Safety device for use in a vehicle, vehicle and method for operating a vehicle

Abstract

The invention relates to a safety device (100) for use in a vehicle, the safety device being configured to operate at least temporarily in an automated driving mode in which the vehicle drives automatically, and the safety device having a first data source (210) configured as a human-machine interface, the first data source being configured to output data about the driving state. The safety device (100) is provided with a computing device (110) and a first data interface (121), wherein the safety device (100) is configured to receive data about the driving state from the first data source (210) via the first data interface (121).

Description

Technical Field

[0001] The invention relates to a safety device for use in a vehicle with an automated driving mode, a vehicle having such a safety device, and a method for operating a vehicle. Background Art

[0002] Current driver assistance systems in vehicles are typically not designed to assume safety-related driving functions. Therefore, even if modern assistance functions provide support when performing lateral and longitudinal maneuvers, the driver always retains responsibility as the vehicle driver in these assistance functions.

[0003] In future automated functions, such as so-called "Staupilot" or "Traffic Jam Pilot", today's solutions reach their limits, since in such cases the vehicle must at least temporarily assume responsibility and the driver can turn to other tasks in the meantime. In this context, we can also speak of automated driving modes in which the vehicle drives automatically.

[0004] For example, DE 10 2016 003 359 A1 discloses the use of two controllers in a vehicle with an especially automated driving mode, which controllers meet different safety standards. The controller with the higher safety standard displays the presence of the active, automated driving mode visually, while the controller with the lower safety standard controls the display. Summary of the invention

[0005] According to the invention, a safety device for use in a vehicle, a vehicle and a method for operating a vehicle are proposed, having the features of the independent claims. Advantageous embodiments are the subject matter of the dependent claims and the following description.

[0006] The safety device according to the invention is intended for use in a vehicle or is provided for this purpose and is designed for this purpose. A particularly suitable vehicle is designed to be operated at least temporarily in an automated driving mode in which the vehicle drives automatically. Therefore, in particular, the term "automated driving mode" should mean that the vehicle drives or can drive on the road - at least temporarily or under certain conditions - without the assistance of a human driver. However, the vehicle can be connected to a higher-level infrastructure for communication. In addition, a particularly suitable vehicle has a first data source configured as a human-machine interface, which is designed to output data about the driving state.

[0007] Such a human-machine interface is in particular a unit by means of which information can be communicated to the driver or other persons in the vehicle. The human-machine interface therefore preferably has a computing device and / or an information output device. Therefore, the first data source is preferably also set up to output information about the driving state to the driver. An information flow in the opposite direction is also suitable, that is, a person can transmit information to the vehicle or a corresponding computing unit via the human-machine interface. In this sense, a typical and preferred human-machine interface is a head-up display, a combination instrument (instrument cluster) or a host (the so-called operating unit of an infotainment system) or also just an illuminated touch screen, buttons or knobs, as they are typically used in modern vehicles.

[0008] The invention can ensure in particular that responsibility is safely and securely transferred from the vehicle to the driver. In this respect, the vehicle can always correctly display or inform the driver of the current driving mode as information about the driving state, in particular with regard to the automated / non-automated distinction. In particular, displays or information that the vehicle is not (anymore) in an automated driving mode must function reliably and must not falsely indicate to the driver that the vehicle is traveling in an automated manner.

[0009] For vehicles that drive automatically, it is particularly important to reliably indicate to the driver whether the vehicle is in the automated driving mode. For this purpose, that is, for the display or information notification, certain safety levels with a particularly low risk of failure are typically specified. For example, the ASID-D level according to the ASIL classification (English "Automotive Safety Integrity Level") commonly used in the automotive field can be considered.

[0010] Current driver assistance systems with a human-machine interface are typically not designed to take over safety-related driving functions, that is, they do not meet the safety level required for automated driving modes. Rather, the driver of the vehicle always retains responsibility as the vehicle driver in such assistance functions.

[0011] The proposed safety device now has a computing device and a first data interface and is designed to receive data about the driving state from a first data source, i.e., a human-machine interface, via the first data interface. In addition, the safety device is designed to receive data about the driving state from a second data source that is different from the first data source, and the safety device is also designed to output information about the driving state to the driver using an information output device and based on the data received from the first data source and the second data source, and more precisely, in particular when a fault situation or a fault is detected in the human-machine interface.

[0012] Such a safety device can be in particular a control unit or another computing unit, which can be integrated into the vehicle accordingly via the first data interface. The safety device can be arranged variably in the vehicle, which can be achieved in particular without relying on a conventional human-machine interface. Arrangement locations include, for example, installation locations in a control console, in particular in a control console, near a seat armrest or also in the roof region of the vehicle close to the driver.

[0013] The proposed safety device receives data about the driving state from different data sources during operation, including in particular automated driving modes or data with information about whether the vehicle is in an automated driving mode. The first data source is a (primary) human-machine interface, which is preferably also used to inform the driver of the driving state in normal situations, while the second data source can be other computing units or controllers of the vehicle, in particular driver assistance controllers (FAS or ADAS-Advanced Driver Assistance Systems), such as, for example, an automatic cruise control, a speedometer, a brake assist system, a lane keeping assist system, etc. For this purpose, the safety device has a second data interface, wherein the safety device is configured to receive data about the driving state from the second data source via the second data interface.

[0014] The data from the first and second data sources can (directly) transmit the status of an automated driving function or an automated driving mode (e.g. “automatically turned on”, “automatically turned off”, “automated driving mode turned on in x seconds”, “automated driving mode turned off in x seconds”, etc.) or contain the following data, from which information must then first be derived.

[0015] In this way, two data sources are available to the safety device. In the event of a fault or failure of the human-machine interface, data from the second data source are always available and information about the driving state can always be output. The output of the information about the driving state can be achieved by a suitably attached information output device, for example, which is already present in the vehicle. However, it is particularly preferred to use or provide a special information output device provided for the safety device.

[0016] The special advantage of this safety device that can be used additionally in the vehicle is that, for example, a common human-machine interface with a low safety level can continue to be used in the sense of the basic equipment for the vehicle. On the contrary, the proposed safety device can be used in the sense of special equipment, within the scope of which automated driving is realized. In contrast, there is no need for a common human-machine interface, such as the second variant of the host or a human-machine interface with a high safety level for all equipment variants. More precisely, the safety-related functions are covered by the safety device. In particular, it can be provided that the decision function or "voter (voting)-function" in the safety device determines the correctness of the data received by the two data sources and can therefore, for example, protect the human-machine interface or identify faults.

[0017] Preferably, the safety device is configured to receive data about the driving state from a second data source and to supply energy to the second data source separately from the first data source. In this way, it is ensured that even when the energy supply of the first data source, i.e. the human-machine interface, fails, data about the current driving state can still be transmitted to the safety device and, if necessary, data about the current driving state can also be output particularly safely and correctly according to the energy supply of the safety device. For this purpose, different onboard power supply channels are regarded as energy supply sources, and the onboard power supply channels are decoupled from each other with corresponding preventive measures, so that, for example, a short circuit in one of the onboard power supply channels does not impair the functional capabilities of other onboard power supply channels. However, it is also conceivable to provide a separate energy storage unit for the safety device, especially one that is independent of the onboard power supply of the vehicle. It is also conceivable to consider emergency energy supply mechanisms, such as batteries, etc., which are only used when the remaining energy supply mechanisms fail.

[0018] The safety device is advantageously designed to deactivate the human-machine interface when a fault is detected in the human-machine interface. Thus, in terms of safety technology, the human-machine interface can be regarded as a slave (and the safety device as a master), in particular when the safety device has a higher safety level than the human-machine interface. In this way, the safety device can also be better protected. In particular, a fault can be detected by the aforementioned "voter function" or if data is no longer received from the human-machine interface.

[0019] The safety device preferably has an information output device, and information about the driving state can be output through the information output device. However, as an alternative or supplementary solution, it is also preferred that the safety device has an interface relative to the information output device, through which data and / or signals and / or power supply can be provided to the information output device. For the integrated information output device, a compact unit covering all functions is obtained, and the interface can realize the targeted positioning of the information output device in the vehicle. Both of these variants of the information output device can be such an information output device that is set up to output optical and / or acoustic information. Among them, a display, one or more LEDs or other lights, a loudspeaker or an actuator for warning sound are particularly included. In particular, for a display or a loudspeaker, it is also possible to consider outputting words or sentences, which, for example, inform the driver according to the situation, especially not only about the driving state but also contain other information when necessary. It is also possible to consider outputting other, especially safety-related information.

[0020] It is expedient if the safety device is designed to detect a fault in the information output device. If the safety device has an interface to the information output device, it is also expedient if the safety device is designed to detect a fault in this interface. In other words, it is thus possible to diagnose the own and the attached or used information output device or the interface, which increases safety overall.

[0021] It is also preferred that the safety device is designed to detect its own faults and, in particular, also display them using information output means. Safety is also increased by such a self-diagnosis possibility.

[0022] Furthermore, the subject matter of the invention is a vehicle which is designed to be operated at least temporarily in an automated driving mode in which the vehicle travels automatically, which has a first data source designed as a human-machine interface and which is designed to output data about the driving state, which has a second data source different from the first data source and which is designed to output data about the driving state, and which has a safety device according to the invention.

[0023] The safety device and the first data source or the human-machine interface are supplied with energy here, in particular by means of different energy supply sources. The different energy supply sources are in particular parts of different onboard power supply channels. However, it is also conceivable that the energy supply source for the safety device is designed as a separate energy storage unit, in particular independent of the onboard power supply of the vehicle.

[0024] As an alternative or in addition, the second data source and the first data source are preferably supplied with energy by means of different energy supply sources. As an alternative or in addition, the safety device and the second data source are preferably supplied with energy by means of the same energy supply source. Thus, in particular two or three different energy supply sources can be provided for the first data source, the second data source and the safety device.

[0025] The subject of the invention is also a method for operating a vehicle, which is configured to operate at least temporarily in an automated driving mode, in which the vehicle drives automatically, and which has a first data source configured as a human-machine interface, which is configured to output data about the driving state. In addition, the vehicle also has a second data source different from the first data source, which is configured to output data about the driving state. In this case, data about the driving state from the first data source and data about the driving state from the second data source are received, and information is output based on the data about the driving state received from the first data source and the second data source using an information output device. For this purpose, in particular, the safety device according to the invention in the vehicle or the vehicle according to the invention can be used.

[0026] With regard to the advantages and further preferred embodiments of the vehicle and the method, in order to avoid repetitions, reference is made to the above explanations regarding the safety device, which apply accordingly here.

[0027] It is also advantageous to implement the method according to the invention in the form of a computer program or computer program product with program code for executing all method steps, since this results in particularly low costs, in particular if the executing controller is also used for other tasks and is therefore already present. Suitable data carriers for providing the computer program are in particular magnetic, optical and electrical storage devices, such as hard disks, flash disks, EEPROMs, DVDs, etc. The program can also be downloaded via a computer network (Internet, intranet, etc.).

[0028] Further advantages and embodiments of the invention are apparent from the description and the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The invention is schematically illustrated in the drawings on the basis of exemplary embodiments and is described below with reference to the drawings.

[0030] Figure 1 A preferred specific embodiment of the vehicle according to the invention is shown schematically.

[0031] Figure 2 A preferred embodiment of the safety device according to the invention is shown schematically.

[0032] Figure 3 A further preferred embodiment of the safety device according to the invention is shown schematically.

[0033] Figure 4 A further preferred embodiment of the safety device according to the invention is shown schematically. DETAILED DESCRIPTION

[0034] exist Figure 1 Schematically depicts a preferred specific embodiment of a vehicle 200 according to the present invention, with which the method according to the present invention can also be carried out.

[0035] The vehicle 200 has a first data source 210 designed as a human-machine interface with information output means. This can be, for example, a head unit or a combination device, which can also be used and is configured for driver assistance functions. The human-machine interface 210 is configured to output data about the driving state via a corresponding data interface, such as a CAN interface. The data can be transmitted to the human-machine interface 210, for example, by a driver assistance control unit.

[0036] Furthermore, the human-machine interface 210 is configured to output information about the driving state to the driver via information output means. In particular, information about whether the vehicle 200 is in an automated driving mode can be output. Such output of information can be performed optically and / or acoustically.

[0037] Furthermore, vehicle 100 has a computing unit 220 as a second data source, which can also output data about the driving state via a corresponding data interface, such as a CAN interface. For this purpose, computing unit 220 can, for example, generate these data itself and / or receive these data from a driver assistance controller. Computing unit 220 can, for example, be an ESP controller or other controllers, in particular for safety-related or safety-critical functions, and / or a driver assistance controller.

[0038] Furthermore, a safety device 100 is provided, which is connected both to the human-machine interface 210 and to the computing unit 220. The safety device 100 is a preferred embodiment of the safety device according to the invention, as it is explained in more detail below in conjunction with the specific connection to the human-machine interface 210 and the computing unit 220.

[0039] exist Figure 2 A preferred embodiment of the safety device 100 according to the invention is schematically shown in FIG. Figure 1As used in vehicle 200.

[0040] The security device 100 has a computing device 110 and a first data interface 121 and a second data interface 122. Figure 1 The first data source or human-machine interface 210 shown in FIG. 1 is connected to the safety device 100 or its computing device 110 via the first data interface 121 in the form of data transmission, for example via a CAN-, MOST-, LIN- or Flexray-bus or also via Ethernet. Figure 1 The computing unit 220 shown in the figure - which represents a second data source in the sense of the present invention - is connected to the safety device 100 or its computing device 110 via a second data interface 122 in the form of data transmission, for example via a CAN-, MOST-, LIN- or Flexray-bus or also via Ethernet.

[0041] In this way, safety device 100 can receive data about the current driving state from two different data sources and can infer therefrom, as information about the driving state, in particular whether vehicle 200 is in an automated driving mode. These data can each directly contain information about the state of an automated driving function or an automated driving mode (e.g., "automatically activated", "automatically deactivated", "automated driving mode activated in x seconds", "automated driving mode deactivated in x seconds", etc.) or can be used to first acquire information.

[0042] Furthermore, two different onboard power supply channels 201 and 202 of the onboard power supply of the vehicle 200 are shown as an example, which allow and also ensure separate and in particular independent energy supplies. The human-machine interface 210 is attached or connected to the onboard power supply channel 201 and thus receives energy supply, while the computing unit 220 is attached or connected to the onboard power supply channel 202 and thus receives energy supply. This energy supply shown is a typical energy supply, which is used, for example, for a combination device as a human-machine interface 210 and an ESP controller as a computing unit 220. However, in conjunction with the present invention, it is also ensured that the safety device can continue to obtain data about the driving state even if the onboard power supply channel 201 fails. In this sense, the second data interface 122 also serves as a so-called "failure observation data interface (Fail-Op-Data-Schnittstelle)".

[0043] For this reason, the safety device 100 itself is preferably also connected to the vehicle power supply channel 202, that is, connected to the vehicle power supply channel via the interface 125 and is supplied with energy from it. However, it goes without saying that other, possibly separate, additional energy sources, such as a battery, can also be used to supply energy to the safety device 100. This can be done both as an alternative to the vehicle power supply channel 202 and as a supplement thereto.

[0044] Furthermore, the safety device 100 is connected to an information output device 130 which is configured to output acoustic information via an interface 123. The information output device 130 can be, for example, a loudspeaker or an acoustic signal generator for a warning sound or a warning oscillating signal or the like.

[0045] Furthermore, the security device 100 is connected to an information output device 140 which is configured to output optical information via an interface 124. The information output device 140 can be, for example, one or more LEDs, small lights, light strips or also a display or the like.

[0046] Both the information output device 130 and the information output device 140 are connected to the computing device 110 via the interface 123 or 124, so that data or signals for corresponding information can be output or displayed. In addition, preferably, both the information output device 130 and the information output device 140 are supplied with current or energy via the interface 123 or 124, which is performed when using the driver or power stage 111 or 112. Therefore, the interfaces 123 and 124 are used not only for power supply but also for transmitting data or signals.

[0047] By integrating the drive or power stage into safety device 100 , the information output means can be positioned in a targeted or desired manner in the vehicle with little installation space required in order to be able to optimally display information about the driving state or, if necessary, also other information to the driver.

[0048] It goes without saying that the information output devices 130 and 140 shown here are selected only as examples. The number and type of the information output devices can be selected according to the requirements or circumstances. For example, only acoustic information output devices or only optical information output devices can also be considered.

[0049] Safety device 100 is now designed to output information about the driving state to the driver by means of information output means 130 and 140. This can be done simultaneously and in parallel with the output via human-machine interface 210 or only if a fault, such as a malfunction, of human-machine interface 210 is detected, whether due to a power supply fault, a hardware fault and / or a software fault.

[0050] exist Figure 3 Another preferred embodiment of the safety device 100 ′ according to the invention is schematically shown in FIG. Figure 1 As used in vehicle 200.

[0051] The safety device 100 ′ corresponds substantially to Figure 2 The safety device 100 is described above, but with the exception that the driver or power stage 111 ′ or 112 ′ is not integrated into the safety device but is arranged outside the safety device, in particular at or near the corresponding information output device 130 or 140 .

[0052] Accordingly, the interface 123 or 124 can be simplified to the transmission of data or signals and the power supply for the drive or power stage 111 ′ or 112 ′ can be carried out separately from the safety device 100 ′, for example via another onboard power supply channel or a separate energy supply source. It goes without saying that the energy supply for the safety device can also be used for the drive or power stage.

[0053] In this way, a safety device that requires less installation space can be provided. It is also conceivable to use drives or power stages and / or information output components that are already present in the vehicle, in particular if they are designed for safety requirements. Figure 2 , which applies here accordingly.

[0054] exist Figure 4 Another preferred embodiment of the safety device 100 ″ according to the invention is schematically shown in FIG. Figure 1 As used in vehicle 200.

[0055] The safety device 100 ″ substantially corresponds to Figure 2 The safety device 100 of FIG. 1 is described above, but with the exception that not only the driver or power stage 111 ′ or 112 ″ but also the information output means, which are indicated here by 130 ″ and 140 ″, are integrated into the safety device.

[0056] Accordingly, no external interface is required for transmitting data or signals. In this way, a compact safety device which is functionally capable and can be used in many ways can be provided. Figure 2 , which applies here accordingly.

Claims

1. A safety device (100, 100', 100") for use in a vehicle (200), the safety device being designed to be operated at least temporarily in an automated driving mode, in which the vehicle (200) is driven automatically, and the vehicle having a first data source (210) designed as a human-machine interface, the first data source being designed to output data about the driving state to the driver in normal situations, the safety device having a computing device (110) and a first data interface (121), The safety device (100, 100', 100") is configured to receive data about the driving state from the first data source (210) via the first data interface (121), The safety device (100, 100', 100") is configured to receive data about the driving state from a second data source (220) different from the first data source (210), and wherein the safety device (100, 100', 100") is configured to output information about the driving state to the driver using an information output device (130, 130", 140, 140") and based on data received from the first data source (210) and the second data source (220), The data about the driving state include data containing information about whether the vehicle is in an automated driving mode.

2. The safety device (100, 100', 100") according to claim 1 has a second data interface (122), wherein the safety device (100, 100', 100") is configured to receive data about the driving status from the second data source (220) via the second data interface (122).

3. The safety device (100, 100', 100") according to claim 1 or 2, which is designed to output information about the driving state when a fault of the first data source is detected. 4 . The safety device ( 100 , 100 ′, 100 ″) according to claim 3 , which is designed to deactivate the first data source when a fault of the first data source is detected. 5 .

5. The safety device (100") according to claim 1 or 2, further comprising an information output device (130", 140"), via which information about the driving state can be output.

6. The safety device (100, 100") according to claim 1 or 2 further comprises an interface (123, 124) relative to the information output device (130, 140), through which data and / or signals and / or power supply can be provided to the information output device (130, 140).

7. The safety device (100, 100') according to claim 5, which is designed to detect a malfunction of the information output means (130, 130", 140, 140").

8. The safety device (100, 100', 100") according to claim 5, wherein the information output means (130, 130", 140, 140") is designed to output optical and / or acoustic information.

9. The safety device (100, 100', 100") according to claim 1 or 2, wherein the safety device (100, 100', 100") is designed to detect a fault of the device itself.

10. The safety device (100, 100', 100") according to claim 9, which is designed to display its own fault using an information output device (130, 130", 140, 140").

11. The safety device (100, 100', 100") according to claim 1 or 2, which is designed to output information about the driving state with the same or a higher safety level than the first data source (210).

12. A vehicle (200) configured to operate at least temporarily in an automated driving mode, in which the vehicle (200) drives automatically, the vehicle having a first data source (210) configured as a human-machine interface, the first data source being configured to output data about the driving state to the driver under normal circumstances, the vehicle having a second data source (220) different from the first data source (210), the second data source being configured to output data about the driving state, and the vehicle having a safety device (100, 100', 100") according to any one of claims 1 to 11.

13. The vehicle (200) according to claim 12, wherein the first data source (210) is configured to output information about the driving state to the driver.

14. The vehicle (200) according to claim 12 or 13, wherein the safety device (100, 100', 100") and the first data source (210) are supplied with energy by means of different energy supply sources, and / or wherein the second data source (220) and the first data source (210) are supplied with energy by means of different energy supply sources.

15. The vehicle (200) according to claim 14, wherein the different energy supply sources are part of different onboard power supply channels (201, 202).

16. The vehicle (200) according to claim 14, wherein the energy supply source for the safety device (100, 100', 100") is designed as a separate energy storage unit.

17. The vehicle (200) according to claim 16, wherein the energy supply source for the safety device (100, 100', 100") is designed as an energy storage unit independent of the onboard electrical system of the vehicle.

18. A method for operating a vehicle (200), the vehicle being configured to be operated at least temporarily in an automated driving mode, in which the vehicle (200) is driven automatically, the vehicle having a first data source (210) designed as a human-machine interface, the first data source being configured to output data about the driving state to the driver under normal circumstances, and the vehicle having a second data source (220) different from the first data source (210), the second data source being configured to output data about the driving state, wherein data on driving status is received from the first data source (210), wherein data on driving status is received from the second data source (220), and wherein information about the driving state is outputted based on the data about the driving state received from the first data source (210) and the second data source (220) using an information output device (130, 130", 140, 140"); The data about the driving state include data containing information about whether the vehicle is in an automated driving mode.

19. The method according to claim 18, wherein a safety device (100, 100', 100") according to any one of claims 1 to 11 is provided in the vehicle (200), or wherein a vehicle (200) according to any one of claims 12 to 17 is used.

Images