. The invention also relates to a corresponding electronic vehicle control system and a computer program as well as a computer-readable storage medium.

For an automated vehicle, for example with a level of automation 4th or stage 5 According to the SAE J3016 classification, it may be necessary that the vehicle is brought into a safety position, for example if one of its systems is defective.

document US 9927810 B1 relates to a system for mapping safe parking areas for an automated vehicle. A digital map shows a route and a safe stopping zone adjacent to the route. The control unit is set up to navigate the host vehicle into the safe stopping zone in the event of an emergency.

According to known approaches, if the system reacts when navigating to a safe zone, a delay can occur between the occurrence of the emergency situation and the start of the navigation, which leads to a reduced overall degree of safety.

It is therefore an object of the present invention to provide an improved concept for bringing an at least partially automated vehicle into a state of minimal risk, which offers greater safety.

The improved concept is based on the idea of determining a safety trajectory during a normal operating mode of the vehicle and, in the event of a triggering event, of controlling the vehicle in such a way that it follows the previously determined safety trajectory.

According to a first independent aspect of the improved concept, a method is provided for bringing an at least partially automated vehicle into a state of minimal danger. The surroundings of the vehicle are monitored by means of a sensor system of the vehicle during a normal operating state of the vehicle, in particular an electronic vehicle control system of the vehicle. A safety trajectory is determined by means of a control unit of the vehicle or the vehicle control system during the normal operating mode as a function of a result of the monitoring, in particular continuously or periodically during the normal operating mode. A triggering event is detected by means of the control unit and, in response to the triggering event, the vehicle is switched from the normal operating mode to a safety mode of the vehicle or of the vehicle control system. The vehicle is controlled by means of the control unit in such a way that it automatically follows the safety trajectory during the safety mode, in particular a current safety trajectory or a last safety trajectory determined during the normal operating mode.

The at least partially automated vehicle is in particular a highly automated vehicle according to level 4 of the SAE J3016 classification or a fully automated vehicle according to level 5 of the SAE J3016 classification.

For example, the minimum hazard state includes a safe position for the vehicle. That is, the vehicle can be in the minimum hazard state, ZMG, when the vehicle is in the safe position. The safe position can be, for example, a position of the vehicle near a lane boundary of a lane on which the vehicle is traveling.

Expressions such as “during normal operation / safety mode” can be understood as “while normal operation / safety mode is activated”. That is to say, the vehicle and / or the vehicle control system are operated in the respective mode, while the respective method steps labeled “during normal operating / safety mode” are carried out.

The monitoring of the environment includes in particular the generation of a representation or an image of the environment or a part of the environment, for example a part of the environment that corresponds to a field of view of the sensor system, and a continuous or periodic updating of the image of the environment or the part of the environment.

In a similar way, the result of the monitoring can be understood as the continuous or periodically updated representation or mapping of the surroundings or a part of the surroundings, for example in the form of a camera image or a point cloud. The monitoring carried out continuously or periodically can be understood, for example, to mean that the image or representation of the environment is updated with a predefined sampling rate.

The point cloud comprises at least three-dimensional spatial coordinates for each point and can be generated, for example, by an active optical sensor system, such as a lidar system.

The normal operating mode of the vehicle can be understood as regular, error-free operation of the vehicle or the electronic vehicle control system in such a way that all or at least all of the essential functionalities for executing the highly or fully automated driving are available. During the normal operating mode, it is intended that the vehicle control system will at least partially automatically drive the vehicle. That is, the vehicle control system operates in its predefined driving operating range during the normal operating mode.

The safety mode corresponds in particular to a mode during which the vehicle is to be brought into the ZMG due to the occurrence of the triggering event.

The triggering event can include, for example, an occurrence of an emergency situation, an error or a defect, in particular an error or a defect in the vehicle or the vehicle control system, in particular an error or a defect that impairs a functionality that is used or is required in order to keep the vehicle high - or perform fully automatic driving.

The determination of the safety trajectory depending on the result of the monitoring can, for example, determine the ZMG, in particular the safe position, depending on the image or the representation that is continuously updated by the sensor system, in particular the continuous or periodic determination of the safe position, and that in particular continuously or periodically compute a set of parameters to guide the vehicle to the safe position or into the ZMG. The set of parameters can be understood, for example, to represent the safety trajectory.

The ZMG, in particular the safe position, corresponds to a destination, a destination or an end position of the safety trajectory, in particular a path profile of the safety trajectory. The path profile includes, in particular, a set of spatial positions that the vehicle is to follow. Furthermore, the safety trajectory can include, for example, a set of speeds that can be referred to as a speed profile.

Since the safety trajectory is determined in particular continuously or periodically during normal operating mode, and in particular the actual occurrence or detection of the triggering event is not awaited, the method according to the improved concept allows a faster reaction to the triggering event. Therefore, the ZMG or the safe position can be reached in a shorter time or in a more comfortable or safer way. Therefore, an overall security can be increased by a method according to the improved concept.

In particular, the sensor system according to the improved concept essentially only has to include one type of sensor, for example an environmental sensor, and does not need to include an inertial sensor or the like in order to fulfill the functionality described. In particular, the improved concept is not based on map information or does not need a localization function, such as support for a global navigation satellite system or the like. Correspondingly, the method according to the improved concept can also function in the event of a fault in several sensors or functionalities of the vehicle. That is also why security is increased.

According to at least one embodiment of the method according to the improved concept, the path profile for the vehicle is determined in order to determine the safety trajectory.

The path profile includes, in particular, a set of points within the surroundings of the vehicle, in particular along or on a roadway on which the vehicle is traveling. The set of points describes a route that the vehicle should follow in order to safely reach the safe position or the ZMG.

The path profile can include, for example, a first section and a second section that follows the first section. The first section can describe a lateral change in a position of the vehicle, that is to say a lateral position of the vehicle with respect to the lane or a lane boundary. For example, the first section can describe a path from the initial position of the vehicle, when the triggering event is detected, to a position at a predetermined safe distance from the lane boundary. The second section can, for example, describe a path that follows a profile of the roadway or the roadway boundary at an at least substantially constant distance from the roadway boundary.

The path profile can, for example, correspond to a polynomial curve or a part thereof, for example a polynomial curve of the fifth degree. By determining the path profile, a spatial path that the vehicle should follow in the safety mode is determined and already in the Normal operating mode defined in order to allow an immediate reaction to the detection of the triggering event.

According to several embodiments, coefficients of a polynomial, in particular a polynomial of the fifth degree, are determined based on the result of the monitoring, and in particular based on a large number of input parameters. The path profile is determined based on the coefficients of the polynomial.

The input parameters can include, for example, initial input parameters which correspond to the respective parameters at an initial point in time when the triggering event is detected and the vehicle is switched from the normal operating mode to the safety mode. The initial parameters can include, for example, a lateral initial position which is given by a distance of the vehicle from the lane boundary at the initial point in time. The initial parameters can include an initial speed, which is given by a speed of the vehicle at the initial point in time. The initial parameters can also include an initial time offset, which can be, for example, zero or any other predefined constant time.

The input parameters can also include one or more end parameters which correspond to parameters after the path profile or the safety trajectory has ended and the vehicle has reached a safe position or a ZMG. The end parameters are in particular desired end parameters and can therefore be predefined and known when the coefficients of the polynomial are determined. The end parameters can include, for example, a desired lateral end position which corresponds to the distance of the vehicle in the ZMG, in particular the safety distance. The end parameters can include a desired end speed, which is given by a desired speed of the vehicle in the ZMG, and can be zero, for example. The final parameters can include a desired final acceleration that is given by a desired acceleration of the vehicle in the ZMG, which can also be zero. The end parameters can also include a desired end time, which is given by the start time plus a desired duration of the path profile.

For example, the coefficients of the polynomial are recalculated once or several times during the safety mode, in particular if the speed of the vehicle changes during the safety mode, in particular while it is following the safety trajectory. The recalculation can be carried out, for example, based on the respective current coefficients of the polynomial, one or more of the input parameters and one or more input parameters. The further input parameters can include an elapsed time, which corresponds to the time period at the point in time of the recalculation with respect to the start time. In addition to the current coefficients and the elapsed time, the recalculation can be based on the desired lateral end position and time.

By determining the path profile based on the coefficients of the polynomial, the path profile can be adapted to a required evenness of the path, which corresponds to a desired comfort level for the driver, and / or can be adapted to available known parameter values for the calculation.

In particular, it has been shown that a fifth-degree polynomial offers a good compromise between a desired flatness of the path and a relatively low set of parameters to be determined. Higher order polynomials would require more independent known parameters that may not be available and would provide only limited improvement in flatness.

According to some implementations, a speed profile for the vehicle is determined to determine the safety trajectory.

The speed profile can contain a set of speed values or changes in the speed values so that the vehicle can safely enter the ZMG. In particular, the speed profile can contain a time series of speed values or speed change values which the vehicle should follow in order to safely reach the ZMG.

In particular, the speed profile can be related to the path profile in such a way that, for example, each point of the path profile corresponds to a value of the speed profile.

According to some embodiments, a set of data points that describe the environment is generated as the result of the monitoring, in particular by means of the sensor system. Each of the data points includes respective spatial coordinates of a point in the environment, in particular a sampling or data point. In particular, the set of data points can be viewed as a point cloud.

The set of data points can in particular be generated by means of an active optical sensor system, for example a lidar system. An active optical sensor can be used as such be defined in that it includes a light source for emitting light pulses and a light detector for detecting light, in particular for detecting reflected parts of the emitted light pulses. The active optical sensor system is set up in particular to generate one or more sensor signals based on the detected part of the light. The term “light” can be understood to include electromagnetic waves in the visible range, in the infrared range and / or in the ultraviolet range. Accordingly, the term “optical” can be understood to refer to light in this sense.

In particular, the active optical sensor system or lidar system can emit the light pulses with different emission angles or directions and in this way can scan part of the surroundings, in particular a field of view of the active optical sensor system. For each emission direction, a sampling point is recorded according to a data point of the set of data points.

Points of the set of data points can be classified as described, for example, by means of a cluster algorithm which can be based on artificial intelligence or a machine learning algorithm. By means of the classification, objects within the environment, for example the road delimitation, can be identified, localized and / or, in particular in the case of moving objects, tracked.

According to some embodiments, each data point of the set of data points comprises respective color coordinates of the point of the surroundings.

An analysis result or a classification result can be improved by means of the color coordinates and the assigned color information of the respective point in the environment.

According to some implementations, the data points of the set of data points are analyzed by the control unit in order to determine a subset of static data points of the set of data points. The spatial coordinates of each of the static data points correspond to respective spatial coordinates of a static point in the vicinity.

A static point can be understood in particular as a point that does not move in an environmental coordinate system, in particular a roadway coordinate system. Thus the static point does not move with respect to the surroundings or the roadway.

The analysis of the data points can include, for example, filtering or classifying the set of data points such that each of the data points is identified as a static data point or as a moving data point, i.e. a data point corresponding to a point which is relative to the surrounding coordinate system moved, or as a data point of unknown type, i.e. a data point that cannot be classified as moving or static with sufficient probability.

The classification of the set of data points can, for example, be based on evidence theory, which can take into account, for example, measurements of the movement of the vehicle, such as acceleration measurements, rotational speed measurements or speed measurements.

According to some embodiments, the subset of static data points which describe respective static points or objects in the environment is generated as the result of the monitoring or the safety trajectory is determined during the normal operating mode as a function of the subset of static data points.

By only taking into account the static objects or static data points for determining the safety trajectory, irrelevant objects for determining the safe position can be filtered out or discarded. Moving objects or potentially moving objects such as unknown objects cannot be considered to represent a safe position.

According to some embodiments, the lane boundary is determined by the control unit based on the result of the monitoring, for example based on the set of data points, in particular on the subset of static data points. The safety trajectory, in particular the path profile and / or the speed profile, is determined as a function of the lane boundary.

The determination of the lane boundary includes in particular the ascertainment or determination of a set of coordinates of the lane boundary and / or a mathematical or geometrical description or approximation of the lane boundary. The determination of the lane boundary can for example include the determination of a polynomial approximation to the lane boundary, for example a polynomial approximation of the fourth degree.

By determining the lane boundary, in particular the position or the geometric shape of the lane boundary, the ZMG or the safe position can be determined. In particular, the safe position can be close to or on the Be the lane boundary, in particular in the safety distance from the lane boundary.

According to some embodiments, the vehicle is controlled during a first phase of the safety mode in order to reduce a distance between the vehicle and the lane boundary, in particular by following the path profile until the distance is equal to the predefined safety distance.

In particular, the safety trajectory is determined during the normal operating mode such that the vehicle is guided to the safety distance from the lane boundary during the safety mode by following the path profile.

The speed of the vehicle according to the speed profile can for example be constant during the first phase. Alternatively, the speed of the vehicle can be controlled by the vehicle control system or the control unit as in the normal operating mode. In the latter case, the speed profile is not active during the first phase, for example.

During the first phase, the vehicle can be removed from a normal driving position on the road, in particular it is removed from normal traffic while the safety distance from the lane boundary is still maintained.

According to some embodiments, the speed of the vehicle is reduced to a predetermined minimum speed, for example zero, during a second phase of the safety mode, in particular after the first phase. In particular, the speed is reduced to a predefined minimum speed by following the speed profile.

In particular, the trajectory is determined during the normal operating mode such that the speed of the vehicle can follow the speed profile up to the minimum speed during the safety mode. The speed profile can be active during the second phase, for example. The lateral distance of the vehicle from the lane delimitation can for example be approximately constant during the second phase.

According to some embodiments, a transition from the first phase to the second phase is carried out by means of the control unit during an adaptation phase of the safety mode, the adaptation phase being between the first and the second phase. During the adaptation phase, the distance from the lane boundary and / or the speed of the vehicle can be stabilized.

According to some embodiments, a fault or defect in an electronic vehicle control system of the vehicle, which comprises the sensor system and the control unit, is detected as the triggering event.

The error or the defect can include, for example, an error or defect in the vehicle control system that affects normal control of the automated vehicle, in particular a main control.

According to some implementations, a predetermined end of an automated driving period is detected as the triggering event.

The predefined end of the automatic driving period can include that the vehicle or the electronic vehicle control system arrives at one end of the driving operating range, in particular followed by the failure of the user of the vehicle to respond to a takeover request from the vehicle control system.

If the automated driving period has ended or the fault or defect in the vehicle control system has been detected, it may be necessary to bring the vehicle into the safe position or the ZMG.

According to a further independent aspect of the improved concept, an electronic vehicle control system with a sensor system and a control unit is provided. The sensor system is set up to monitor the surroundings of an at least partially automated vehicle during a normal operating mode of the vehicle control system. The control unit is set up to determine a safety trajectory during the normal operating mode as a function of a result of the monitoring. The control unit is configured to detect a triggering event and, in response to the triggering event, to switch the vehicle control system from the normal operating mode to a safety mode. The control unit is further configured to control the vehicle in such a way that it automatically follows the safety trajectory during the safety mode in order to bring the vehicle into a state of minimal danger.

According to some embodiments of the electronic vehicle control system, the sensor system includes an active optical sensor system, for example a lidar system or a camera system, which is set up to include a set of Generate data points describing the environment as the result of the monitoring.

According to some embodiments, the active optical sensor system comprises at least two active optical sensors that have different fields of view.

In this way, the overall field of view of the sensor system can be expanded and the accuracy of the lane delimitation improved. Furthermore, the determination of the safe position can be accelerated.

Further designs of the electronic vehicle control system according to the improved concept result directly from the various designs of the method for bringing a vehicle into a state of minimal danger and vice versa. In particular, the electronic vehicle control system can be set up or programmed to execute a method according to the improved concept, or the vehicle control system executes a method according to the improved concept.

According to a further independent aspect of the improved concept, a vehicle, in particular an at least partially automated vehicle, is provided which comprises an electronic vehicle control system according to the improved concept.

According to a further independent aspect of the improved concept, a computer program is provided, the computer program containing instructions which, when the computer program is executed by an electronic vehicle control system according to the improved concept, in particular by a control unit of the electronic vehicle control system, cause the vehicle control system to execute a Carry out method according to the improved concept.

According to a further independent aspect of the improved concept, a computer-readable medium is provided, the storage medium storing a computer program according to the improved concept.

Further features of the invention emerge from the claims, the figures and the description of the figures. The features and combinations of features mentioned above in the description as well as the features and combinations of features mentioned below in the description of the figures and / or shown alone in the figures can be used not only in the specified combination, but also in other combinations without departing from the scope of the invention . There are thus also embodiments of the invention to be considered as encompassed and disclosed, which are not explicitly shown and explained in the figures, but emerge from the explained embodiments and can be generated by separate combinations of features. Designs and combinations of features are also to be regarded as disclosed, which therefore do not have all the features of an originally formulated independent claim. In addition, designs and combinations of features, in particular through the statements set out above, are to be regarded as disclosed which go beyond the combinations of features set forth in the back references of the claims or differ from them.

• 1 ein Flussdiagramm einer beispielhaften Ausführung eines Verfahrens gemäß dem verbesserten Konzept;
• 2 schematisch einzelne Verfahrensschritte einer weiteren beispielhaften Ausführung eines Verfahrens gemäß dem verbesserten Konzept;
• 3 ein Fahrzeug, welches eine beispielhafte Ausführung eines elektronischen Fahrzeugsteuerungssystems gemäß dem verbesserten Konzept umfasst;
• 4 schematisch einzelne Verfahrensschritte einer weiteren beispielhaften Ausführung eines Verfahrens gemäß dem verbesserten Konzept;
• 5 schematisch weitere einzelne Verfahrensschritte einer weiteren beispielhaften Ausführung eines Verfahrens gemäß dem verbesserten Konzept; und
• 6 schematisch weitere Verfahrensschritte gemäß einer weiteren beispielhaften Ausführung eines Verfahrens gemäß dem verbesserten Konzept.

Show in the drawings

• 1 a flow chart of an exemplary embodiment of a method according to the improved concept;
• 2 schematically, individual method steps of a further exemplary embodiment of a method according to the improved concept;
• 3 a vehicle including an exemplary implementation of a vehicle electronic control system according to the improved concept;
• 4th schematically, individual method steps of a further exemplary embodiment of a method according to the improved concept;
• 5 schematically, further individual method steps of a further exemplary embodiment of a method according to the improved concept; and
• 6th schematically, further method steps according to a further exemplary embodiment of a method according to the improved concept.

3 shows a vehicle 1 , in particular an at least partially automated vehicle 1 which is at least a level 2 classified according to SAE J3016. The vehicle 1 includes an exemplary implementation of a vehicle electronic control system 2 according to the improved concept.

The vehicle control system 2 includes a control unit 4th and a sensor system. The sensor system comprises at least one active optical sensor system, for example a lidar system 3 . A field of vision 6th of the lidar system 3 can in front of the vehicle 1 lie. The sensor system can optionally have one or more additional lidar systems 3a , 3b with respective fields of view 6a , 6b include that is different from the field of view 6th of the lidar system 3 distinguish. For example, the fields of view 6a , 6b Behind or at least partially behind and / or to the side of the vehicle 1 lie.

During a normal operating mode of the vehicle control system 2 , the control unit can 4th fully automated or partially automated driving of the vehicle 1 Taxes. The sensor system, especially the lidar systems 3 , 3a , 3b can an environment 5 of the vehicle 1 monitor during normal operating mode.

During normal operating mode, the control system can 2 for example continuously a safety trajectory depending on one through the monitoring by means of the lidar systems 3 , 3a , 3b determine the generated point cloud. For this purpose, any of the lidar systems 3 , 3a , 3b for example, generate an individual point cloud and the individual point clouds can for example from the control unit 4th be merged to form the point cloud or the total point cloud.

If there is a trigger event from the control unit 4th is detected, for example a fault in the vehicle control system 2 , which can affect the regular operation of automated driving, the control unit 4th the vehicle control system 2 switch from the normal operating mode to a safety mode and the vehicle 1 control in such a way that it automatically follows the safety trajectory that was last determined during the normal operating mode in order to bring the vehicle into a safe position.

For more details on the operation and functionality of the electronic control system 2 reference is made to the explanations relating to the figures 1 , 2 and 4th to 6th .

In 1 FIG. 3 is a flow diagram of an exemplary embodiment of a method for displacing the vehicle 1 shown in a safe position.

The safe position can be a position of the vehicle, for example 1 near a lane boundary 7th such as in 6th is shown correspond. For example, the safe position can be a position of the vehicle 1 with a safety margin 8th from the lane boundary 7th his.

Again referring to 1 , is in process step 19th the point cloud from the lidar system 3 and optionally from the other lidar systems 3a , 3b generated and the control unit 4th provided. For this purpose, the lidar systems 3 for example the environment 5 of the vehicle 1 by scanning a plurality of scanning points with different scanning directions. For each scanning direction or each scanning point, respective light pulses from the lidar system 3 be emitted and at least partially from objects or points in the area 5 be reflected. The lidar system 3 can detect the reflected areas of the light pulses and determine a spatial coordinate of the respective scanning point based thereon. The spatial coordinates of all sampling points represent a single point cloud of the lidar system 3 . Optionally, further individual point clouds can be generated in the same way from the optional further lidar system 3a , 3b be generated. If this is the case, the lidar systems can 3a , 3b their individual point clouds also to the control unit 4th provide, and the control unit 4th guides the individual point clouds of all lidar systems 3 , 3a , 3b together to form the point cloud or the total point cloud.

In the optional process step 20th , the control unit can 4th carry out a classification or point movement classification of the overall point cloud, in particular by block classification of each point of the overall point cloud, for example into one of three categories, in particular a movement category, a static category and an unknown category. Here, a point is classified as static when it is not moving with respect to the roadway, and is classified as moving when it is moving with respect to the roadway. A point can be categorized in the unknown class if it cannot be classified in the static or moving class with sufficient probability. The block classification can, for example, be based on evidence theory, for example movement parameters of the vehicle 1 take into account, for example, acceleration, rotational speed and speed of the vehicle 1 .

In step 21st determines the control unit 4th a representation, in particular an approximate representation, of the lane boundary 7th based on the total point cloud, in particular based on the static points of the point cloud. The lane boundary 7th can, for example, as a set of four variables including a lateral offset of the respective point of the lane boundary 7th to a defined point on the vehicle 1 be, for example, a center point of the front bumper of the vehicle 1 , a heading angle, in particular an angle between the vehicle in a longitudinal direction and the lane boundary, and a curvature of the lane boundary at the specific point and optionally a derivative of the curvature.

2 shows schematically vehicle 1 and a field of view 6th of the lidar system 3 as well as the lane boundary 7th . The crosses in 2 represent static points of the point cloud generated by the control unit 4th as part of the lane boundary 7th identified will. The lane boundary 7th can for example be approximated as a polynomial, for example fourth degree.

In process step 22nd the control unit determines a safety trajectory based on the point cloud, in particular based on the static points, in particular based on the approach to the lane boundary 7th . The goal of generating the safety trajectory is to create a path profile 6th and / or define a speed profile to the vehicle 1 in the safe position. Based on the determined lane boundary 7th , especially the polynomial description of the lane boundary 7th determined by the control unit 4th a route profile 6th the safety trajectory, which is given by a set of points along the roadway that provides a route for the vehicle 1 describe which to follow if the vehicle's safety mode is activated to reach the safe position. Furthermore, the control unit 4th generate a speed profile, which for example the path profile 6th assigned. The speed profile represents a time series of speed setpoints which the vehicle 1 should follow in order to reach the safe position.

It should be noted that the steps 19th to 22nd during normal operating mode of the vehicle control system 2 occur. Calculation steps of the control unit 4th and scanning steps of the lidar systems 3 , 3a , 3b during the procedural steps 19th to 22nd can be repeated continuously or periodically during normal operating mode to ensure a transition of the vehicle 1 into the safe position is immediately possible as soon as it is necessary.

In particular, the control unit comprises 4th a software architecture and associated algorithms that constantly query the acceleration and steering angle for the vehicle 1 based on the safety trajectory calculated in real time.

The route profile 6th can for example be determined as a polynomial approximation to a path that of the vehicle 1 to be followed during the safety trajectory. The polynomial description can for example include the calculation of a fifth degree polynomial which represents the path profile.

In 4th is the calculation of the path profile 6th shown schematically. There is a normal operation calculation module 27 the control unit 4th , which can be a software module, for example. The module 27 has a variety of entrances 9 and a variety of outputs 11 on. In the example shown, the module has 27 for example eight inputs, each input 9 corresponds to a corresponding input parameter, and for example six outputs 11 , each output corresponding to a polynomial coefficient for a fifth degree polynomial. The input parameters can, for example, be a lateral starting position of the vehicle 1 , an initial speed of the vehicle 1 , an initial acceleration of the vehicle 1 , a desired lateral end position of the vehicle 1 , a desired top speed of the vehicle 1 , a desired final acceleration of the vehicle 1 , a start time that can be set to zero and an end time given by the start time plus a desired duration of the path profile 6th is given include. By providing values for all input parameters, the module can 27 repeatedly or continuously calculate the coefficients of the polynomial and these at the outputs 11 provide.

Again with reference to 1 are the steps 19th to 29 of the method is repeated in particular continuously during the normal operating mode, so that the safety trajectory is continuously updated.

The vehicle 1 can for example remain in normal operating mode until a triggering event is detected. The triggering event can, for example, detect a safety-relevant situation or an error, in particular an error or a defect in the vehicle control system 2 .

When the trigger event by means of the control unit 4th is detected, the process continues with the process steps 23 and 24 away.

In step 23 becomes the lateral position of the vehicle 1 according to the path profile 6th , especially the route profile 6th the last determined safety trajectory controlled. This is the lateral position of the vehicle 1 , especially the lateral distance of the vehicle 1 to delimit the lane 7th , continuously according to the path profile 6th decreased.

If the speed of the vehicle 1 if it changed the path profile 6th follows, the polynomial can be updated. This is in the right part of 4th shown. There is a security mode module there 10 shown, for example, which first inputs 12th for receiving the calculated coefficients of the polynomial from the outputs 11 of the module 27 and second entrances 13th has for receiving further input parameters. The further input parameters can include, for example, a time that has elapsed since the start of the safety mode, in particular since the start time, the desired lateral end position and the end time. Based on these further Input parameters and the original coefficient of the polynomial, the polynomial can be along the path profile 6th can be updated and respective updated coefficients can be sent to an output 14th of the module 10 are issued.

In step 24 who step parallel to or simultaneously with 23 or alternatively after step 23 can be performed, longitudinal control of the vehicle movement is performed according to the speed profile. That is, in step 24 can speed the vehicle 1 according to the speed profile.

The speed profile defines how the vehicle 1 should reach the desired final speed at the end of the safety trajectory, especially when the vehicle 1 has reached the safe position. In particular, the final desired speed can be zero.

In process step 25th can send low-level commands from the control unit 4th be generated, for example, to operate the brake pedal or an accelerator pedal of the vehicle in order to execute the speed profile.

In step 26th can the vehicle 1 reach the safe position.

In 5 and 6th becomes the behavior of the vehicle 1 shown schematically in a slightly modified manner during the safety mode.

In particular, in 5 for example, four states of the vehicle control system 2 shown. At the beginning, when the normal operating condition has ended and the safety mode has been activated, the vehicle control system is located 2 in a nominal condition 15th . The nominal state 15th corresponds to the last state of the vehicle control system 2 when it was still in its normal operating state. When the vehicle 1 is in the nominal state, it still drives regularly on the road, as in 6th shown.

When the safety mode is activated, the vehicle control system will 2 from the nominal state 15th in a lateral control state 16 switched. During the lateral steering state 16 , the vehicle will 1 near the lane boundary 7th brought it to the path profile 6th follows until the safety distance 8th is reached.

From the lateral control mode, the vehicle control system 2 into an adjustment state 17th in which the vehicle is located 1 and the vehicle control system 2 can stabilize. The lateral control state 16 and the state of adaptation 17th can be repeated iteratively until the state of the vehicle changes 1 or the vehicle control system 2 has stabilized.

Then the vehicle control system can 2 in a longitudinal steering state 18th be switched. During the longitudinal steering state 18th becomes the speed of the vehicle 1 for example according to the speed profile reduced to the vehicle 1 reaches the desired final speed, for example until it is at zero speed. Then the vehicle is 1 for example in the safety distance 8th to delimit the lane 7th positions and stands still. The state of minimal danger or the safe position has therefore been reached.

As described, a method or an electronic vehicle control system according to the improved concept can be used to achieve a rapid reaction to a triggering event, for example a safety-relevant situation, in order to bring the vehicle into the state of minimal danger. Therefore, the security is increased.

QUOTES INCLUDED IN THE DESCRIPTION

This list of the documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• US 9927810 B1 [0003]

Claims (15)

Method for bringing an at least partially automated vehicle (1) into a state of minimal danger, an environment (5) of the vehicle (1) being monitored by means of a sensor system (3) of the vehicle (1) during normal operating mode of the vehicle (1) becomes; characterized in that by means of a control unit (4) of the vehicle (1), - a safety trajectory is determined as a function of a result of the monitoring during the normal operating mode; - A triggering event is detected and, in response to the triggering event, the vehicle (1) is switched from the normal operating mode to a safety mode of the vehicle (1); and - the vehicle (1) is controlled in such a way that it automatically follows the safety trajectory during the safety mode. Procedure according to Claim 1 , characterized in that a path profile (6) for the vehicle (1) is determined in order to determine the safety trajectory. Procedure according to Claim 2 , characterized in that - coefficients of a polynomial are determined based on the result of the monitoring; - The path profile (6) is determined based on the coefficients of the polynomial. Method according to one of the Claims 1 to 3 , characterized in that a speed profile is determined for the vehicle (1) in order to determine the safety trajectory. Method according to one of the Claims 1 to 4th , characterized in that - a set of data points describing the environment (5) is generated as the result of the monitoring; - Each of the data points having respective spatial coordinates of a point in the environment (5). Procedure according to Claim 5 , characterized in that - the data points of the set are analyzed by means of the control unit (4) in order to determine a subset of static data points of the set of data points; - wherein the spatial coordinates of each of the static data points correspond to respective spatial coordinates of a static point in the environment (5). Method according to one of the Claims 1 to 6th , characterized in that - a lane delimitation (7) is determined by means of the control unit (4) based on the result of the monitoring; and - the safety trajectory is determined as a function of the road boundary (7). Procedure according to Claim 7 , characterized in that the vehicle (1) is controlled during a first phase of the safety mode in such a way that a distance between the vehicle (1) and the lane boundary (7) is reduced until the distance is equal to a predefined safety distance (8). Procedure according to Claim 8 , characterized in that a speed of the vehicle (1) is reduced to a predefined minimum speed during a second phase of the safety mode. Method according to one of the Claims 1 to 9 , characterized in that - a fault in an electronic vehicle control system (2) of the vehicle (1), which has the sensor system (3) and the control unit (4), is detected as the triggering event; or - a predefined end of an automated driving period is detected as the triggering event. Electronic vehicle control system, with a sensor system (3) which is set up to monitor an environment (5) of an at least partially automated vehicle (1) during a normal operating mode of the vehicle control system (2), and a control unit (4); characterized in that the control unit (4) is set up to - determine a safety trajectory during the normal operating mode as a function of a result of the monitoring; - to detect a triggering event and, in response to the triggering event, the vehicle control system (2) is switched from the normal operating mode to a safety mode; and - to control the vehicle (1) in such a way that it automatically follows the safety trajectory during the safety mode in order to bring the vehicle (1) into a state of minimal danger. Electronic vehicle control system according to Claim 11 , characterized in that the sensor system (3) has an active optical sensor system which is set up to generate a set of data points which describe the environment (5) as the result of the monitoring. Electronic vehicle control system according to Claim 12 , characterized in that the active optical sensor system at least has two active optical sensors with different fields of view. Computer program which contains instructions which, when the computer program is received from an electronic vehicle control system (2) according to one of the Claims 11 to 13th is executed, cause the vehicle control system (2) to implement a method according to one of the Claims 1 to 10 execute. Computer-readable storage medium that contains a computer program according to Claim 14 saves.

Images