Method and apparatus for temperature verification in a vehicle

Abstract

A method for time verification in a vehicle is provided. The method comprises receiving first position information at a receiving unit (21, 22) of the vehicle (1), the received first position information comprising first time information; providing a first timestamp to the received first location information based on a vehicle time when the first location information is received; receiving second position information at a receiving unit (21, 22) of the vehicle (1), the received second position information comprising second time information; providing a second timestamp to the received second location information based on the vehicle time when the second location information is received; and determining whether a difference between the first time information and the second time information and a difference between the first time stamp and the second time stamp are the same and / or whether a deviation between the two differences is below a predefined threshold.

Description

Technical Field

[0001] The present disclosure relates to a method for time verification in a vehicle, a data processing system including components for executing the method, a computer program and a computer-readable medium, wherein the computer program includes instructions, which, when executed by a computer, cause the computer to execute the method, and the computer-readable medium includes instructions, which, when executed by a computer, cause the computer to execute the method. Background Art

[0002] As the complexity of autonomous or automated vehicles increases, different electronic control units (ECUs) use multiple communication buses to ensure that the autonomous or automated driving functions meet safety requirements, such as those required for the so-called Automotive Safety Integrity Level (ASIL). Summary of the invention

[0003] Automotive Safety Integrity Level is a risk classification scheme defined by ISO 26262 for functional safety of road vehicles. The ASIL classification includes four safety levels, from ASIL A, which has the lowest safety requirements, to ASIL D, which has the highest safety requirements. In addition, hazards identified as QM do not specify any safety requirements.

[0004] All relevant controllers involved in the critical decision making of the automated driving function need to have synchronized time with respect to the other controllers. Time synchronization for highly automated vehicles (e.g., SAE Level 3 or 4 or higher cars) (where the SAE J3016 standard describes the classification and terminology definitions for highway vehicles with automated driving systems) is required to meet ASIL B or higher standards.

[0005] In the prior art, for example, time synchronization of Ethernet buses is performed according to IEEE 802.1AS for TSN (Time Sensitive Network) and IEEE 1588 for PTP (Precision Time Protocol). However, for time synchronization via PTP, in addition to the corresponding standards, several measures can also be taken to ensure the integrity of the synchronization process and thus the integrity of the distributed time base.

[0006] More specifically, the vehicle may include different environmental sensors configured to provide sensor data about the environment of the vehicle. A control unit within the vehicle may utilize and / or may fuse sensor data from different environmental sensors to determine an environmental model indicating the location of objects within the environment of the vehicle. The vehicle may then operate, for example, in an autonomous driving mode based on the environmental model. The environmental sensors may be located in one or more different communication networks or communication bus systems of the vehicle. An example communication bus system is a controller area network (CAN), notably a CAN-FD (flexible data rate), a bus system, a FlexRay bus system, a local interconnect network (LIN) bus system, a media-oriented system transmission (MOST) bus system, and / or an Ethernet bus system.

[0007] The different environmental sensors typically each include a local clock configured to provide a timestamp for sensor data captured by the respective environmental sensor. When fusing the sensor data to determine the environmental model, the timestamps of the sensor data provided by the different sensors are typically considered.

[0008] Differences in the local times indicated by the local clocks of different environmental sensors may lead to inaccuracies in the environment model and may impair autonomous driving.

[0009] In this regard, WO2021204342A1 discloses a method for performing time synchronization between a master clock of a master unit and multiple slave clocks of corresponding multiple slave units in a communication bus system. The method includes sending a forward time synchronization message indicating the master clock from the master unit to multiple slave units so that multiple slave units can synchronize their corresponding slave clocks with the master clock. The method also includes receiving a reverse time synchronization message indicating the corresponding slave clock from each of the multiple slave units at a first verifier. In addition, the method includes using a reverse time synchronization message from a plurality of slave units to synchronize multiple verifier clocks of a first verifier with corresponding multiple slave clocks, and verifying the time synchronization between multiple slave clocks at the first verifier based on these verifier clocks of the first verifier.

[0010] In addition, GNSS (Global Navigation Satellite System) positioning information is essential for autonomous driving, and its timestamp is also part of the above safety goals, so that the time and position of the vehicle can be known, and these data can be used later in the sensor fusion ECU and / or to detect the position of the vehicle on the map. In order to ensure the use of ASIL for timestamping, the existing technology relies on ASIL-B receivers (chips) to obtain GNSS positioning information. This limits the choice of receivers (chips) that can be used for autonomous vehicles. For example, QM receivers and QM receiver ECUs cannot be relied on to obtain GNSS positioning information.

[0011] Against the background of the prior art, it is an object of the present disclosure to provide, inter alia, an apparatus and a method, respectively, adapted to overcome at least some of the above-mentioned disadvantages of the prior art.

[0012] This object is solved by the features of the independent claim. The dependent claims contain preferred further developments of the disclosure.

[0013] More specifically, the object is solved by a method for time verification in a vehicle.

[0014] The method may be a computer-implemented method.The method may also be referred to as a method for time stamp verification provided by a data processing unit installed in a vehicle to position information.

[0015] The method includes receiving first location information at a receiving unit of a vehicle, the received first location information including first time information. The method includes providing a first time stamp to the received first location information based on a vehicle time when the first location information is received.

[0016] The method includes receiving second position information at a receiving unit of a vehicle, the received second position information including second time information.

[0017] The method includes providing a second timestamp to the received second location information based on a vehicle time when the second location information is received.

[0018] The method comprises determining whether a difference between the first time information and the second time information and a difference between the first time stamp and the second time stamp are the same and / or whether a deviation between the two differences is below a predefined threshold.

[0019] Position information may be received from a satellite navigation or satellite navigation system, which is a system that uses satellites to provide autonomous geospatial positioning. It allows a small electronic receiver to determine its position (longitude, latitude and / or altitude / elevation) with high accuracy (e.g., within a few centimeters to a few meters) using time signals transmitted by radio along a line of sight from a satellite. The system may be used to provide position, navigation, or to track the position of an object on which the receiver is mounted (satellite tracking). These signals also allow an electronic receiver to calculate the current local time with high accuracy, thereby achieving time synchronization. These uses are collectively referred to as positioning, navigation, and timing (PNT). Satellite navigation systems operate independently of any telephone or internet reception, although these technologies can improve the usefulness of the positioning information generated.

[0020] A satellite navigation system with global coverage may be referred to as a Global Navigation Satellite System (GNSS).

[0021] Position information may be provided by such a GNSS and may be referred to as GNSS (position) information. A Global Navigation Satellite System (GNSS) is a system for determining Earth and air position and navigation by receiving signals from navigation satellites and pseudo-satellites. GNSS is a general term for the use of existing and future global satellite systems, such as: NAVSTAR GPS (Global Positioning System) in the United States of America, GLONASS (Global Navigation Satellite System) in the Russian Federation, Galileo in the European Union and Beidou in the People's Republic of China, as well as various complementary systems in Europe, the United States, Japan and India.

[0022] As described above, the corresponding positioning information can allow the vehicle to determine its position, for example, based on the corresponding time information included in the position information. For example, a GPS receiver calculates its four-dimensional position in space and time based on data received from multiple GPS satellites. Each satellite carries an accurate record of its position and time, and transmits this data to the receiver as position information. These satellites carry very stable atomic clocks that are synchronized with each other and with ground clocks. Any time deviations maintained on the ground are corrected every day. In the same way, the satellite position can be known very accurately. The GPS receiver also has a global time used by some or all of the communication networks of the vehicle, such as the communication network of the vehicle. Since the speed of radio waves is constant and has nothing to do with the satellite speed, the time delay between the satellite transmission signal and the receiver reception signal is proportional to the distance from the satellite to the receiver. The receiver must see at least four satellites to calculate four unknown quantities (three position coordinates and the deviation of its own clock from the satellite time). However, the time information included in the GPS signal can be used not only to calculate the position coordinates, but also to calculate the time difference between two subsequently received GPS signals. When both GPSs signal a timestamp upon GPS signal reception, the time difference between the two timestamps should be substantially the same, i.e. ideally should be the same, but may slightly deviate from the time difference calculated based on the time included in the GPS signal. By checking whether this time difference is substantially the same, it can be ensured that no time corruption of the local time used at the receiver unit has occurred between the reception of the two GPS signals. Thus, safety integrity can be ensured even if the receiver itself does not provide safety integrity. The above description applies mutatis mutandis to all other satellite navigation systems and is therefore not limited to GPS which is used for exemplary purposes only.

[0023] In the following, optional further developments of the present disclosure are described in detail.

[0024] The receiving unit may provide a first timestamp to the received first location information and / or a second timestamp to the received second location information. That is, the timestamping may optionally be performed by the receiving unit when receiving the location information. The timestamp may include the actual time of the local clock of the receiving unit.

[0025] The receiving unit may be connected to a control unit of the vehicle. The method may further include sending the first time information and the second time information and the first timestamp and the second timestamp from the receiving unit to the control unit, and determining at the control unit whether the difference between the first time information and the second time information and the difference between the first timestamp and the second timestamp are the same and / or whether the deviation between the two differences is below a predefined threshold.

[0026] That is, when the receiving unit completes the timestamping, the timestamp may be sent from the receiving unit to the control unit, optionally together with the positioning information, and the control unit may calculate the time difference and compare the calculated time difference. This also allows the control unit to act as a central validator of the timestamps provided by different sub-receiving units, i.e. the receiving unit may comprise a plurality of receiving units for receiving positioning information from different positioning systems, such as satellite navigation systems. For example, one of the sub-receiving units may be provided for GPS and another of the sub-receiving units may be provided for Galileo. The two sub-receiving units may provide a timestamp to the position information received from the respective positioning systems. The control unit may then perform a time verification between the respective sub-receiving units.

[0027] That is, the method may include receiving first location information at a first receiving unit of a vehicle, the received first location information including first time information. The method may include providing a first timestamp to the received first location information based on the vehicle time when the first location information is received. Optionally, the first timestamp is provided by the first receiving unit. The method may include receiving second location information at a second receiving unit of a vehicle, the received second location information including second time information. The method may include providing a second timestamp to the received second location information based on the vehicle time when the second location information is received. Optionally, the second timestamp is provided by the second receiving unit. The method may include determining whether the difference between the first time information and the second time information and the difference between the first timestamp and the second timestamp are the same and / or whether the deviation between the two differences is below a predefined threshold. The first time information may be received from a first positioning system. The second time information may be received from a second positioning system. The first positioning system may be different from the second positioning system. The method may also include sending first time information and second time information as well as a first timestamp and a second timestamp from the first receiving unit and the second receiving unit to the control unit, and determining at the control unit whether the difference between the first time information and the second time signal and the difference between the first timestamp and the second timestamp are the same and / or whether the deviation between the two differences is lower than a predefined threshold.

[0028] The control unit may have a higher automotive safety level than the receiving unit. That is, the receiving unit may be a QM, while the control unit is ASIL B. As mentioned above, the automotive safety integrity level (ASIL) is a risk classification scheme defined by the above-mentioned ISO 26262 road vehicle functional safety standard. This is an adaptation of the safety integrity level (SIL) used in the automotive industry in IEC 61508. This classification helps define the safety requirements required to comply with the ISO 26262 standard. ASIL is established by performing a risk analysis of potential hazards by looking at the severity, exposure, and controllability of the vehicle operation scenario. The safety goal of the hazard then includes the ASIL requirement. The standard identifies four ASILs: ASIL A, ASIL B, ASILC, and ASIL D. ASIL D specifies the highest integrity requirements for the product, and ASIL A specifies the lowest integrity requirements. Hazards identified as QM (see below) do not specify any safety requirements.

[0029] The method may include synchronizing the local time of the receiving unit with the vehicle time. For example, PTP may be used to synchronize the receiving unit with the global time or master time used by the superordinate, i.e., the vehicle time. The receiving unit acts as a slave device for synchronization with the superordinate time. If more than one receiving unit is used, each receiving unit may be synchronized with the vehicle time.

[0030] The receiving unit may provide a first time stamp for the received first position information and / or a second time stamp for the received second position information based on its synchronized local time, ie based on its time synchronized with the global / vehicle time.

[0031] The first position information may be received from a first global navigation satellite system and the second position information may be received from a second global navigation satellite system, wherein the first global navigation satellite system and the second global navigation satellite system are different from each other.

[0032] The first position information and the second position information may be received from a global navigation satellite system.

[0033] The vehicle may be an autonomous vehicle. The vehicle may be a car, such as a sedan. The autonomous vehicle may be configured to at least partially and / or temporarily take over lateral and / or longitudinal guidance of the autonomous vehicle during autonomous driving. For this purpose, inter alia, position information verified in the above-described method may be used.

[0034] Autonomous driving can make the driving of a vehicle (largely) automatic.

[0035] The vehicle may be an autonomy level 1 vehicle, ie the driver takes over the task of dynamic driving, even if supporting systems (eg anti-lock braking system (ABS) and / or electronic stability control ESP) are available.

[0036] The vehicle may be an autonomy level 1 vehicle, ie having certain driver assistance systems supporting the driver in the operation of the vehicle, such as adaptive cruise control (ACC).

[0037] The vehicle may be an autonomy level 2 vehicle, ie partially automated, wherein functions such as automatic parking, lane keeping or lateral guidance, general longitudinal guidance, acceleration and / or braking are performed by a driver assistance system.

[0038] The vehicle may be an autonomy level 3 vehicle, i.e., one in which the vehicle is driven automatically in a conditional manner and the driver is not required to continuously monitor the system vehicle. The vehicle autonomously performs functions such as triggering turn signals, lane changes and / or lane keeping. The driver may attend to other matters, but the system will prompt the driver to take over control within a warning time if necessary.

[0039] The vehicle may be a vehicle of autonomy level 4, ie highly automated, in which the driving of the vehicle is permanently taken over by the system vehicle. If the system no longer handles the driving task, the driver may be asked to take over control.

[0040] The vehicle may be an autonomy level 5 vehicle, i.e., fully automated, where a driver is not required to perform driving tasks. No human intervention is required other than setting a destination and activating the system. The vehicle may be operated without a steering wheel or pedals.

[0041] The method may include controlling the autonomous driving function of the vehicle based on the received first position information and / or second position information only when the difference between the first time information and the second time information and the difference between the first timestamp and the second timestamp are the same and / or if the deviation between the two differences is below a predefined threshold.

[0042] Furthermore, a data processing system comprising components for executing the above method may be provided. The data processing system may be part of the above vehicle. A vehicle comprising the data processing system may also be provided.

[0043] The data processing system may include an electronic control unit (ECU), also known as an electronic control module (ECM), which is an embedded system in automotive electronics that controls one or more of the electrical systems or subsystems in a car or other motor vehicle. Modern vehicles have many ECUs, and these ECUs may include some or all of the following: engine control module (ECM), powertrain control module (PCM), transmission control module (TCM), brake control module (BCM or EBCM), central control module (CCM), central timing module (CTM), general electronic module (GEM), body control module (BCM) and suspension control module (SCM). These ECUs are sometimes collectively referred to as the computer of the car, although technically they are all separate computers, not a single computer. Sometimes, an assembly includes several individual control modules (PCM usually controls both the engine and the transmission). The ECU including the first microcontroller can be configured to control functions related to the driving behavior of the vehicle, such as an engine control system, a powertrain system, a braking system and / or a tire pressure control system. Additionally or alternatively, one, some or all driver assistance systems of an autonomous vehicle (such as parking assistance, adaptive cruise control, lane departure warning, lane change assistance, traffic sign recognition, light signal recognition, approach assistance, night vision assistance, intersection assistance and / or many other systems) may be controlled by an ECU. The ECU may be or may be part of a (smart) processor control unit, which may optionally communicate with other modules via a central gateway (CGW). The ECU may form part of an on-board network of a vehicle, including a fieldbus such as a CAN bus, a LIN bus, a MOST bus and / or a FlexRay or automotive Ethernet, optionally together with a telematics control unit.

[0044] Furthermore, the above description of the method applies mutatis mutandis to the data processing system vehicle and vice versa.

[0045] Furthermore, there may be provided a computer program comprising instructions which, when executed by a computer, cause the computer to perform the above-described method.

[0046] The program may comprise any program code, in particular a code suitable for a control system of a vehicle. The above description of the method, the data processing system and the vehicle applies mutatis mutandis to the computer program and vice versa.

[0047] Furthermore, a computer readable medium comprising instructions which, when executed by a computer, cause the computer to perform the above-described method may be provided.

[0048] The computer readable medium may be any digital data storage device, such as a USB flash drive, a hard disk, a CD-ROM, an SD card, or an SSD card. The above-mentioned computer program may be stored on a computer readable medium. However, the computer program does not necessarily have to be stored on such a computer readable medium, but may also be obtained via the Internet.

[0049] Furthermore, the above description regarding the method and the data processing system applies mutatis mutandis to the computer program and the computer-readable medium, and vice versa.

[0050] In other words, the above method can be summarized as the following more specific implementation, wherein the following description is not intended to limit the present disclosure in any way: the current prior art relies on ASIL-B receiver chips. However, the few available options for ASIL B receiver chips also limit the options for GNSS receiver ECUs. The basic principle of the present disclosure is a QM receiver and a QM receiver ECU that relays GNSS, and creates safety integrity by performing a reasonableness check on the timestamp of the GNSS data on the consumer side compared to the world global time received from (optionally) different GNSS systems (and optionally different satellites of each system). More specifically, the GNSS QM ECU may include several GNSS receivers for different systems. The GNSS data contains world time and positioning information from several satellites of the GNSS. The GNSS receiver ECU microcontroller unit (MCU) will obtain vehicle global time synchronization through the standard PTP protocol in the vehicle with QM safety integrity. The GNSS line data is timestamped with the global vehicle time immediately after reception. The timestamped GNSS data is sent to a higher-level positioning ECU, i.e., a GNSS consumer, for further processing with higher safety integrity. The method consists in checking the consistency of the time streams between the different satellite systems with the vehicle timestamps provided by the GNSS receivers. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Reference below Figure 1 and Figure 2 Embodiments are described.

[0052] Figure 1 Schematically shows an autonomous vehicle comprising a control unit configured to perform a method for time verification, and

[0053] Figure 2 A flow chart of the method is schematically shown. DETAILED DESCRIPTION

[0054] Figure 1 The automated vehicle 1 schematically shown in FIG. 1 comprises two receiving units 21, 22 for receiving position information from two positioning systems 31, 32, and a control unit 4 respectively connected to the two receiving units 21, 22. The control unit 4 has a higher vehicle safety level than the receiving units 21, 22.

[0055] The receiving units 21, 22 and the control unit 4 form (a part of) a data processing system 5 which is configured to perform a method for time verification, the method comprising essentially six steps S1-S6, such as Figure 2 As shown in the flowchart.

[0056] In a first step S1 of the method, the respective local times of the two receiving units 21 , 22 are synchronized with the vehicle time, for example using PTP.

[0057] In the second step S2 of the method, first location information is sent from the first positioning system 31 in the positioning system, and the first location information is received at the first receiving unit 21 in the receiving unit, and the received first location information includes first time information wt1. In the first step S1 of the method, second location information is sent from the second positioning system 32 in the positioning system, and the second location information is received at the second receiving unit 22 in the receiving unit, and the received second location information includes second time information wt2.

[0058] The first positioning system 31 in the positioning system is a first global navigation satellite system, such as GPS, and the second positioning system 32 in the positioning system is a second global navigation satellite system, such as Beidou. Therefore, the first position information is received from the first global navigation satellite system, and the second position information is received from the second global navigation satellite system, wherein the first global navigation satellite system and the second global navigation satellite system are different from each other. Alternatively, the first position information and the second position information can be received from one or the same global navigation satellite system, that is, the first positioning system 31 in the positioning system can send the first position information and the second position information to the first receiving unit 31 and / or the second receiving unit 32 in the receiving unit.

[0059] In the third step S3 of the method, a first timestamp ts1 is provided to the received first location information based on the transportation time when the first receiving unit 31 in the receiving unit receives the first location information (i.e., the synchronized local time of the first receiving unit 31 in the receiving unit), and a second timestamp ts2 is provided to the received second location information based on the transportation time when the second receiving unit 32 in the receiving unit receives the second location information (i.e., the synchronized local time of the second receiving unit 32 in the receiving unit).

[0060] In the fourth step S4 of the method, the first receiving unit 31 in the receiving unit sends the first time information wt1 and the first time stamp ts1 to the control unit 4 , and the second receiving unit 32 in the receiving unit sends the second time information wt2 and the first time stamp ts2 to the control unit 4 .

[0061] In the fifth step S5 of the method, the control unit 4 determines whether the difference between the first time information wt1 and the second time information wt2 and the difference between the first time stamp ts1 and the second time stamp ts2 are the same and / or whether the deviation between the two differences is below a predefined threshold. This can be calculated as follows: wt2-wt1=ts2-ts1 or (wt2-wt1)-(ts2-ts1)<threshold or (wt2-wt1)-(ts2-ts1)=<threshold.

[0062] In the sixth step S6 of the method, the control unit 4 directly or indirectly controls the automatic driving function of the vehicle 1 based on the received first position information and / or second position information only when the difference between the first time information wt1 and the second time information wt2 and the difference between the first timestamp ts1 and the second timestamp ts2 are the same and / or if the deviation between these two differences is lower than a predefined threshold.

[0063] Reference numerals

[0064] 1: Autonomous vehicles

[0065] 21, 22: Receiving unit

[0066] 31, 32: Positioning system

[0067] 4: Control unit

[0068] 5: Data processing system

[0069] S1-S6: Steps of the method

Claims

1. A method for time verification in a vehicle (1), the method comprising: - receiving first position information at a receiving unit (21, 22) of the vehicle (1), the received first position information comprising first time information, - providing a first timestamp to the received first position information based on a vehicle time when the first position information is received, - receiving second position information at the receiving unit (21, 22) of the vehicle (1), the received second position information comprising second time information, - providing a second timestamp to the received second position information based on the vehicle time when the second position information is received, and - determining whether a difference between said first time information and said second time information and a difference between said first time stamp and said second time stamp are the same and / or whether a deviation between said two differences is below a predefined threshold.

2. The method according to claim 1, wherein the receiving unit (21, 22) provides the first time stamp to the received first position information and / or provides the second time stamp to the received second position information.

3. The method according to claim 1 or 2, wherein the receiving unit (21, 22) is connected to a control unit (4) of the vehicle (1), wherein the method further comprises: - sending the first time information and the second time information as well as the first time stamp and the second time stamp from the receiving unit (21, 22) to the control unit (4), and - determining at the control unit (4) whether the difference between the first time information and the second time information and the difference between the first time stamp and the second time stamp are the same and / or whether the deviation between the two differences is below the predefined threshold.

4. The method according to claim 3, wherein the control unit (4) has a higher vehicle safety level than the receiving unit (21, 22).

5. The method according to any one of claims 1 to 4, wherein the method further comprises synchronizing the local time of the receiving unit (21, 22) with the vehicle time.

6. The method according to claim 5 as dependent on any one of claims 2 to 4, wherein the receiving unit (21, 22) provides the first timestamp to the received first location information and / or provides the second timestamp to the received second location information based on its synchronized local time.

7. The method according to any one of claims 1 to 6, wherein the first position information is received from a first global navigation satellite system (31) and the second position information is received from a second global navigation satellite system (32), wherein the first global navigation satellite system and the second global navigation satellite system (31, 32) are different from each other.

8. The method according to any one of claims 1 to 6, wherein the first position information and the second position information are received from a global navigation satellite system (31, 32).

9. A method according to any one of claims 1 to 8, wherein the vehicle (1) is an autonomous driving vehicle, and wherein the method further comprises controlling the autonomous driving function of the vehicle (1) based on the received first position information and / or second position information only when the difference between the first time information and the second time information and the difference between the first timestamp and the second timestamp are the same and / or if the deviation between the two differences is lower than the predefined threshold.

10. A data processing system (5) comprising means for performing the method according to any one of claims 1 to 9.

11. A computer program comprising instructions which, when the program is executed by a computer, cause the computer to perform the method according to any one of claims 1 to 9.

12. A computer-readable medium comprising instructions which, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 9.

Images