Operating Design Domain Validation Coverage for Road and Lane Types

Abstract

The present invention relates to the verification coverage of the operational design domain for road and lane types. A control system for a vehicle traveling along a first direction on a road section is proposed. The vehicle has a driver support function for autonomously controlling the vehicle, and the driver support function can operate within an operational design domain (ODD) including a road safety barrier metric and a road characteristic metric. The control system includes a control circuit configured to acquire data including information about the surrounding environment of the vehicle. The information includes road safety barrier data and road characteristic data. The control circuit is configured to determine the satisfaction of the road safety barrier metric and the road characteristic metric based on the road safety barrier data and the road characteristic data, so as to determine the satisfaction of the ODD based on the acquired data. If the ODD is satisfied, the control circuit is configured to generate a first control signal to control the availability of the driver support function for the road section, so that the driver support function is available to the passengers of the vehicle.

Description

[0001] Cross - reference to related applications

[0002] This patent application claims priority to European Patent Office Application No. 19209645.1, filed on November 18, 2019, with the title "Operational Design Domain Verification Coverage for Road and Lane Types", which has been assigned to the assignee of this patent application and is hereby incorporated by reference in its entirety. Technical Field

[0003] This disclosure relates to autonomous driving (AD) and advanced driver assistance systems (ADAS) for vehicles such as cars, buses, trucks, etc. Background Art

[0004] Autonomous systems (AS) have the ability to operate independently of human direct control and under unanticipated conditions. These systems enable a range of applications such as autonomous vehicles, humanoid robots, and mail - delivery drones. However, this increased ability and flexibility comes at a cost: it is difficult to assess the reliability and safety of autonomous systems.

[0005] Traditional testing methods do not provide the desired level of standards, mainly due to the combinatorial explosion of possible cases to be analyzed. There is a strict need to ensure that AS is safe and reliable. Safety standards enforce that AS operates in a non - hazardous state, while reliability requirements enforce that the system provides services as specified. These requirements are typically associated with a low threshold of system failures, i.e., a high probability of fault - free operation in a particular environment, which in turn requires high - cost and time - consuming verification and validation of AS.

[0006] Therefore, the strict safety requirements imposed on autonomous driving (AD) systems are translated into huge verification requirements. Moreover, these strict safety requirements are imposed not only on software components but also on decision - making and control components and the perception systems of vehicles (e.g., for accurately determining the position of a vehicle in a lane). The high safety requirements for perception systems imply a large amount of redundancy and expensive sensors and / or HD (high - definition) map capabilities.

[0007] Therefore, there is a need for new and improved methods and systems that mitigate the problems of currently known solutions, and specifically, there is a need for methods and systems that can transition from ADAS to AD in a lower - complexity and more cost - effective manner than currently known solutions while still meeting the associated safety requirements. Summary of the Invention

[0008] Accordingly, it is an object of the present disclosure to provide a control system, a vehicle including such a control system, a method, and a computer-readable storage medium that mitigate all or at least some of the deficiencies of currently known solutions.

[0009] More specifically, it is an object of the present disclosure to mitigate problems associated with autonomous driving systems in terms of huge verification requirements and high hardware costs.

[0010] This object is achieved by a control system, a vehicle including such a control system, a method, and a computer-readable storage medium as defined in the appended claims. The term "exemplary" should be understood in this context as being used for instances, examples, or illustrations.

[0011] According to a first aspect of the present disclosure, there is provided a control system for a vehicle traveling along a first direction on a road segment. The vehicle has a driver support function for autonomously maneuvering the vehicle, and the driver support function is capable of operating within an operational design domain (ODD) including a road safety barrier metric and a road characteristic metric. The control system includes a control circuit configured to: obtain data including information about the vehicle's surrounding environment. The information includes road safety barrier data and road characteristic data. Further, the control circuit is configured to: determine the satisfaction of the road safety barrier metric and the road characteristic metric by respectively based on the road safety barrier data and the road characteristic data, so as to determine the satisfaction of the ODD based on the obtained data. Moreover, if the ODD is satisfied, the control circuit is configured to generate a first control signal to control the availability of the driver support function for the road segment, so that the driver support function is available to the passengers of the vehicle. By means of the control system provided above, strict integrity requirements can be shifted to the ODD monitoring part of the system, and thereby the requirements for other features of the driver support function (such as the feature of keeping the vehicle in the lane, which requires a large amount of resources to verify and is associated with high-end, very expensive sensor devices) can be mitigated.

[0012] More specifically, the proposed control system enables the system design to distribute integrity / reliability requirements in such a way that driver support functions in the form of traffic jam pilot or highway pilot can be implemented in a more cost-effective manner than previously known ways. More specifically, due to the reduced exposure to oncoming vehicles, stationary objects, and other high-risk scenarios (such as reduced lane merges), the integrity requirements for the lane-keeping ability of the driver support function can be relaxed.

[0013] According to an exemplary embodiment, a road safety barrier metric includes a required quantity of road safety barriers, a required position of the road safety barriers relative to a road section, and at least one required type of the road safety barriers. The acquired data includes sensor data acquired by at least one sensing device configured to monitor the surrounding environment of the vehicle, and wherein the control circuit is configured to: determine the presence of a plurality of road safety barriers in the surrounding environment of the vehicle by based on the acquired road safety barrier data, to determine the satisfaction of the road safety barrier metric, and if there is at least one road safety barrier in the surrounding environment of the vehicle, then: determine the position of the at least one road safety barrier relative to the road section, and determine the type of the at least one road safety barrier. Moreover, the control circuit is configured to: determine that the road safety barrier metric is satisfied if the required quantity of the road safety barriers, the required position of the road safety barriers relative to the road section, and at least one required type of the road safety barriers are satisfied.

[0014] Moreover, according to another exemplary embodiment, the required quantity of the road safety barriers is two, the required position of the road safety barriers is one road safety barrier on each side of a road section extending in a first direction, and the required type is one of a flexible road safety barrier, a rigid road safety barrier, and a semi-rigid road safety barrier. Thus, the road safety barrier metric can be defined that there should be road safety barriers (traffic barriers) extending along both sides of the lane to satisfy the road safety barrier metric.

[0015] According to a second aspect of the present disclosure, there is provided a vehicle including: a positioning system configured to monitor the geographical location of the vehicle; a sensing system including at least one sensor configured to monitor the surrounding environment of the vehicle; and a control system according to any of the embodiments disclosed herein. For this aspect of the present disclosure, there are similar advantages and preferred features as those of the first aspect previously discussed in the present disclosure.

[0016] According to a third aspect of the present disclosure, there is provided a method for controlling a driver support function of a vehicle that autonomously maneuvers and travels along a first direction on a road section. The driver support function is capable of operating within an operational design domain (ODD) including a road safety barrier metric and a road characteristic metric. The method includes: acquiring data including information about the surrounding environment of the vehicle, wherein the information includes road safety barrier data and road characteristic data. The method further includes: determining the satisfaction of the road safety barrier metric and the road characteristic metric by respectively based on the road safety barrier data and the road characteristic data, to determine the satisfaction of the ODD based on the acquired data. If the ODD is satisfied, then the method includes: generating a control signal to control the availability of the driver support function for the road section, to make the driver support function available to the passengers of the vehicle. For this aspect of the present disclosure, there are similar advantages and preferred features as those of the first aspect previously discussed in the present disclosure.

[0017] According to a fourth aspect, there is provided a (non-transitory) computer-readable storage medium storing one or more programs configured to be executed by one or more processors of a vehicle control system, the one or more programs including instructions for performing a method according to any one of the embodiments disclosed herein. For this aspect of the present disclosure, there are similar advantages and preferred features as those previously discussed for the first aspect of the present disclosure.

[0018] As used herein, the term "non-transitory" is intended to describe a computer-readable storage medium (or "memory") that does not include propagating electromagnetic signals, but is not intended to otherwise limit the type of physical computer-readable storage device encompassed by the term computer-readable medium or memory. For example, the term "non-transitory computer-readable medium" or "tangible memory" is intended to encompass types of storage devices that do not necessarily store information permanently, including for example random access memory (RAM). Program instructions and data stored in a non-transitory form on a tangible computer-accessible storage medium may further be transmitted via a transmission medium or signal (such as an electrical, electromagnetic, or digital signal), which may be conveyed via a communication medium such as a network and / or a wireless link. Thus, as used herein, the term "non-transitory" is a limitation on the medium itself (i.e., tangible, rather than a signal), rather than a limitation on the persistence of data storage (e.g., RAM versus ROM).

[0019] Further embodiments of the present disclosure are defined in the dependent claims. It should be emphasized that when used in this specification, the term "comprising / including" is used to specify the presence of stated features, integers, steps, or components. The presence or addition of one or more other features, integers, steps, components, or combinations thereof is not excluded.

[0020] These and other features and advantages of the present disclosure will be further illustrated hereinafter with reference to the embodiments described below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Other objects, features, and advantages of embodiments of the present disclosure will become apparent from the following detailed description with reference to the accompanying drawings, in which:

[0022] Figures 1a to 1b are two schematic perspective views of a vehicle including a control system according to an embodiment of the present disclosure.

[0023] Figure 2 is a schematic diagram illustrating a method for controlling a driver support function for an autonomously maneuvering vehicle according to an embodiment of the present disclosure.

[0024] Figure 3 is a schematic flowchart of a method for controlling a driver support function for an autonomously maneuvering vehicle according to an embodiment of the present disclosure.

[0025] Figure 4 is a schematic side view of a vehicle including a control system according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] Those skilled in the art will understand that the steps, services, and functions explained herein can be implemented using separate hardware circuits, using software running in conjunction with a programmed microprocessor or a general-purpose computer, using one or more application-specific integrated circuits (ASICs), and / or using one or more digital signal processors (DSPs). It will also be understood that when the present disclosure is described in terms of a method, it can also be embodied by one or more processors and one or more memories coupled to the one or more processors, wherein the one or more memories store one or more programs that, when executed by the one or more processors, perform the steps, services, and functions disclosed herein.

[0027] In the following description of the exemplary embodiments, the same reference numerals denote the same or similar components.

[0028] Figure 1a and Figure 1b are two schematic perspective views of a vehicle 1 according to an embodiment of the present disclosure, the vehicle 1 including a control system for controlling driver support functions for autonomous operation of the vehicle 1. More specifically, Figures 1a to 1b is intended to illustrate an example of how the control system operates in two different scenarios while the vehicle 1 is traveling 21 on a road section 22. The vehicle 1 is provided with driver support functions, which in this context can be understood as autonomous driving (AD) features or autonomous driving system (ADS) features, and with reference to the latter, the driver support functions are preferably ADS features of level 3 or higher according to the SAE J3016 driving automation levels. The driver support functions can be, for example, a "highway pilot" feature or a "traffic jam pilot" feature.

[0029] The present inventors have noted that even when an autonomous or semi-autonomous vehicle 1 is traveling on a "highway-like" road, it does not necessarily mean that there is a physical separation in the form of a barrier towards oncoming vehicles. Thus, if the existence of a barrier separating the vehicle 1 from oncoming vehicles cannot be proven or assumed, a high exposure to oncoming vehicles must be assumed. The high exposure to oncoming vehicles poses high reliability / integrity requirements (e.g., ASIL D) on the ability of the driver support functions to stay within its own lane (ego lane), which in turn leads to high reliability / integrity requirements on the corresponding sensors. These reliability / integrity requirements translate into significant verification requirements (verification of the driver support functions) and the use of high-end sensor devices and systems, which adds a significant cost in the highly cost-sensitive automotive industry.

[0030] Subsequently, it should be realized that rather than focusing on driver support functions, especially their ability to stay in the lane (which is very costly and time-consuming for development and verification), it is better to focus on risk exposure to reduce the overall risk assessment of colliding with oncoming vehicles. More specifically, by shifting the high integrity requirements to the monitoring of the coverage of the physical barrier isolation of oncoming vehicles, the risk exposure can be controlled at a sufficiently low level such that the requirement for the driver support function's ability to stay in its own lane can be relaxed by a corresponding amount.

[0031] Furthermore, in the context of Automotive Safety Integrity Level (ASIL) classification, there are three classification categories (Severity classification (S), Exposure classification (E), and Controllability classification (C)), which can be used when determining the ASIL requirements for driver support features. It should be noted that although the following discussion is in reference to ASIL classification, the present disclosure is not limited thereto, as the same logical reasoning can be applied to any other current or future risk classification scheme used in the context of specifying the safety requirements for vehicle autonomous and semi-autonomous driving features. Therefore, the discussion related to ASIL levels and the corresponding classification categories (S, E, and C) will be understood as being used as an example to illustrate at least some of the advantages of the embodiments disclosed herein.

[0032] Thus, in the traditional case of driver support features in highway piloting or traffic jam piloting forms, there is a high exposure level (E4) to oncoming vehicles because the monitoring of the coverage of the physical risk barrier isolation is not a priority, and thus it must be assumed that there is no road safety barrier isolating the driving route. Also, the severity level is significantly high (S3) because the severity of the injury caused by the hazardous event (head-on collision) is fatal and it is difficult for the driver to prevent the injury, and thus the controllability is low (C3), i.e., once a hazardous event occurs, the driver cannot take many measures to prevent injury. Therefore, the ASIL for the ability of the driver support feature to stay in its own lane should be set to ASIL D, i.e., the vehicle system should not exceed staying in its own lane once every 10 9 hours of driving. Thus, in many cases, the task of developing and providing autonomous driving features becomes an infeasible task due to the associated huge requirements and costs.

[0033] Therefore, by shifting the focus to the exposure level, and more specifically by shifting the high ASIL requirements to the monitoring of the vehicle's surrounding environment (at design time or during operation), the ASIL requirements for the ability of the driver support feature to stay in the lane can be relaxed. More specifically, it should be realized that it is much easier to determine the existence of a high-risk environment, such as an environment without a physical barrier separating oncoming vehicles, lane merges, exits, lane additions, etc., than to ensure that the vehicle can always stay within its own lane. Therefore, by determining when the vehicle is and is not in a "high-risk environment", and ensuring that the driver support feature is only available (for activation) when the vehicle is not in such a "high-risk environment", the exposure to this operating condition can be kept at a low level (e.g., E2). Therefore, the requirements for the driver support feature to stay in the lane can be relaxed (e.g., to ASIL B).

[0034] Therefore, it can be considered that, in the traditional case, the requirement for the driver support feature to keep the vehicle in its own lane is ASIL D because the hazardous event (collision with oncoming vehicles) is associated with high severity (S3), high exposure (E4), and low controllability (C3). By concentrating this feature on an environment where it is only available to meet specific criteria (the road safety barrier between driving routes), the remaining risks are divided into two cases, collision with the barrier and collision with oncoming vehicles. The collision with the barrier may (for some speeds) be associated with low severity (S1), high exposure (E4), and low controllability (C3), which is translated into an ASIL B requirement for staying in the lane. The collision with oncoming vehicles may currently be associated with high severity (S3), low exposure (E2), and low controllability (C3), which is translated into an ASIL B requirement for staying in the lane.

[0035] Analogical reasoning can be applied to the physical separation at the road shoulder, i.e., if there is no road safety barrier at the road shoulder, there is a high exposure to the risk of collision with off-road obstacles (trees or other stationary objects). Similar to before, by shifting the ASIL requirements to the monitoring of the physical road shoulder barrier, and making the driver support function only available for sections with a sufficient probability (>99%) of having a physical road shoulder barrier, the requirements for the driver support function to keep the vehicle in its own lane can be relaxed.

[0036] Further analogical reasoning applies to lane merges, exits, lane additions, and other special high-risk sections of controlled-access highways. As previously discussed, by making the driver support function only available for sections without such road conditions, the (ASIL) requirements for avoiding collisions with other vehicles traveling on the same driving route can be reduced because the exposure to this situation is controlled (reduced).

[0037] For example, lane merges can be reduced with the ASIL B requirements of driver support features (e.g., highway pilot) to avoid collisions with vehicles during lane merges. More specifically, the ASIL B requirements can be derived, for example, from the high exposure (E4), low severity (S1), and low controllability (C3) of lane merges. However, by transforming the ASIL B requirements such that the features of the driver support function are only available on sections or lanes without lane merges, the resulting risk is associated with a low exposure level (e.g., E2), which transforms the integrity requirement of avoiding collisions with vehicles during lane merges into a quality management (QM) level. Accordingly, the verification tasks and sensor requirements related to the feature of avoiding collisions with vehicles during lane merges are alleviated. It should be understood that the availability of the driver support function can be controlled at the lane level, i.e., in some embodiments, the driver support function can be available on lanes without lane merges. Thus, even on ordinary driving routes (including multiple lanes traveling in the same direction), the driver support function is available as long as there are no lane merges in the ego lane.

[0038] More specifically, the handling of lane merges with ASIL B integrity requires significant side / rear sensing and associated verification. For driver support features such as traffic jam pilot, the aim is to minimize sensor costs, and thus ASIL-classified side / rear sensing is not required. Also, solving lane merge scenarios is a time-critical situation, which increases complexity and verification is very costly. Accordingly, the present inventors have realized that it is a simpler task to confirm that the vehicle is traveling on a section or lane with limited exposure to lane merges, and since the integrity level of avoiding collisions with vehicles during lane merges can be reduced, the remaining issues of "rare" lane merge situations can be solved with existing side / rear sensing (e.g., corner radar and fisheye cameras). An additional advantage (as for the road barrier scenario) is that the verification tasks are also reduced.

[0039] In Figure 1a FIG. 10, vehicle 1 (also referred to as the ego vehicle) travels in a first direction 21 on a section 22, herein in the form of an access-controlled highway (also referred to as a motorway, freeway, or expressway). More specifically, the access-controlled highway is a dual carriageway, where each carriageway has two lanes, and section 22 is part of one of the carriageways. A dual carriageway can be understood as a type of highway with two carriageways for traffic traveling in opposite directions separated by a central reservation 23 (also referred to as a central median 23).

[0040] The driver support function of vehicle 1 can operate within a specific Operational Design Domain (ODD). The Operational Design Domain (ODD) should be understood as a description of the operational domain in which an automated or semi-automated driving system (i.e., ADS or ADAS) is designed to operate, including but not limited to geography, roads (e.g., type, surface, geometry, edges, and markings), environment, connectivity, surrounding objects, and speed limits. Thus, the ODD of the driver support function defines a set of requirements that must be met if the driver support function is to be able to operate.

[0041] In some embodiments, the ODD includes a road safety barrier metric and a road characteristic metric, both of which need to be met if the driver support system is to be able to operate within the ODD. However, in some embodiments, the ODD includes at least one (i.e., one or both) of the road safety barrier metric and the road characteristic metric. The road safety barrier metric and the road characteristic metric are understood in this context to be parameters related to the road safety barriers and road characteristics to be met or identified in the surrounding environment of vehicle 1 in order to achieve ODD compliance.

[0042] The road safety barrier metric may include the required number of road safety barriers 24, 25, the required positions of the road safety barriers 24, 25 relative to the road section 22, and at least one required type of the road safety barriers 24, 25. For example, in some embodiments, the road safety barrier metric may stipulate that there should be a concrete barrier 24, 25 on each side of the road section 22 in the surrounding environment of vehicle 1. In some embodiments, the road safety barrier metric may involve a road safety barrier 24 (of any type) that separates two driving lanes. In this context, a road safety barrier is understood to be a traffic barrier (also known as a guardrail or crash barrier) that is designed to keep a vehicle within its road and prevent the vehicle from colliding with dangerous obstacles such as boulders, sign supports, trees, bridge piers, buildings, walls, and large stormwater pipes, or from crossing a steep (non-retreatable) slope or entering deep water. It can also be installed within the central reservation 23 of a divided highway to prevent out-of-control vehicles from entering the oncoming traffic lanes and help reduce head-on collisions.

[0043] The road characteristic metric may include the presence of an access-controlled highway without a right merge lane, a left merge lane, a right exit ramp, a left exit ramp, or a lane addition. In other words, a section of access-controlled highway has no merges, exits, lane additions, etc. Further, the road characteristic metric may include the presence of at least one lane (for traffic in the same direction) with recognizable (clear) lane markings.

[0044] In Figure 1a and Figure 1bIn the illustrated example embodiment, the required number of road safety barriers 24, 25 is two, the required location of the road safety barriers 24, 25 is one road safety barrier 24, 25 on each side of a road section 22 extending in a first direction 21, and the required type is one of a flexible road safety barrier, a rigid road safety barrier, and a semi-rigid road safety barrier. Additionally, the required road type (defined by road characteristic metrics) is an access-controlled highway without right merge lanes, left merge lanes, right exit ramps, left exit ramps, or lane additions. A flexible road safety barrier can be, for example, a wire rope supported between frangible posts, a rigid road safety barrier can be made of concrete and not deform, and a semi-rigid road safety barrier can be made of steel beams or rails designed to deform less than a flexible barrier. Also, according to the SAE J3016 driving automation levels, the driver support function is a feature of the ADS in the form of highway pilot with an automation level of level 3 or higher.

[0045] The control system of vehicle 1 includes a control circuit configured to obtain data including information about the surrounding environment of vehicle 1. Moreover, this information at least includes road safety barrier data and road characteristic data. More specifically, the obtained data may include sensor data obtained by at least one sensing device arranged to monitor the surrounding environment of vehicle 1. The sensing device can be part of the perception system of vehicle 1. The perception system is understood in this context as a system responsible for obtaining raw sensor data from sensors such as cameras, LIDAR, and RADAR, ultrasonic sensors, etc. and converting this raw data into scene understanding. In essence, the sensor data can be directly received from one or more suitable sensors (such as camera, LIDAR sensors, radar, ultrasonic sensors, etc.). However, the obtained data may also include map data obtained from an HD map module and / or position data obtained from, for example, a global navigation satellite system (GNSS) module. The data may also originate from the perception system of another vehicle 2 and be obtained by the ego vehicle 1 via a vehicle-to-vehicle (V2V) communication protocol to increase the detection redundancy of various objects and parameters in the surrounding environment.

[0046] Further, the control circuit is configured to determine the satisfaction of the ODD based on the obtained data by determining the satisfaction of road safety barrier metrics and road characteristic metrics based on the road safety barrier data and road characteristic data. Finally, if the ODD is satisfied, the control circuit is configured to generate a first control signal to control the availability of the driver support function for the road section 22, making the driver support function available to the passengers of the vehicle.

[0047] As described above, in Figure 1aIn this case, the ego-vehicle 1 is traveling on an access-controlled road, and the other vehicle 2 is traveling on two driving lanes. There is no lane merging, exit, or lane addition, but there is no road safety barrier on the access-controlled road. Therefore, the road characteristic metric is satisfied, but the road safety barrier metric is not satisfied, so the ODD of the driver support function is not satisfied. Thus, in Figure 1a In the illustrated scenario, the control circuit of the vehicle's control system is configured to control the availability 27 of the driver support function such that it is not available 28 to the passengers of the ego-vehicle. In other words, in Figure 1a In the illustrated scenario, the passengers of vehicle 1 cannot activate the highway pilot feature.

[0048] In Figure 1b In this case, the ego-vehicle is also traveling on an access-controlled road, and the other vehicle 2 is traveling on two driving lanes. There is no lane merging, exit, or lane addition, but there are (rigid) concrete road safety barriers 24, 25 on both sides of the section 22 where the ego-vehicle is currently traveling. Therefore, both the road characteristic metric and the road safety barrier metric are satisfied, so the ODD of the driver support function is satisfied. Thus, the control circuit of the vehicle's control system is configured to control the availability 27 of the driver support function such that it is available 29 to the passengers of the ego-vehicle 1. In other words, in Figure 1b In the illustrated scenario, the passengers of vehicle 1 can activate the highway pilot feature.

[0049] More specifically, the acquired data may include sensor data acquired by at least one sensing device arranged to monitor the surrounding environment of vehicle 1. Thus, the control circuit may be configured to determine the satisfaction of the road safety barrier metric by determining the presence of multiple road safety barriers 24, 25 in the surrounding environment. Subsequently, if there is at least one road safety barrier in the surrounding environment of the vehicle, the position and type of one or more road safety barriers 24, 25 are determined. Now, vehicle 1 has a perception of the surrounding environment based on various road safety barrier parameters. Therefore, determining whether the road safety barrier metric is satisfied may be based on whether the required number of road safety barriers, the required position of the road safety barrier relative to the section, and at least one required type of road safety barrier are satisfied. As described above, these road safety barrier parameters may be obtained from other information sources, such as HD map data, the perception systems of other vehicles 2, etc.

[0050] Similarly, the control circuit is configured to determine the satisfaction of the road characteristic metric by: determining the road type of section 22 based on the acquired road characteristic data, and determining that the road characteristic metric is satisfied if the determined road type corresponds to an access-controlled road without a right merge lane, a left merge lane, a right exit ramp, a left exit ramp, or a lane addition. Similar to the road safety barrier parameters, the road characteristic data can also be obtained from other information sources (e.g., HD map data, the sensing system of other vehicle 2, etc.).

[0051] To estimate whether the ODD will be satisfied at an upcoming portion of the section (e.g., during the next 1000 meters, 2000 meters, or 5000 meters), it is advantageous to obtain road safety barrier data and road characteristic data from sources such as the sensing systems of other vehicles and HD map data.

[0052] Moreover, although specific examples of the road safety barrier metric and the road characteristic metric have been discussed, a reader skilled in the art will recognize that the illustrated parameters can be combined in other ways than those explicitly described. For example, the road characteristic metric can specify that the ODD includes an access-controlled road without a right exit unless there is a road safety barrier on each side of the section. If there is a road safety barrier on each side of the section, the ODD is satisfied even if the vehicle is traveling on an access-controlled road with an exit on the right. Also, the term section will be interpreted broadly, and the driver support feature can operate in different ODDs depending on which lane of the section the vehicle is in. For example, in some embodiments, if the ego lane (i.e., the vehicle's current lane) is the leftmost lane of the driving route and there is a road safety barrier on the left side of the lane, the ODD is satisfied. Similarly, in some embodiments, if the ego lane is the rightmost lane of the driving route and there is a road safety barrier on the right side of the ego lane, the ODD can be satisfied.

[0053] Figure 2 is a schematic diagram or graph illustrating a method for controlling a driver support function of an autonomous vehicle according to an embodiment of the present disclosure. More specifically, Figure 2 The schematic diagram is used to illustrate how the availability of the driver support function is controlled while the vehicle is traveling during a time period from t0 to t4. The vehicle has a driver support function for autonomous operation of the vehicle, e.g., in the form of highway piloting or traffic jam piloting. Moreover, the driver support function can operate within an ODD that includes a road safety barrier metric and a road characteristic metric. In the illustrated example and in the following discussion related to the illustrated example, the ODD (within which the driver support function can operate) is denoted as ODD 1.

[0054] For Figure 2For the related discussion, it will be assumed that the same road safety barrier metrics and road characteristic metrics are used. In other words, there are two requirements for the road safety barrier, the required location of the road safety barrier is one road safety barrier on each side of the road section extending in the first direction, and the required type is one of a flexible road safety barrier, a rigid road safety barrier, and a semi-rigid road safety barrier. Additionally, the required road type (defined by the road characteristic metrics) is an access-controlled highway without right merge lanes, left merge lanes, right exit ramps, left exit ramps, or lane additions.

[0055] For the first sub-period [t0, t1] of the time period [t0, t4], the vehicle travels on the first road section of the access-controlled highway. More specifically, the vehicle travels on a road section that satisfies the ODD for the driver support function. Accordingly, a control signal is generated to control the availability of the driver support function for the road section on which the vehicle is currently traveling. More specifically, since the ODD is satisfied, the control signal is configured to make the driver support function available to the passengers of the vehicle. The driver support function being available is to be interpreted as the driver support function being available for activation so that the driver support function assumes control of the vehicle platform.

[0056] During the second sub-period [t1, t2] of this time period, the vehicle travels on a second road section that includes a lane merge. Accordingly, the road characteristic metrics are not satisfied, and thus the ODD for the driver support function is not satisfied. Accordingly, a control signal is generated to make the driver support function unavailable to the passengers of the vehicle while the vehicle is in an environment where the ODD for the driver support function is not satisfied.

[0057] Moreover, in some embodiments, a second control signal is generated during the first sub-period [t0, t1] to prepare for the handover from the driver support function to the passengers of the vehicle and optionally issue the following warning (e.g., via the vehicle's human-machine interface (HMI)): the driver support function will be unavailable when the vehicle enters the upcoming road section (i.e., the second road section). The lane merge can be represented, for example, from HD map data or communicated from a vehicle ahead via the V2V communication protocol.

[0058] Moreover, in some embodiments, when the vehicle enters the second road section, a third control signal is generated to prompt the passengers of the vehicle to perform the handover from the driver support function to the passengers of the vehicle. If the handover is confirmed by the passengers of the vehicle, a fourth control signal is generated to perform the handover. However, if the handover is not confirmed by the passengers of the vehicle, a fifth control signal is generated to initiate a safety maneuver (e.g., perform "DDT support (Fall-back)").

[0059] Further, while the vehicle is traveling on the second section, a second control signal may be generated to indicate to the passengers of the vehicle the availability of the driver support function for the upcoming section (i.e., the section traveled between t2 and t3), since the road safety barrier data and the road characteristic data indicate that the ODD is met at the upcoming part of this section. The road safety barrier data and the road characteristic data may be obtained, for example, from HD map data or from a vehicle ahead via the V2V communication protocol.

[0060] Therefore, when the vehicle enters the third section at time t2, a control signal is generated to make the driver support function available to the passengers of the vehicle. Similar to the previous discussion related to the second section [t1, t2], the fourth section [t3, t4] is associated with an environment where the ODD for the driver support feature is not met because there is no shoulder barrier.

[0061] Figure 3 is a schematic flowchart of a method 300 for controlling a driver support function of a vehicle that autonomously maneuvers along a first direction on a section. Moreover, the vehicle has a driver support function for autonomously maneuvering the vehicle, and the driver support function is capable of operating within the ODD. The ODD defines a road safety barrier metric and a road characteristic metric. In this context, the driver support function being capable of operating within the ODD can be understood as: while the vehicle is in an environment that meets the driver support function, the driver support function is set to generate a control signal to control acceleration, deceleration, steering angle, activation of the turn indicator, etc. The ODD includes a road safety barrier metric and a road characteristic metric.

[0062] Method 300 includes: obtaining 301 data including information about the vehicle's surrounding environment. This data can be sensor data generated by the vehicle's perception system, map data (e.g., HD map data), and / or sensor data generated by the perception system of another vehicle and transmitted to the ego vehicle. The sensor data includes road safety barrier data and road characteristic data.

[0063] Further, method 300 includes: determining 302 the satisfaction of the ODD based on the obtained data by respectively determining 304 the satisfaction of the road safety barrier metric and determining 305 the satisfaction of the road characteristic metric based on the road safety barrier data and the road characteristic data. Determining the satisfaction of the metric can be accomplished, for example, by analyzing the data obtained 301 to verify the presence or absence of one or more conditions, parameters, or objects defined by the metric. One or more conditions, parameters, or objects defined by the metric can be retrieved, for example, from a local or remote data warehouse 310.

[0064] Further, method 300 includes: generating a control signal to control the availability of the driver support function 303 for the section, where the availability 306 or unavailability 307 of the driver support function depends on whether the ODD is met, as illustrated previously.

[0065] Method 300 may further include: generating a control signal to initiate and perform 308 a handover to the driver if the vehicle is traveling towards an environment where the ODD is not met. Moreover, if the handover is not confirmed by the driver of the vehicle and the vehicle enters an environment where the ODD is not met, method 300 may include initiating and performing 309 a safety maneuver (e.g., performing DDT support such as "safe stop" or "back-up stop").

[0066] Optionally, the executable instructions for performing these functions are included in a non-transitory computer-readable storage medium or other computer program product configured to be executed by one or more processors.

[0067] Figure 4 is a schematic side view of vehicle 1 including the control system 10 of vehicle 1. Vehicle 1 has a driver support function for autonomous control of the vehicle when driving on a section. In some embodiments, according to the SAE J3016 driving automation level (also referred to as AD features), the driver support function is an ADS function with an automation level of level 3 or higher. The driver support function is capable of operating within a specific operational design domain (ODD). The ODD includes road safety barrier metrics and road characteristic metrics.

[0068] Vehicle 1 further includes a perception system 6 and a positioning system 5. The perception system 6 is understood in this context as a system responsible for obtaining raw sensor data from sensors 6a, 6b, 6c such as cameras, LIDAR, RADAR, and ultrasonic sensors and converting the raw data into a scene understanding. The positioning system 5 is configured to monitor the geographical location and traveling direction of the vehicle and may be in the form of a global navigation satellite system (GNSS) such as GPS. However, alternatively, the positioning system may also be implemented as real-time kinematic (RTK) GPS to improve accuracy. The positioning system may include or be associated with an HD map module. The HD map is understood in this context as a map including data with a highly accurate and true representation of the road on which vehicle 1 travels. More specifically, the HD map can be understood as a map specifically constructed for the purpose of autonomous driving. These maps have extremely high accuracy, typically at the centimeter level. Moreover, the map usually contains information such as where the lanes are, where the road boundaries are, where the curves are, and how curved the curves are.

[0069] The control device 10 includes one or more processors 11, a memory 12, a sensor interface 13, and a communication interface 14. The processor 11 may also be referred to as a control loop 11 or a control circuit 11. The control loop 11 is configured to execute instructions stored in the memory 12 to perform a method for controlling a vehicle according to any of the embodiments disclosed herein. In other words, the memory 12 of the control device 10 may include one or more (non-transitory) computer-readable storage media for storing computer-executable instructions that, when executed by one or more computer processors 11, may cause the computer processors 11 to perform the techniques described herein. Optionally, the memory 12 includes high-speed random access memory (such as DRAM, SRAM, DDRRAM, or other random access solid-state memory devices), and optionally includes non-volatile memory (such as one or more disk storage devices, optical disk storage devices, flash memory devices, or other non-volatile solid-state storage devices).

[0070] More specifically, the control circuit 11 is further configured to obtain data from the perception system 6 and / or the positioning system 5 of the vehicle 1. This data includes information about the vehicle's surrounding environment, and more specifically, includes road safety barrier data and road characteristic data. The control circuit 11 is further configured to determine the satisfaction of the ODD based on the obtained data. Moreover, if the ODD is satisfied, the control circuit 11 is configured to generate a first control signal to control the availability of the driver support function for this section of the road, so that the driver support function is available to the passengers of the vehicle while the vehicle is in an environment where the ODD is satisfied.

[0071] Further, the vehicle 1 may be connected to an external network 20 (e.g., for retrieving map data) via, for example, a wireless link. The same or some other wireless link may be used to communicate with other vehicles 2 near the vehicle or with local infrastructure elements. Cellular communication technologies may be used for long-distance communication, such as communication to the external network, and if the cellular communication technology used has low latency, it may also be used for communication between vehicles, vehicle-to-vehicle (V2V) and / or vehicle-to-infrastructure V2X communication. Examples of cellular radio technologies are GSM, GPRS, EDGE, LTE, 5G, 5G NR, etc., and also include future cellular solutions. However, in some solutions, medium-range to short-range communication technologies are used, such as wireless local area network (LAN) (e.g., IEEE 802.11-based solutions). ETSI is researching cellular standards for vehicle communication, and 5G, for example, is considered a suitable solution because of its low latency and effective handling of high bandwidth and communication channels.

[0072] The present disclosure has been presented above with reference to specific embodiments. However, other embodiments besides the above embodiments are possible and within the scope of the present disclosure. Method steps different from the above method steps may be provided within the scope of the present disclosure by hardware or software. Thus, according to an exemplary embodiment, there is provided a non-transitory computer-readable storage medium storing one or more programs, the one or more programs being configured to be executed by one or more processors of a vehicle control system, the one or more programs including instructions for performing the method according to any of the above embodiments. Alternatively, according to another exemplary embodiment, a cloud computing system may be configured to execute any method presented herein. The cloud computing system may include distributed cloud computing resources that jointly execute the methods presented herein under the control of one or more computer program products.

[0073] Generally, computer-accessible media may include any tangible or non-transitory storage medium or memory medium such as an electrical, magnetic, or optical medium (e.g., a disk or CD / DVD-ROM coupled to a computer system via a bus). As used herein, the terms "tangible" and "non-transitory" are intended to describe computer-readable storage media (or "memory") that do not include propagated electromagnetic signals, but are not intended to otherwise limit the types of physical computer-readable storage devices encompassed by the term computer-readable medium or memory. For example, the term "non-transitory computer-readable medium" or "tangible memory" is intended to include types of storage devices that do not necessarily permanently store information, including, for example, random access memory (RAM). Program instructions and data stored in a tangible computer-accessible storage medium in non-transitory form may further be transmitted via a transmission medium or signal such as an electrical signal, an electromagnetic signal, or a digital signal, which may be conveyed via a communication medium such as a network and / or a wireless link.

[0074] Processor 11 (associated with control device 10) may be or include any number of hardware components for performing data or signal processing or for executing computer code stored in memory 12. Device 10 has an associated memory 12, and memory 12 may be one or more devices for storing data and / or computer code for performing the various methods described in this specification. The memory may include volatile memory or non-volatile memory. Memory 12 may include database components, object code components, script components, or any other type of information structure for supporting the various activities of this specification. According to an exemplary embodiment, any distributed or local storage device may be used with the systems and methods of this specification. According to an exemplary embodiment, memory 12 may be communicatively coupled to processor 11 (e.g., via a loop or any other wired, wireless, or network connection) and includes computer code for performing one or more of the processes described herein.

[0075] It should be understood that the sensor interface 13 may also provide the possibility of obtaining sensor data directly or via the dedicated sensor control circuit 6 in the vehicle. The communication / antenna interface 14 may further provide the possibility of sending an output to a remote location (e.g., a remote operator or a control center) by means of the antenna 8. Moreover, some sensors in the vehicle may communicate with the control device 10 using a local network setup such as CAN bus, I2C, Ethernet, fiber optic, etc. The communication interface 14 may be arranged to communicate with other control functions of the vehicle and may therefore also be regarded as a control interface; however, a separate control interface (not shown) may also be provided. The local communication within the vehicle may also be of the wireless type, having protocols such as WiFi, LoRa, Zigbee, Bluetooth or similar medium / short-range technologies.

[0076] Therefore, it should be understood that parts of the described solution may be implemented in the vehicle, in a system located outside the vehicle, or in a combination of inside and outside the vehicle, e.g., in a server communicating with the vehicle, i.e., a so-called cloud solution. For example, the sensor data may be sent to an external system, and the system performs steps to determine whether the ODD is satisfied. The different features and steps of the embodiments may be combined in other combinations different from those described.

[0077] It should be noted that the word "comprising" does not exclude the presence of other elements or steps in addition to those listed, and the word "a" preceding an element does not exclude the presence of a plurality of such elements. It should be further noted that any reference signs do not limit the scope of the claims, and the present disclosure may be implemented at least in part by both hardware and software, and some "devices" or "units" may be represented by the same hardware item.

[0078] Moreover, although the control system and method have been described in connection with driver support features capable of operating within an ODD including both road safety barrier metrics and road characteristic metrics. However, in some embodiments, the driver support features are capable of operating within an ODD including at least one of road safety barrier metrics and road characteristic metrics. Therefore, the data obtained, including information about the surrounding environment, may include at least one of road safety barrier data and road characteristic data. For example, if the ODD only has road safety barrier metrics, the data obtained includes information containing road safety barrier data. Similarly, if the ODD only has road characteristic metrics, the data obtained includes information containing road characteristic data. In these cases, the satisfaction of the ODD may be based on the data obtained by determining the satisfaction of one or both of the road safety barrier metrics and road characteristic metrics.

[0079] Although the figures may show a specific order of method steps, the order of the steps may be different from the described order. In addition, two or more steps may be performed simultaneously or partially simultaneously. Such variations will depend on the selected software and hardware systems and the choices of the designer. All such variations are within the scope of the present disclosure. Similarly, the software implementation may be achieved using standard programming techniques with rule-based logic and other logics to accomplish various connection steps, processing steps, comparison steps, and decision steps. The embodiments mentioned and described above are given only as examples and should not be limited to the present disclosure. Other solutions, uses, purposes, and functions within the scope of the present disclosure claimed in the patent embodiments described below should be obvious to those skilled in the art.

Claims

1. A control system for a vehicle traveling along a first direction on a road section, wherein, The vehicle has a driver support function for autonomously controlling the vehicle, wherein the driver support function is capable of operating within an Operational Design Domain (ODD) including a road safety barrier metric and a road characteristic metric, and wherein the control system includes a control circuit configured to: Obtain data including information about the vehicle's surrounding environment, the information including road safety barrier data and road characteristic data; Determine the satisfaction of the road safety barrier metric and the road characteristic metric by determining the satisfaction of the ODD based on the obtained data, wherein the road safety barrier metric includes a required number of road safety barriers, a required position of the road safety barrier relative to the section, and at least one required type of road safety barrier; If the ODD is satisfied, generate a first control signal to control the availability of the driver support function for the section, so that the driver support function is available to the passengers of the vehicle.

2. The control system according to claim 1, Among them, The obtained data includes sensor data obtained by at least one sensing device arranged to monitor the vehicle's surrounding environment, and wherein the control circuit is configured to determine the satisfaction of the road safety barrier metric by the following steps: Determine the presence of a plurality of road safety barriers in the vehicle's surrounding environment based on the obtained road safety barrier data; and If there is at least one road safety barrier in the vehicle's surrounding environment, then: Determine the position of the at least one road safety barrier relative to the section; and Determine the type of the at least one road safety barrier; and If the required number of road safety barriers, the required position of the road safety barrier relative to the section, and at least one required type of road safety barrier are satisfied, determine that the road safety barrier metric is satisfied.

3. The control system according to claim 2, wherein, The step of determining the type of the at least one road safety barrier includes: for each road safety barrier of the at least one road safety barrier, determining whether the road safety barrier is one of a flexible road safety barrier, a rigid road safety barrier, and a semi-rigid road safety barrier.

4. The control system according to claim 2 or 3, wherein, The required number of road safety barriers is two, the required position of the road safety barrier is one road safety barrier on each side of the section extending in the first direction, and the required type is one of a flexible road safety barrier, a rigid road safety barrier, and a semi-rigid road safety barrier.

5. The control system according to any one of claims 2 or 3, wherein, The road characteristic metric includes the presence of an access-controlled highway without a right merge lane, a left merge lane, a right exit ramp, a left exit ramp, or a lane addition, and wherein the control circuit is configured to determine the satisfaction of the road characteristic metric by: Determine the road type of the section based on the obtained road characteristic data; and If the determined road type corresponds to an access-controlled highway without a right merge lane, a left merge lane, a right exit ramp, a left exit ramp, or a lane addition, then it is determined that the road characteristic measure is satisfied.

6. The control system according to any one of claims 1-3, wherein, The data obtained includes map data and the geographical location of the vehicle.

7. The control system according to any one of claims 1-3, wherein, The control circuit is further configured to: Determine the satisfaction of the road safety barrier measure and the road characteristic measure of the upcoming portion of the section by based on the road safety barrier data and the road characteristic data associated with the upcoming portion of the section, to determine the satisfaction of the ODD of the upcoming portion of the section along the first direction; Generate a second control signal to: If the road safety barrier data and the road characteristic data indicate that the ODD is not satisfied at the upcoming portion of the section, prepare for the handover from the driver support function to the passenger of the vehicle; Or If the road safety barrier data and the road characteristic data indicate that the ODD is satisfied at the upcoming portion of the section, indicate to the passenger of the vehicle the availability of the driver support function for the upcoming section.

8. The control system according to claim 7, wherein, The control circuit is further configured to: When the vehicle enters the upcoming portion of the section and the second control signal is generated to prepare for the handover, generate a third control signal to prompt the passenger of the vehicle to perform the handover from the driver support function to the passenger of the vehicle; If the handover is confirmed by the passenger of the vehicle, generate a fourth control signal to perform the handover; Or If the handover is not confirmed by the passenger of the vehicle, generate a fifth control signal to initiate a safety maneuver.

9. A vehicle, comprising: A positioning system for monitoring the geographical location of the vehicle; A sensing system including at least one sensor for monitoring the surrounding environment of the vehicle; The control system according to claim 1.

10. A method for controlling a driver support function of a vehicle that autonomously drives along a first direction on a road section, wherein, The driver support function is capable of operating within an Operational Design Domain (ODD) including a road safety barrier measure and a road characteristic measure, and the method includes: Obtain data including information about the surrounding environment of the vehicle, the information including road safety barrier data and road characteristic data; Determine the satisfaction of the road safety barrier measure and the road characteristic measure by based on the road safety barrier data and the road characteristic data, to determine the satisfaction of the ODD based on the data obtained, wherein the road safety barrier measure includes the required number of road safety barriers, the required position of the road safety barrier relative to the section, and at least one required type of road safety barrier; If the ODD is satisfied, generate a control signal to control the availability of the driver support function for the section, to make the driver support function available to the passenger of the vehicle.

11. According to the method of claim 10, Among them, The acquired data includes sensor data acquired by at least one sensing device configured to monitor the surrounding environment of the vehicle, and wherein the step of determining the satisfaction of the ODD includes: determining the presence of a plurality of road safety barriers in the surrounding environment of the vehicle based on the acquired road safety barrier data; and if there is at least one road safety barrier in the surrounding environment of the vehicle, then: determining the position of the at least one road safety barrier relative to the road section; and determining the type of the at least one road safety barrier; and if the required number of road safety barriers, the required position of the road safety barrier relative to the road section, and at least one required type of the road safety barrier are satisfied, determining that the road safety barrier metric is satisfied.

12. The method according to claim 11, wherein, The step of determining the type of the at least one road safety barrier includes: for each road safety barrier of the at least one road safety barrier, determining whether the road safety barrier is one of a flexible road safety barrier, a rigid road safety barrier, and a semi-rigid road safety barrier.

13. The method according to claim 10, further comprising: determining the satisfaction of the ODD of the upcoming portion of the road section by determining the satisfaction of the road safety barrier metric and the road characteristic metric of the upcoming portion of the road section based on the road safety barrier data and the road characteristic data associated with the upcoming portion of the road section, to determine the satisfaction of the ODD of the upcoming portion of the road section along the first direction; generating a second control signal to: if the road safety barrier data and the road characteristic data indicate that the ODD is not satisfied at the upcoming portion of the road section, prepare for the handover from the driver support function to the passenger of the vehicle; or if the road safety barrier data and the road characteristic data indicate that the ODD is satisfied at the upcoming portion of the road section, indicate to the passenger of the vehicle the availability of the driver support function for the upcoming road section.

14. The method according to claim 13, further comprising: when the vehicle enters the upcoming portion of the road section and the second control signal is generated to prepare for the handover, generating a third control signal to prompt the passenger of the vehicle to perform the handover from the driver support function to the passenger of the vehicle; if the handover is confirmed by the passenger of the vehicle, generating a fourth control signal to perform the handover; or if the handover is not confirmed by the passenger of the vehicle, generating a fifth control signal to initiate a safety maneuver.

15. A computer-readable storage medium storing one or more programs configured to be executed by one or more processors of a vehicle control system, the one or more programs including instructions for performing the method according to any one of claims 10-14.

Images