Method for determining a measured value by means of at least two mutually different measuring methods and use thereof

Abstract

The invention relates to a method for determining measured values ​​(MW1, MW2, KMW) by means of at least two different measuring methods (MV1, MV2). According to the invention, a preliminary measured value (MW1, MW2) is determined with each of the measuring methods (MV1, MV2) and information about the integrity (IMW1, IMW2) of the determined preliminary measured values ​​(MW1, MW2) is provided. The determined preliminary measured values ​​(MW1, MW2) are fused into a combined measured value (KMW) and information about the integrity (KIMW) of the combined measured value (KMW) is determined. Based on the information about the integrity (IMW1, IMW2, KIMW) of the determined preliminary measured values ​​(MW1, MW2) and the combined measured values ​​(KMW) and based on the following duration, it is determined which of the measured values ​​(MW1, MW2, KMW) are provided for further processing.

Description

Technical Field

[0001] The invention relates to a method for determining a measured value by means of at least two mutually different measuring methods and to the use thereof. Background Art

[0002] A method for determining the position of a vehicle is known from the prior art as described in DE 10 2016 009 117 A1, wherein positioning based on environmental detection is combined with positioning using a global navigation satellite system.

[0003] DE 10 2018 004 229.5 describes a method for controlling a vehicle system of a vehicle that is configured to perform an automated driving operation and a device for performing the method. In the method, the vehicle is positioned using at least two different positioning methods, wherein the at least two positioning methods include at least one landmark-based position determination method and a positioning method based on at least one global navigation satellite system. The vehicle system is allowed to be activated based on the positioning result. Here, the vehicle system is only allowed to be activated when it is confirmed by each of the used positioning methods that the vehicle is located on a road section where the automated driving operation is allowed. Summary of the invention

[0004] The object of the present invention is to specify a method for determining a measured value by means of at least two mutually different measuring methods which is improved compared to the prior art and a use of the method.

[0005] According to the invention, this object is achieved by the method according to the invention for determining a measured value by means of at least two mutually different measuring methods and by the use of the method according to the invention.

[0006] An advantageous design of the present invention is also provided.

[0007] According to the invention, in a method for determining measured values ​​by means of at least two different measuring methods, preliminary measured values ​​are determined with each of the measuring methods, and information about the integrity of the determined preliminary measured values ​​is provided. Integrity is here in particular a quality measure that indicates the reliability of the respective measured values. The determined preliminary measured values ​​are merged into combined measured values, and information about the integrity of the combined measured values ​​is determined. Based on the information about the integrity of the determined preliminary measured values ​​and the combined measured values ​​and based on the duration during which the determined preliminary measured values ​​and the combined measured values ​​respectively meet the prescribed requirements regarding their integrity, it is determined which of the measured values ​​are provided for further processing. Therefore, it is advantageous to provide the combined measured values ​​for further processing based on the judgment made, or to select one of the measuring methods and provide the determined preliminary measured values ​​of the selected measuring method for further processing.

[0008] The method allows the availability of measured values ​​for further processing to be increased, since with the method not only combined measured values ​​are provided for further processing, but also determined preliminary measured values ​​when the abovementioned prerequisites are met.

[0009] The method can be used in particular in a vehicle, in particular for carrying out an automated or autonomous driving operation of the vehicle and / or for controlling a vehicle system of the vehicle which is provided for an automated or autonomous driving operation of the vehicle. The availability of the measured values ​​improved by means of the method also increases the availability of the automated or autonomous driving, i.e. the driving operation of the vehicle can be carried out to a large extent as an automated or autonomous driving operation. The measuring method then relates in particular to a vehicle positioning method, i.e. in particular a method for determining the position of the respective vehicle, since such positioning is required for carrying out the automated or autonomous driving operation. In a possible embodiment of the method, the measuring method thus comprises, for example, a landmark-based measuring method and a satellite-aided measuring method, in particular based on at least one global navigation satellite system.

[0010] In another possible embodiment of the method, the measuring method comprises, for example, at least two different measuring methods for object recognition and / or distance determination, in particular at least one radar-based measuring method and / or at least one lidar-based measuring method and / or at least one camera-based measuring method, to replace or supplement the above-mentioned landmark-based measuring method and satellite-aided measuring method, in particular based on at least one global navigation satellite system. This embodiment of the method is also particularly suitable for use in a vehicle, in order to thereby increase the availability of corresponding vehicle functions based on the measuring method, i.e., the time of their use can be increased with the aid of the method.

[0011] For example, the duration for which the respective measured values ​​are available for further processing is determined. Advantageously, the duration for which the respective measured values ​​are available for further processing is limited. This ensures that the error rate, in particular the false positive error rate of the measured values ​​available for further processing, does not exceed a specified value overall. A false positive error occurs when the relevant measured value should be good according to the integrity-related information, but this is not the case.

[0012] In one possible embodiment of the method, it is determined for a plurality of further processing devices which of the measured values ​​are to be provided for the respective further processing, based on the information about the integrity of the determined preliminary measured values ​​and the combined measured values ​​and based on the duration during which the determined preliminary measured values ​​and the combined measured values ​​respectively meet the prescribed requirements for their integrity. It is thereby possible to adjust the set conditions for the integrity of the determined preliminary measured values ​​and the combined measured values, the set conditions for the duration during which the determined preliminary measured values ​​and the combined measured values ​​respectively meet the prescribed requirements for their integrity, and the set conditions for the requirements to be met by the respective further processing devices and their respective requirements, so that perhaps for some of the further processing devices which provide fewer set conditions for the parameters relating to the measured values, measured values ​​can still be provided for further processing, while for other further processing devices which have higher set conditions, no measured values ​​can be provided. Thus, instead of uniform availability of the functions of all further processing devices, it is possible that the availability of the functions of some of the further processing devices which provide fewer set conditions can also be further increased. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The embodiments of the present invention are described in detail below with reference to the drawings, wherein:

[0014] Figure 1 Schematically shows an individual measuring method and a further processing device for further processing the measured values ​​provided by the measuring method,

[0015] Figure 2 The following diagram shows the practices allowed according to ISO26262 standard.

[0016] Figure 3 A diagram schematically shows the results of two mutually different measuring methods and the combined results,

[0017] Figure 4 The best choice consisting of three measurement methods is shown schematically,

[0018] Figure 5 schematically shows a method for determining a measured value by means of at least two mutually different measuring methods,

[0019] Figure 6 Schematically showing the provision status of the results of the corresponding measurement method or the fusion results,

[0020] Figure 7 A further specific embodiment of a method for determining a measured value by means of at least two mutually different measuring methods is schematically shown.

[0021] Figure 8 Schematic representation of the vehicle position and the upper error limit determined using two measurement methods,

[0022] Fig. 9 A method for determining measured values ​​by means of at least two mutually different measuring methods is schematically illustrated using the example of vehicle positioning.

[0023] Fig.10 The method for determining measured values ​​by means of at least two mutually different measuring methods is schematically illustrated using the example of vehicle positioning and an additional comfort function.

[0024] Parts that correspond to one another are provided with the same reference symbols in all the figures. DETAILED DESCRIPTION

[0025] The following, based on Figure 1-10 A method is described for determining measured values ​​MW1, MW2, KMW with the aid of at least two different measuring methods MV1, MV2, for example with the aid of a satellite-aided measuring method and a landmark-based measuring method for vehicle positioning, or with the aid of a radar-based, lidar-based and / or camera-based measuring method for object recognition or distance determination.

[0026] Each of the measuring methods MV1, MV2 provides preliminary measured values ​​MW1, MW2 and integrity data, ie information about the integrity IMW1, IMW2 of the provided preliminary measured values ​​MW1, MW2. Integrity IMW1, IMW2 is a quality measure that indicates the reliability of the measured values ​​MW1, MW2.

[0027] The preliminary measured values ​​MW1 , MW2 are fused to form a combined measured value KMW and the integrity data of the combination are determined, ie information about the integrity KIMW of the combined measured value KMW is determined.

[0028] Based on the information about the integrity IMW1, IMW2, KIMW of the measured values ​​MW1, MW2, KMW and based on the duration during which the measured values ​​MW1, MW2, KMW respectively meet the prescribed requirements about their integrity IMW1, IMW2, KIMW, it is determined which of the measured values ​​MW1, MW2, KMW should be provided for further processing. Based on this determination, either the combined measured value KMW is provided for further processing or one of the measuring methods MV1, MV2 is selected and the preliminary measured values ​​MW1, MW2 of the selected measuring method MV1, MV2 are provided for further processing.

[0029] The method is particularly suitable for safety-critical systems, since these place stringent demands on the upstream measuring function in terms of both functional safety and operational safety. In this case, in addition to the measured parameter and the statistical accuracy estimate (standard deviation), the measuring function should usually also output a statement that the measured parameter is within a specified standard range (integrity). This is the case in particular when more complex error patterns than simple interference noise can occur. As an exemplary embodiment, complete positioning for highly automated driving, i.e. automated and in particular highly automated or autonomous driving operations, is described below.

[0030] The ISO 26262 standard is known from the prior art, which allows the critical measurement function to be decomposed into two different subcomponents, which redundantly estimate the measurement parameters and metadata independently of each other. The functional safety requirements for each subcomponent are then significantly reduced. The safety of use also benefits from this, because when the integrity indicators are "integrated", that is, a combined integrity indicator is formed, the combined integrity indicator has a significantly lower false positive error rate than the individual components (false positive errors occur when the relevant measurement value should be good according to the integrity-related information, but this is not the case). This practice is actually widespread, because the two subcomponents can in most cases be designed to be significantly more advantageous than individual solutions that achieve the same requirements. However, the disadvantage at this time is that the "integration" reduces the availability of the measurement function, which is usually reflected in the restrictions that can be perceived by the user.

[0031] This disadvantage is avoided by the method described here. The method is preferably a system extension which, unlike the above-described and previously performed decomposition, allows a "soft" decomposition of the measurement function, since the method described here allows output of variants of measurement parameters and metadata with different degrees of protection.

[0032] As mentioned above, in this case, the duration is to be measured or, in particular when the method is used in a vehicle, the distance is measured, for example, alternatively or additionally, for example, after the start of the calculation cycle, for example, after the ignition, two subcomponents, i.e., two measurement methods MV1, MV2 are available. The false positive error rate of the "integrated" integrity indication is very low at this time. In the above manner, in particular according to the metric, the unavailability of one of the subcomponents, i.e., one of the measurement methods MV1, MV2, is allowed to continue temporarily in a variant of the measurement output, while the other available subcomponents, i.e., the corresponding other measurement methods MV2, MV1 directly occupy the measurement output. The duration and / or the duration of the distance, i.e., the duration and / or the distance of providing the corresponding measurement values ​​MW1, MW2 for further processing are preferably measured and limited according to the metric.

[0033] This method has the advantage that the availability of the measured parameters for the system-side receiver of the measured parameters, i.e. the further processing device 1, can be increased in this way if it is able to take into account a higher false positive error rate than has been achieved in practice so far by the hard "integration" described above. It then obtains a measured parameter variant which corresponds exactly to its false positive error rate requirement, but has the greatest possible availability for this.

[0034] Different receivers, i.e. different further processing devices 1a, 1b, 1c, with different false positive error rate requirements can now be supplied with measured values ​​MW1, MW2, KMW in parallel. This results in a higher availability of all downstream system components, even functions that can be experienced by the user. Thus, in the embodiment of the automated or autonomous driving function, its availability is increased, i.e. the user, here the driver or passenger of the vehicle, enjoys a higher availability, i.e. a higher possible use time of the automated or autonomous driving function. Compliance with the ISO 26262 guidelines is maintained here.

[0035] Based on the basic description of the methods and previous practices described herein, the following Figure 1-10 First, the previous approach is described again in detail, followed by the method described herein, and then an exemplary embodiment for automated or autonomous driving functions.

[0036] Figure 1 Shown are a separate measuring method MV and a safety-critical system as a receiver and a further processing device 1 for further processing the measured values ​​MW provided by the measuring method MV.

[0037] The problem on which the method described here is based is that such safety-critical systems (for example, vehicle systems for performing automated or autonomous driving operations) have strict requirements on their measurement methods MV in terms of both functional safety and safety in use. Additional information about the integrity IMW of the measured value MW is usually required, for example additional information about the maximum error, quality, validity and / or imprecision. Therefore, an integrity check IP is performed, i.e., it is checked whether the information about the integrity IMW of the measured value MW is sufficient. When the information about the integrity IMW is insufficient, for example because the quality mark is at a low level and the upper error limit, also called the protection limit, is too high, the safety-critical system switches to a safe state, for example, deactivates and notifies or warns the user. This adversely affects the user experience. Therefore, a high availability of the integrity IMW will be sought. The acceptable false positive error rate of the information about the integrity IMW is generally very low and requires expensive error recognition mechanisms.

[0038] In addition, most measurement methods such as MV Figure 1The standard deviation SA of the measured values ​​MW is also shown, but it is mostly only the residual value of the linear optimization or linearized optimization. No integrity is derived from this and it is a poor quality measure in the case of more complex error conditions than simple noise. It can also be used, for example, to determine the amount of noise in order to merge the preliminary measured values ​​MW1, MW2 of the different measurement methods MV1, MV2 as described below, especially if other mechanisms evaluate the data integrity.

[0039] The above ISO 26262 standard on functional safety is as follows Figure 2 The illustration allows a measurement method MV to be decomposed, i.e. split into two subcomponents, i.e. two different measurement methods MV1, MV2, which are measured in an independent manner according to different input data and methods and respectively provide preliminary measurement values ​​MW1, MW2, information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2 and the corresponding standard deviations SA1, SA2. In this case, it is helpful with regard to functional safety to avoid high ASIL measurement functions, because the subcomponents, i.e. the two different measurement methods MV1, MV2, can monitor each other (ASIL = Automotive Safety Integrity Level, the safety requirement level for safety-related systems in motor vehicles as specified in ISO 26262).

[0040] Similarly, false positive integrity evaluations can be significantly reduced by the integrity combination IK of the information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2 (for example, by an AND operation of valid indicators, so-called flags, and / or by unification of upper error limits). Therefore, the individual subcomponents, i.e. the two different measurement methods MV1, MV2, can generate more false positive errors in their information about the integrity IMW1, IMW2 and require less costly error detection and elimination mechanisms. In general, this split solution is cheaper than a very reliable individual component with a high ASIL value, i.e. a very reliable individual measurement method MV. As a result, this approach is widespread.

[0041] Figure 2 A schematic diagram of the procedure permitted according to ISO 26262 is shown. Two different measuring methods MV1, MV2 respectively provide preliminary measured values ​​MW1, MW2, information about the integrity IMW1, IMW2 of the preliminary measured values ​​MW1, MW2 and the corresponding standard deviations SA1, SA2. This is done, for example, with the aid of an estimation algorithm. The information about the integrity IMW1, IMW2 of the preliminary measured values ​​MW1, MW2 includes, for example, an upper error limit or a validity mark, i.e. a validity flag, and thus a guaranteed upper error limit of the respective preliminary measured values ​​MW1, MW2.

[0042] In an association step (hereinafter referred to as hard association step HVS, to distinguish it from the approach described in detail below based on the mandatory association of the two measurement methods MV1, MV2), a measurement value fusion MF is performed, i.e. the preliminary measurement values ​​MW1, MW2 provided by the two different measurement methods MV1, MV2 are fused into a combined measurement value KMW with a combined standard deviation KSA. The combined measurement value KMW is, for example, a weighted average value, which is weighted, for example, according to the standard deviations SA1, SA2. An integrity combination IK of information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2 provides information about the integrity KIMW of the combined measurement value KMW, for example, a combination of two upper error limits FG1, FG2 or two validity marks, i.e., two validity flags should be feasible.

[0043] The integrity combination IK of information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2 can be a "logical AND" in individual cases, such as a valid mark, a so-called flag, but in general it can be any combination of independent information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2 that allows a more reliable integrity evaluation, such as the set of the upper error limits FG1, FG2 of the two measurement methods MV1, MV2.

[0044] The integrity is in particular a reliability criterion for measuring how good the respective measured value MW1, MW2, KMW is, for example whether one can currently rely on the measured value MW1, MW2, KMW, whether one can rule out that the error of the measured value MW1, MW2, KMW is currently not greater than a specified value. The integrity is a guarantee for the quality of the measured value MW1, MW2, KMW, for example a "yes / no" marking or a statement "the measured value MW1, MW2, KMW is guaranteed only within a certain range", for example a guarantee for the required quality of the distance value only within a range of no more than 30 meters.

[0045] Figure 3 Taking vehicle positioning as an example, the results EMV1, EMV2 and the combined result EF of two different measurement methods MV1, MV1 are shown. The first measurement method MV1 provides a first vehicle position FP1 and a first error upper limit FG1 as a positioning result. It is necessary to ensure that the first vehicle position FP1 is within the range with a false positive error rate lower than the required value. The second measurement method MV2 provides a second vehicle position FP2 and a second error upper limit FG2 as a positioning result. It is necessary to ensure that the second vehicle position FP2 is within the range with a false positive error rate lower than the required value. The intersection of the two error upper limits FG1, FG2 corresponds to information about the integrity KIMW of the combined measurement value KMW.

[0046] The evaluation of the information about the integrity KIMW of the combined measurement value KMW is positive only when all additional conditions introduced by the integrity IMW1, IMW2 of the determined preliminary measurement values ​​MW1, MW2 are met. When, for example, the two information about the integrity IMW1, IMW2 of the determined preliminary measurement values ​​MW1, MW2 contain a maximum error estimate, i.e., an upper limit on the maximum error, only the larger error span meets the two restrictive conditions. Of the two quality evaluations, only the poorer evaluation is considered, i.e., only the medium quality evaluation is considered in the good quality evaluation and the medium quality evaluation. Only when both valid flags, i.e., valid signs, are "true", i.e., both are positive, are they evaluated as positive. False positive A false positive integrity evaluation means that the data quality of the integrity information is better estimated than its actual situation.

[0047] In summary, it can be said that the information about the integrity KIMW of the combined measured value KMW allows a more reliable assessment of the integrity, i.e. a lower false positive error rate, since it only leads to a false positive if the two individual information about the integrity IMW1, IMW2 of the determined preliminary measured values ​​MW1, MW2 are simultaneously false positives. However, the assessment is also more biased towards the negative, so that the currently less capable measuring methods MV1, MV2 always have limited usability.

[0048] The only method known from the prior art for increasing the availability is to add more redundant subcomponents, i.e. more mutually different measuring methods MV1, MV2, MV3 and to make an optimal selection BA, for example in the case of three measuring methods MV1, MV2, MV3 for the best two of the three measuring methods MV1, MV2, MV3, e.g. Figure 4 Here, three different measurement methods MV1, MV2, MV3 are used. For two of the three measurement methods MV1, MV2, MV3, the best selection BA is made and then the following is performed: Figure 2 The above-mentioned hard association step HVS is shown. The result EF obtained in this way, in particular the combined measured value KMW, is then provided to the further processing device 1. However, this significantly increases the system costs, because more measuring methods MV1, MV2, MV3 and the corresponding measuring devices required for this are required, so it can only be carried out when high availability is critical, that is, it is necessary, such as in object recognition.

[0049] As an improvement over the solutions known from the prior art, the above and Figure 5The method for determining the measured values ​​MW1, MW2, KMW by means of at least two mutually different measuring methods MV1, MV2 provides for the expansion of the binary decomposition known from the prior art to maximize the system availability in an intelligent manner within the permissible design range. Here, full use is made of the fact that, in combination with the integrity data, i.e. the information about the integrity KIMW of the combined measured value KMW, the false positive error rate of the integrity evaluation is generally low enough to exceed the actual system requirements. Therefore, a budget with essentially error-free working time can be accumulated, provided that the integrity data of the two subcomponents, i.e. the information about the integrity IMW1, IMW2 of the determined preliminary measured values ​​MW1, MW2, are good enough. Thus, the budget can be used to allow for short pauses, in which only one subcomponent, i.e. only one of the two different measuring methods MV1, MV2, provides the result EMV1, EMV2 for the further processing device 1, so as to pass the time when the other subcomponent, i.e. the other measuring method MV2, MV1, does not work well enough. During these brief pauses, the false positive error rate increases, but the monitoring unit 2 controls not only the time component of the overly safe working time but also the time component of the less safe working time, so that the predetermined false positive error rate is still adhered to.

[0050] The method includes Figure 2 The approach described above is shown. Two different measurement methods MV1, MV2 provide preliminary measurement values ​​MW1, MW2, information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2 and the corresponding standard deviations SA1, SA2. This is done, for example, with the aid of an estimation algorithm. The information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2 includes, for example, the upper error limit or the validity mark, i.e. the valid flag and the corresponding guaranteed upper error limit of the preliminary measurement values ​​MW1, MW2.

[0051] In the hard association step HVS, a measurement value fusion MF is performed, i.e. the preliminary measurement values ​​MW1, MW2 provided by the two different measurement methods MV1, MV2 are fused into a combined measurement value KMW with a combined standard deviation KSA. The combined measurement value KMW is, for example, a weighted average value, which is weighted, for example, according to the standard deviations SA1, SA2. An integrity combination IK of information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2 provides information about the integrity KIMW of the combined measurement value KMW, for example, a combination of two upper error limits FG1, FG2 or two validity marks, i.e. two validity flags should be possible.

[0052] The integrity combination IK of information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2 can in individual cases be a "logical AND", such as a valid mark, a so-called flag, but in general it can be any combination of individual information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2 that allows a more reliable integrity evaluation, such as the set of upper error limits FG1, FG2 of the two measurement methods MV1, MV2.

[0053] Integrity is in particular a reliability criterion which measures how good the respective measured values ​​MW1, MW2, KMW are, for example whether one can currently trust the measured values ​​MW1, MW2, KMW, whether one can exclude that the errors of the measured values ​​MW1, MW2, KMW are currently not greater than a specified value.

[0054] This integrity is a quality assurance of the measured values ​​MW1, MW2, KMW, for example a “yes / no” marking or a statement that “the measured values ​​MW1, MW2, KMW are guaranteed to be only within a specified range”, for example the required quality for the distance values ​​is guaranteed to be only within a range of up to 30 meters.

[0055] Furthermore, a soft correlation step WVS is performed. It comprises a multiplier 3, to which the combined measurement value KMW, the combined standard deviation KSA, the information about the integrity KIMW of the combined measurement value KMW, and the preliminary measurement values ​​MW1, MW2 of the two measurement methods MV1, MV2, the information about the integrity IMW1, IMW2 of the preliminary measurement values ​​MW1, MW2, and the corresponding standard deviations SA1, SA2 are input. In addition, a control signal SS of the monitoring unit 2 is added here, which informs the multiplier 3 which of the following values ​​should be output for further processing: the fused value, i.e. the combined measurement value KMW, the combined standard deviation KSA and the information about the integrity KIMW of the combined measurement value KMW; or the value of the first measurement method MV1, i.e. its preliminary measurement value MW1, the standard deviation SA1 and the information about the integrity IMW1 of the determined preliminary measurement value MW1; or the value of the second measurement method MV2, i.e. its preliminary measurement value MW2, the standard deviation SA2 and the information about the integrity IMW2 of the determined preliminary measurement value MW2. For this purpose, an integrity check IP is performed in the monitoring unit 2 for the information about the integrity KIMW of the combined measured value KMW, the information about the integrity IMW1 of the determined preliminary measured value MW1 of the first measuring method MV1 and the information about the integrity IMW2 of the determined preliminary measured value MW2 of the second measuring method MV2 . In addition, counters Z0, Z1, Z2 are operated, which detect the duration for which the corresponding values ​​are provided for further processing, i.e., when the fused values, i.e., the combined measured value KMW, the combined standard deviation KSA and the information about the integrity KIMW of the combined measured value KMW are provided by the multiplier 3 for further processing, the counter Z0 is operated and / or indicates how long they are provided; when the values ​​of the first measurement method MV1, i.e., its preliminary measured value MW1, the standard deviation SA1 and the information about the integrity IMW1 of the determined preliminary measured value MW1 are provided by the multiplier 3 for further processing, the counter Z1 is operated and / or indicates how long they are provided; and when the values ​​of the second measurement method MV2, i.e., its preliminary measured value MW2, the standard deviation SA2 and the information about the integrity IMW2 of the determined preliminary measured value MW2 are provided by the multiplier 3 for further processing, the counter Z2 is operated and / or indicates how long they are provided. The duration for providing the corresponding values ​​for further processing determined in this way is input to the monitoring unit 2, so that in particular the provision of the values ​​of the first measurement method MV1 and the second measurement method MV2 by the monitoring unit 2 is limited. The counter Z0 now indicates how long the value was provided for further processing with a low error rate, in particular a false positive error rate.

[0056] Furthermore, a specification configuration K is input to the monitoring unit 2 , for example the maximum time components max_time_share_1 , max_time_share_2 and the minimum continuity min_continuity of the first and second measuring methods MV1 , MV2 .

[0057] The following apply here:

[0058] max_time_share_1=(FP S -FP C ) / (FP1-FP C ) (1)

[0059] max_time_share_2 = (FP S -FP C ) / (FP2-FP C ) (2)

[0060] in,

[0061] FP1: false positive error rate of the information on the integrity IMW1 of the determined preliminary measurement value MW1 of the first measurement method MV1,

[0062] FP2: false positive error rate of the information on the integrity IMW2 of the determined preliminary measurement value MW2 of the second measurement method MV2,

[0063] FP C : false positive error rate of information about the completeness KIMW of the combined measurement value KMW,

[0064] FP S : The expected false positive error rate of the information about the integrity IMW1, IMW2, KIMW provided by multiplier 3 respectively.

[0065] The minimum continuity min_continuity is the minimum duration or distance at which the control can be maintained by the monitoring unit 2 in a mode with a single source and in particular a single measuring method MV1, MV2 without having to switch back and forth. It is advantageously set in such a way that it covers the typical length of the unavailability of the combined integrity data, i.e. the information about the integrity KIMW of the combined measured value KMW.

[0066] The basic idea is to establish a budget when both measurement methods MV1, MV2 have provided results EMV1, EMV2 that are better than required, which can then be released, i.e., even if both measurement methods MV1, MV2 have been better than required for a specified duration, results EMV1, EMV2 that do not meet the requirements, in particular preliminary measurement values ​​MW1, MW2, can be temporarily used. Thus, the required accuracy is still achieved after a longer duration.

[0067] Figure 6 States S1, S2, SF are shown in which the results EMV1, EMV2 of the respective measuring methods MV1, MV2 or the combined result EF fused by the multiplier 3 are available for further processing. After the start S, all counters Z0, Z1, Z2 are first reset to zero and first switched to the state SF in which the combined result EF is available. Selector A is set to "available combined result EF". Counter Z0 counts up.

[0068] When the situations K1a and K1b are applicable, the state S1 is switched to "providing the result EMV1 of the first measurement method MV1", the selector A is adjusted to "providing the result EMV1 of the first measurement method MV1", and the counter Z1 counts up. When the situation K1a is no longer applicable, the state SF is switched back to "providing the combined result EF".

[0069] When the situations K2a and K2b are applicable, the state S2 is switched to "providing the result EMV2 of the second measurement method MV2", the selector A of which is adjusted to "providing the result EMV2 of the second measurement method MV2", and the counter Z2 will count up. When the situation K2a is no longer applicable, the state SF is switched back to "providing the combined result EF".

[0070] Case 1a applies under the following conditions: there is insufficient information about the integrity KIMW of the combined measurement value KMW, there is sufficient information about the integrity IMW1 of the determined preliminary measurement value MW1 of the first measurement method MV1, there is insufficient information about the integrity IMW2 of the determined preliminary measurement value MW2 of the second measurement method MV2, and the quotient obtained by counter Z1 and the sum of the three counters Z0, Z1, Z2 is less than the maximum time component max_time_share_1 of the first measurement method MV1.

[0071] Case 1b applies if the quotient of the sum of the counter Z1 and the minimum continuity min_continuity and the sum of all three counters Z0 , Z1 , Z2 is smaller than the maximum time component max_time_share_1 of the first measurement method MV1 .

[0072] Case 2a applies under the following conditions: there is insufficient information about the integrity KIMW of the combined measurement value KMW, there is insufficient information about the integrity IMW1 of the determined preliminary measurement value MW1 of the first measurement method MV1, there is sufficient information about the integrity IMW2 of the determined preliminary measurement value MW2 of the second measurement method MV2, and the quotient obtained by counter Z2 and the sum of the three counters Z0, Z1, Z2 is less than the maximum time component max_time_share_2 of the second measurement method MV1.

[0073] Case 2b applies if the quotient of the sum of the counter Z2 and the minimum continuity min_continuity and the sum of all three counters Z0 , Z1 , Z2 is smaller than the maximum time component max_time_share_2 of the first measurement method MV2 .

[0074] In another embodiment of the method, more than two different measuring methods MV1, MV2 can be used. The measured value fusion MF, the monitoring unit 2 and the multiplier 3 thus obtain additional input values. Each additional measuring method MV3 requires an additional counter and an additional state. The required modifications can be realized in a simple manner.

[0075] In another embodiment, the Figure 7 As shown, provision is made for cascades with mutually different error rates. In individual systems, various further processing devices 1a, 1b, 1c have mutually different requirements for error rates, in particular false positive error rates. The method can then be carried out in parallel using various instances with mutually different configurations K1, K2, K3. Each further processing device 1a, 1b, 1c then obtains its own measurement variant with the greatest possible availability, tailored to it. This embodiment is also orthogonal and can be combined with the previous embodiment.

[0076] Figure 7 The two measuring methods MV1, MV2, three further processing devices 1a, 1b, 1c and a configuration K1 with high safety for the first further processing device 1a, a balanced configuration K2 for the second further processing device 1b and a configuration K3 with high availability for the third further processing device 1c are shown. A soft association step WVS is then performed in a corresponding manner for the respective further processing device 1a, 1b, 1c with the respective configuration K1, K2, K3.

[0077] The advantage of the method described here over the prior art is that the false positive error rate of the integrity evaluation is adapted to the actual requirements of the further processing device 1, thereby obtaining the best availability for the false positive error rate requirements. Various further processing devices 1a, 1b, 1c can be supplied with special variants of the measured values ​​MW1, MW2, KMW, which are each optimally matched to the coordination between safety and availability. The improved availability is conveyed through the functional chain of the system and is therefore also reflected in the end-user functions, where the improved availability directly improves the user experience of the end-user functions. The development and implementation of the method are simplified because the existing solutions can be slightly readjusted to meet the requirements regarding safety or availability. This allows a reduction in development costs.

[0078] The following, combined Figure 8-10 To describe the use of a vehicle positioning method for performing automated or autonomous driving operations. Safety-critical systems are then automated and in particular highly automated or autonomous driving functions. The measuring methods MV1, MV2 determine the vehicle position in a high-resolution digital map (which provides important environmental data for automated and in particular highly automated or autonomous driving functions). The measured values ​​MW1, MW2, KMW and the standard deviations SA1, SA2, KSA are the vehicle position PLM, PGNSS, PK in the high-resolution digital map and its unreliability. The integrity data, i.e. the information about the integrity IMW1, IMW2 of the determined preliminary measured values ​​MW1, MW2 and the combined measured value KMW, is a live calculation of the maximum position error in meters as a boundary range around the vehicle, within which it is ensured that the actual vehicle position is located. This will be referred to as the upper error limit.

[0079] As long as the upper error limit is below the so-called 10-meter warning limit, the integrity data, ie the information about the integrity IMW1 , IMW2 of the determined preliminary measured values ​​MW1 , MW2 and the combined measured value KMW, are considered sufficient.

[0080] If the current positioning error exceeds the upper error limit, the integrity data, ie the information about the integrity IMW1 , IMW2 of the determined preliminary measured values ​​MW1 , MW2 and the combined measured value KMW, is a false positive.

[0081] If the integrity data, i.e. the information about the integrity IMW1, IMW2 of the determined preliminary measured values ​​MW1, MW2 and the combined measured value KMW, are insufficient, the automated and in particular highly automated or autonomous driving function is switched to a safe deactivated state or remains in the deactivated state and the user is informed of the unavailability. The higher the availability, the better the user experience.

[0082] Assume that the required false positive error rate is <= 1e-6 / km and the required ASIL is classified as "C". This is difficult to achieve with a single inexpensive positioning method. This is therefore achieved with two mutually different measurement methods MV1, MV2.

[0083] The first measurement method MV1 is a satellite-assisted measurement method, in particular a measurement method based on at least one global navigation satellite system, also known as a GNSS-based measurement method, and its ASIL classification is A(C). It achieves a false positive error rate of <=1e-5 / km when the length of the false positive state is less than 100 meters, that is, the erroneous state occurs at most once every 100,000 km and lasts until the next 100 meters.

[0084] The second measurement method MV2 is a landmark-based measurement method with an ASIL classification of B(C). It achieves a false positive error rate of <=1e-4 / km when the false positive state length is less than 200 meters, that is, the false state occurs at most once every 10,000 km and lasts until the next 200 meters.

[0085] For the false positive rate of the combined integrity status, the error states of the two measurement methods MV1, MV2 should overlap. This is unlikely in view of the two mutually independent measurement methods MV1, MV2. The combined false positive error rate is then less than 1e-10 / km.

[0086] However, the combination requires that the upper error limits be unified within a relatively large limit range. The unified limit range far exceeds the alarm limit, so that the integrity data, i.e. the information about the integrity KIMW of the combined measured value KMW, is insufficient for the system of automated and especially highly automated or autonomous driving functions. This results in a higher unavailability of automated and especially highly automated or autonomous driving functions.

[0087] Figure 8 The vehicle position PLM and its upper error limit PLLM determined by means of a landmark-based measurement method, the vehicle position PLGNSS and its upper error limit PLGNSS determined by means of a satellite-assisted measurement method, in particular based on at least one global navigation satellite system, and the vehicle position PK and its upper error limit PLK determined by the combined measurement value KMW are shown.

[0088] The upper error limit PLGNSS of the satellite-assisted measurement method, in particular, based on at least one global navigation satellite system, exceeds the 10-meter warning limit during 4% of the driving period. The upper error limit PLLM of the landmark-based measurement method exceeds the 10-meter warning limit during 8% of the driving period. Therefore, the upper error limit PLK of the vehicle position PK determined by the combined measurement value KMW exceeds the 10-meter warning limit during more than 12% of the driving period, because the difference between the determined vehicle positions PLM and PGNSS generally adds an additional margin to the combined upper error limit PLK before fusion. That is, automated and in particular highly automated or autonomous driving functions are unavailable 12% of the time. But when they are available, the positioning result is more reliable than required. Therefore, there is a high unavailability of automated and in particular highly automated or autonomous driving functions and thus poor user satisfaction.

[0089] When using the method described here with the soft association step WVS, use is made of:

[0090] FP S =1e-6 / km

[0091] FPc=1e-10 / km

[0092] FP1=1e-5 / km

[0093] FP2=1e-4 / km

[0094] and formulas (1) and (2), the following values ​​for the maximum time components max_time_share_1, max_time_share_2 for the measurement methods MV1, MV2 are obtained:

[0095] max_time_share_1=(FP S -FP C ) / (FP1-FP C )=0.09999≈0.1 (3)

[0096] max_time_share_2 = (FP S -FP C ) / (FP2-FP C )=0.009999≈0.01 (4)

[0097] The minimum continuity min_continuity may be approximately equal to 1000 meters, where it can be reliably assumed that a new landmark or satellite is detected for complete reconstruction.

[0098] Fig. 9Two measurement methods, namely a first measurement method MV1 as a satellite-assisted measurement method, in particular based on at least one global navigation satellite system, and a second measurement method MV2 as a landmark-based measurement method, together with their above-mentioned false positive error rates and the execution of said methods with a soft association step WVS and the above-mentioned false positive error rates resulting therefrom, and a further processing device 1 in the form of a system for automated and in particular highly automated or autonomous driving functions are shown. Configuration K comprises: a maximum time component max_time_share_1 of the first measurement method MV1, equal to 0.1, as calculated in formula (3), a maximum time component max_time_share_2 of the second measurement method MV2, equal to 0.01, as calculated in formula (4), and a minimum continuity min_continuity, equal to 1000, as described above.

[0099] This results in the following effect, namely that the fused, i.e. combined, result EF, in particular the combined measured value KMW, can be used for 88% of the time. Automated and in particular highly automated or autonomous driving functions are available. When the integrity IMW1 of the determined preliminary measured value MW1 of the first measuring method MV1 is insufficient, the availability can be maintained up to 1% availability until the maximum time component max_time_share_2 of the second measuring method MV2 is reached. When the integrity IMW2 of the determined preliminary measured value MW2 of the second measuring method MV2 is insufficient, the availability can be maintained up to 8% availability until the maximum time component max_time_share_1 of the first measuring method MV1 is reached. Since it is almost impossible to reach the maximum time component max_time_share_1 of the first measuring method MV1, the availability can be basically maintained. In practice, individual restrictions are possible, but it can be assumed that the initial unavailability (i.e. 12%) is reduced by about 1 / 2 to 1 / 3.

[0100] Fig.10 An embodiment of the method is shown, which has two different further processing devices 1a, 1b with different safety requirements (using positioning), wherein the further processing device 1a is a system for automated and in particular highly automated or autonomous driving functions, and the further processing device 1b is a system for comfort functions, and the measuring methods MV1, MV2 are as follows Fig. 9 Shown are a satellite-assisted measurement method MV1, in particular based on at least one global navigation satellite system, and a landmark-based measurement method MV2. The further processing device 1b as a comfort function system has lower safety requirements. For example, its false positive error rate is 1e-5 / h.

[0101] Here, for each further processing device 1a, 1b, the soft association step WVS is performed in parallel according to different configurations K1, K2. For the further processing device 1a of the system for automation and especially highly automated or autonomous driving functions, the maximum time component max_time_share_1 of the first measurement method MV1 equal to 0.1 as calculated in formula (3), the maximum time component max_time_share_2 of the second measurement method MV2 equal to 0.01 as calculated in formula (4) and the minimum continuity min_continuity equal to 1000 as described above are followed again. For the further processing device 1b of the comfort function system, the maximum time component max_time_share_1 of the first measurement method MV1 equal to 1, the maximum time component max_time_share_2 of the second measurement method MV2 equal to 0.1 and the minimum continuity min_continuity equal to 1000 are followed.

[0102] The false positive error rate of the first measurement method MV1 is equal to 1e-5 / km, the false positive error rate of the second measurement method MV2 is equal to 1e-4 / km, the false positive error rate of the soft association step WVS of the further processing device 1a for automation and in particular highly automated or autonomous driving functions is equal to 1e-6 / km, and the false positive error rate of the soft association step WVS of the further processing device 1b for the comfort function system is equal to 1e-5 / km.

[0103] The resulting availability is greater than 99%, with individually set safety requirements being observed.

Claims

1. A method for determining measured values ​​(MW1, MW2, KMW) by means of at least two mutually different measuring methods (MV1, MV2, MV3), characterized in that - using each of said measurement methods (MV1, MV2, MV3) to determine a preliminary measurement value (MW1, MW2) and to provide information on the integrity (IMW1, IMW2) of the determined preliminary measurement value (MW1, MW2), - fusing the determined preliminary measured values ​​(MW1, MW2) into a combined measured value (KMW) and determining information about the integrity (KIMW) of the combined measured value (KMW), - Based on the information about the integrity (IMW1, IMW2, KIMW) of the determined preliminary measured values ​​(MW1, MW2) and the combined measured values ​​(KMW) and based on the following duration, which of the measured values ​​(MW1, MW2, KMW) are provided for further processing, within which the determined preliminary measured values ​​(MW1, MW2) and the combined measured values ​​(KMW) respectively meet the prescribed requirements regarding their integrity.

2. The method according to claim 1, characterized in that: Depending on the decision made, either the combined measurement value (KMW) is provided for further processing, or one of the measurement methods (MV1, MV2, MV3) is selected and the determined preliminary measurement value (MW1, MW2) of the selected measurement method (MV1, MV2, MV3) is provided for further processing.

3. The method according to claim 1 or 2, characterized in that: The duration of time during which the corresponding measured values ​​(MW1, MW2, KMW) are available for further processing is detected.

4. The method according to claim 3, characterized in that: The duration for which the corresponding measured values ​​(MW1, MW2, KMW) are provided for further processing is limited.

5. The method according to claim 4, characterized in that: The duration for which preliminary measured values ​​(MW1, MW2) of the measuring method (MV1, MV2, MV3) are provided for further processing is limited.

6. The method according to claim 1 or 2, characterized in that: Based on information about the integrity (IMW1, IMW2, KIMW) of the determined preliminary measured values ​​(MW1, MW2) and the combined measured values ​​(KMW) and based on the following duration, it is determined for multiple further processing devices (1, 1a, 1b, 1c) which of the measured values ​​(MW1, MW2, KMW) are provided for corresponding further processing, within which time period the determined preliminary measured values ​​(MW1, MW2) and the combined measured values ​​(KMW) respectively meet the prescribed requirements regarding their integrity.

7. The method according to claim 1 or 2, characterized in that: The integrity is a quality measure which indicates the reliability of the respective measured value (MW1, MW2, KMW).

8. The method according to claim 1 or 2, characterized in that: The measurement methods (MV1, MV2, MV3) include landmark-based measurement methods and satellite-assisted measurement methods.

9. The method according to claim 8, characterized in that: The measuring method (MV1, MV2, MV3) comprises a satellite-assisted measuring method based on at least one global navigation satellite system.

10. The method according to claim 1 or 2, characterized in that: The measuring methods (MV1, MV2, MV3) include at least two different measuring methods for object detection and / or distance determination.

11. The method according to claim 10, characterized in that: The measuring methods (MV1, MV2, MV3) include at least one radar-based measuring method and / or at least one camera-based measuring method.

12. The method according to claim 10, characterized in that: The measuring methods (MV1, MV2, MV3) include at least one lidar-based measuring method.

13. The method according to claim 12, characterized in that: The measuring methods (MV1, MV2, MV3) include at least one laser radar-based measuring method and at least one camera-based measuring method.

14. Use of a method according to one of the preceding claims in a vehicle.

15. The use according to claim 14, for performing an automated driving operation or an autonomous driving operation of a vehicle and / or for controlling a vehicle system of a vehicle configured to perform an automated driving operation or an autonomous driving operation.

Images