Method, control device and storage medium for authenticating map elements

Abstract

A method for authenticating map elements of safety-critical driving functions via a control device is disclosed. After a mapping step is performed, at least one observation parameter for at least one mapping step of at least one map element is obtained via at least one monitoring function, and the observation parameter is compared with an expected value. Based on the comparison of the observation parameter with the expected value for at least one mapping step, at least one result value is calculated via the monitoring function, and the at least one result value is stored as a certificate and associated with the at least one map element. Furthermore, a control device, a computer program, and a computer-readable storage medium are disclosed.

Description

Technical Field

[0001] The present invention relates to a method for authenticating map elements for safety-critical driving functions, a control device, a computer program, and a machine-readable storage medium. Background Technology

[0002] Automated driving functions and vehicles equipped with them are becoming increasingly important. Current and accurate maps are essential for the successful implementation of automated driving functions.

[0003] By using digital maps for automated driving functions, the limited sensor range and occlusion of the scanning area of ​​vehicle sensors can be compensated for, and complete environmental perception can be achieved.

[0004] Furthermore, digital maps can be generated externally to the vehicle's surroundings using typically higher computing power, allowing for the processing and delivery of more complex algorithms and larger data volumes. Using maps via vehicle-side control devices requires less computing power compared to generating maps externally to the vehicle.

[0005] However, using maps generated outside the vehicle for safety-critical functions is problematic. If the vehicle's automated driving functions use digital maps, errors and inaccuracies in map generation could lead to dangerous traffic situations. Summary of the Invention

[0006] The objective of this invention is to propose a method for using maps in safety-critical driving functions.

[0007] According to one aspect of the present invention, a method is provided for authenticating map elements of safety-critical driving functions via a control device. Preferably, the authentication can be performed by a control device or server unit external to the vehicle.

[0008] Authentication can be performed on each digital map element (such as a map section or map tile) or the entire digital map.

[0009] In one step, after the mapping step is performed, at least one observation parameter of at least one mapping step for at least one map element is obtained through a monitoring function, and the observation parameter is compared with the expected value of the observation parameter. The mapping step may preferably be performed by a control device.

[0010] Mapping can be performed, for example, using graph-based modeling methods. For instance, graph SLAM methods can be used to explicitly model vehicle position and orientation (i.e., so-called vehicle attitude). The following exemplary mapping steps are implemented: Alignment

[0011] - receiving, by the control device, measurement data taken by sensors of the plurality of mapping vehicles.

[0012] - pre-processing the received measurement data.

[0013] - geometrically aligning the measurement data received by different mapping vehicles. The alignment can be performed by means of static landmarks and features which can be found in different sets of measurement data by the control device.

[0014] - after the alignment, the position of the static landmarks and the pose of the mapping vehicles can be taken.

[0015] - in a further mapping step, a localization map can be generated from the landmarks. From the sequence of vehicle poses, a trajectory of the mapping vehicle can be derived.

[0016] - in the set of measurement data, foreign trajectories of other traffic participants are included. Based on the vehicle trajectories and the foreign trajectories, a map summarizing the historical behavior of the other traffic participants can be derived.

[0017] - in addition to analyzing the trajectories, the landmarks can be further processed into a planning map.

[0018] Here, the monitoring function can be implemented after one, more or each of the exemplary mentioned mapping steps in order to verify the respective mapping step and thus to ensure correct and precise map generation.

[0019] In a further step, at least one result value is calculated by the monitoring function depending on the comparison of the observed quantity with the expected value of the observed quantity for at least one mapping step.

[0020] The result value may, for example, represent the accuracy or quality of the respective mapping step and thus evaluate at least one completed mapping step.

[0021] Preferably, the result value can be used to adhere to a determined accuracy or a determined quality during the mapping step. If the predefined result value is not reached, no certificate can be issued and the map elements cannot be used for safety-critical applications.

[0022] Then, if at least one result value or all calculated result values adhere to a tolerance range, at least one result value is stored as a certificate. The generated certificate is then associated with at least one map element.

[0023] At least one map element with the associated certificate is provided to a traffic participant, so that the traffic participant can implement an automated driving function.

[0024] In the plurality of mapping steps checked by the monitoring function, the respective result values of the individual mapping steps can be summarized, for example by a total value, in order to technically simplify further operations and certificate generation.

[0025] In generating the total value, the respective result values can be weighted differently or identically.

[0026] The at least one map element can be provided together with the associated certificate to a vehicle for performing an automated driving function via a communication connection.

[0027] Before using the map element, the total value stored in the certificate for this map element can be decoded in the vehicle or by a computing unit on the vehicle side. If the total value is positive or lies within a tolerance range, the map element can then be used by the automated driving function or a localization unit of the vehicle.

[0028] According to another aspect of the application, a control device is provided, wherein the control device is configured to implement the method. The control device can be, for example, a control device on the vehicle side, a control device outside the vehicle or a server unit outside the vehicle, for example a cloud system.

[0029] Furthermore, according to an aspect of the application, a computer program is provided, which comprises instructions which, when the computer program is implemented by a computer or a control device, cause the computer or the control device to implement the method according to the application. According to another aspect of the application, a machine-readable storage medium is provided, on which the computer program according to the application is stored.

[0030] According to the BASt standard, the vehicle can be assisted automation, partially automated, highly automated and / or fully automated, that is to say capable of operating without a driver.

[0031] The vehicle can be, for example, a passenger car, a heavy goods vehicle, an automated taxi, etc. The vehicle is not limited to operating on roads. Rather, the vehicle can also be configured as a ship, an aircraft, for example a transport drone, etc.

[0032] By means of the method, different map levels, for example a localization map, a planning map, etc., can be checked during mapping, thereby ensuring that map elements are used for safety-critical functions of the vehicle. The map elements checked by the monitoring function can meet the requirements of the ISO 26262 standard, in particular.

[0033] According to one embodiment, the at least one mapping step is performed as a pre-processing of the measurement data of the at least one sensor, an alignment of the pre-processed measurement data, a generation of a localization map, a generation of a behavior map of traffic participants and / or a generation of a planning map.

[0034] By using the monitoring functions it can be ensured that all important relevant components or sections for the map generation are monitored. By this measure the safety of the overall system is increased.

[0035] For example, in a mapping step which is configured to pre-process the measurement data, the monitoring function can use observation variables in the form of the number of measurement data sets, the age of the measurement data and the weather during the measurement data acquisition and compare them with expected values. The monitoring function can use, for example, as expected values the number of measurement data sets "at least five", the age of the measurement data "at most three hours" and the weather "not damaging the sensor device".

[0036] If the alignment step of the measurement data is verified using a monitoring function, so-called Olson's Loops can be used as quality measure or observation variable. The expected value can be, for example, at most 0.05.

[0037] After the generation of the positioning map (as further mapping step), the monitoring function can consider a certain number of positioning features as observation variable. The certain number of positioning features can comprise, for example, at least 50 landmarks.

[0038] The mapping steps performed for the generation of the behavior map can also be checked by a monitoring function. For example, there can be a number of different traffic participants' used behavior patterns of at least 100 measurement data sets in order to enable a positive evaluation of the mapping step by the monitoring function.

[0039] The subsequent generation of the planning map can be checked by a monitoring function in order to exclude, for example, contradictions between the map and legal provisions. For example, the number of detected contradictions (for example, a speed limit of 100 km / h in a closed residential area, whereas it should be 50 km / h) can be used as observation variable by the checking function. The expected value of the number of contradictions should not deviate from zero.

[0040] The at least one monitoring function can be configured, for example, as a software module which can be executed by the control device.

[0041] According to a further embodiment, a monitoring function is implemented after each mapping step in order to determine and verify the observation variable of the respective mapping step. By this measure it can be ensured that all important relevant components for the map generation are monitored, whereby the safety of the overall system is increased.

[0042] According to a further embodiment, at least one result value determined by the monitoring function after each mapping step is transmitted by a communication connection to a protected processing unit, for example a protected SPS hardware unit, wherein the at least one result value is stored as a certificate by the protected processing unit.

[0043] Preferably, the results of the monitoring function or, respectively, the results of the monitoring function carried out after each mapping step can be transmitted to the protected processing unit by a protected communication.

[0044] The processing unit can logically associate the result values of the monitoring function carried out for each mapping step to the values of each mapping element. Here, the result values which have been determined by the different mapping steps by means of the monitoring function can be weighted. For example, the result values of the pre-processing of the measurement data can be weighted more weakly than the result values of the alignment of the measurement data.

[0045] For example, the processing unit can be configured as a cluster of multiple fail-safe SPS hardware elements, thereby providing a security concept similar to the so-called AVP security concept.

[0046] According to a further embodiment, the result values determined by the monitoring function are transmitted to the protected processing unit by an encrypted communication connection. By this measure, the result values can additionally be protected before the processing unit aggregates the result values to a total value.

[0047] According to a further embodiment, a certificate is generated for each map element, wherein the certificate has a total value which aggregates all result values determined by the monitoring function. Thereby, a digital map composed of multiple map elements can be divided into multiple partial sections, so that the safety-critical function can be certified section by section. Thereby, the digital map can be used at least section by section for the automated driving function of the vehicle.

[0048] Preferably, the total value of the monitoring function can be added to the respective map element in the form of a certificate and transmitted to the vehicle or a computing unit of the vehicle by a protected communication connection.

[0049] According to a further embodiment, a certificate is generated for each map element, wherein the certificate has all result values determined by the monitoring function. With this configuration, not only the aggregated total value is stored in the map element, but also each result value of the monitoring function is stored separately in the form of a certificate.

[0050] Thereby, the decision about the weighting of the result values of the monitoring function can be taken by a computing unit of the vehicle which uses the map elements. BRIEF DESCRIPTION OF DRAWINGS

[0051] The preferred embodiments of the application are further explained in the following according to highly simplified schematic drawings. The drawings show:

[0052] Figure 1 a schematic diagram of a vehicle arrangement for illustrating the described method;

[0053] Figure 2A schematic flow chart for illustrating a method according to an embodiment is shown. DETAILED DESCRIPTION

[0054] Figure 1 A schematic diagram for illustrating a vehicle arrangement 1 for a method 2 is shown. The vehicle arrangement 1 has one or more mapping vehicles 4.

[0055] The mapping vehicle 4 can for example be a passenger car equipped with a sensor device for detecting the surrounding environment.

[0056] The mapping vehicle 4 has a sensor 6 for collecting measurement data of the surrounding environment U.

[0057] The sensor 6 can be configured as a lidar sensor, a radar sensor, a camera sensor, etc.

[0058] The measurement data can be collected by a computing unit 8 on the vehicle side and transmitted to a control device 12 outside the vehicle via a communication connection 10.

[0059] The communication connection 10 can for example be based on the transmission standards WLAN, UMTS, GSM, 4G, 5G, etc.

[0060] The control device 12 is configured as a server unit outside the vehicle and can receive the measurement data of the mapping vehicle 4 and use the measurement data to generate a digital map.

[0061] Preferably, the control device 12 can generate and certify the digital map by a plurality of mapping steps, so that the digital map is provided to a vehicle 14 or a road user via a further communication connection 11 for implementing an automated driving function.

[0062] A schematic flow chart for illustrating a method 2 according to an embodiment is shown in Figure 2 The method 2 serves to certify map elements of safety-critical driving functions by the control device 12. The mapping is carried out section by section or map element by map element. For simplicity, the method 2 is described in terms of map elements.

[0063] In a step 16, a first mapping step is carried out. The first mapping step can for example comprise a pre-processing or alignment of the received measurement data.

[0064] Then, after carrying out the first mapping step, at least one observation quantity of the first mapping step 16 is determined by a first monitoring function 17 and compared with an expected value of the observation quantity.

[0065] A monitoring function 17, 19, 21 is implemented after each mapping step 16, 18, 20 in order to obtain and verify the observation quantities of the respective mapping step 16, 18, 20.

[0066] As an exemplary second mapping step 18, for example, a positioning map can be generated. An exemplary third mapping step 20 can comprise generating a behavior map of the traffic participants and / or generating a planning map. Further intermediate steps or further mapping steps can be implemented, which are not shown for the sake of clarity.

[0067] A monitoring function 17, 19, 21 is implemented after each mapping step 16, 18, 20. Preferably, the monitoring functions 17, 19, 21 can be matched to the mapping steps 16, 18, 20.

[0068] From a comparison of the observation quantities with expected values of the observation quantities, at least one result value is calculated by the monitoring function.

[0069] The result values obtained by the monitoring function are transmitted to a protected processing unit 22. The protected processing unit 22 can be configured, for example, as a protected SPS hardware unit.

[0070] The received result values are summarized 24 by the protected processing unit 22 into a total value. Here, the respective result values can be weighted to different extents.

[0071] In a further step 26, the total value is stored in the form of a certificate and is associated with the map element.

[0072] The map element authenticated in this way can then be provided 28 to the traffic participants 14.

Claims

1. A method (2) for certifying map elements of safety-critical driving functions by a control device (12), wherein after implementing a mapping step (16, 18, 20), at least one observed quantity of at least one mapping step (16, 18, 20) of at least one map element is ascertained by at least one monitoring function (17, 19, 21) and compared with an expected value of the observed quantity; as a function of the comparison of the observed quantity with the expected value of the observed quantity for the at least one mapping step (16, 18, 20), at least one result value is calculated by the monitoring function (17, 19, 21) as a verification of the quality of the mapping step (16, 18, 20); the at least one result value is stored as a certificate and associated with the at least one map element; the at least one map element with the certificate is provided to a road user (14), wherein after each mapping step (16, 18, 20) of a plurality of mapping steps (16, 18, 20) a monitoring function (17, 19, 21) is respectively implemented in order to ascertain and verify an observed quantity of the respective mapping step (16, 18, 20), wherein the monitoring function (17, 19, 21) is matched to the respective mapping step (16, 18, 20), wherein the plurality of mapping steps (16, 18, 20) comprises a preprocessing of measurement data of at least one sensor (6) and an alignment of the preprocessed measurement data, wherein in a mapping step configured to preprocess the measurement data the monitoring function uses and compares with expected values the observed quantities of the number of measurement data sets, the age of the measurement data and the weather form during measurement data acquisition, wherein for each map element a certificate is generated, wherein the certificate has all result values ascertained by the monitoring function (17, 19, 21), wherein a decision about the weighting of the result values of the monitoring function is taken by a computing unit of the vehicle side using the map element.

2. The method of claim 1, wherein, The plurality of mapping steps further comprises a generation of a localization map, a generation of a behavior map of the road user (14) and / or a generation of a planning map.

3. The method of claim 1 or 2, wherein, The at least one result value ascertained after each mapping step (16, 18, 20) by the monitoring function (17, 19, 21) is transmitted to a protected processing unit (22) by a communication connection, wherein the at least one result value is stored as a certificate by the protected processing unit (22).

4. The method of claim 3, wherein, The result values ascertained by the monitoring function (17, 19, 21) are transmitted to the protected processing unit by an encrypted communication connection.

5. The method of claim 1 or 2, wherein, For each map element a certificate is generated, wherein the certificate has a total value which summarizes all result values ascertained by the monitoring function (17, 19, 21).

6. The method of claim 3, wherein, The protected processing unit (22) is a protected SPS hardware unit.

7. A control device (12), wherein The control device (12) is configured to implement the method (2) according to any one of claims 1 to 6.

8. A computer program product comprising instructions which, when the computer program product is implemented by a computer or control device (12), cause the computer or control device to carry out the method (2) according to any one of claims 1 to 6.

9. A machine-readable storage medium on which the computer program product according to claim 8 is stored.

Images