Method for securing driving behavior of vehicle by providing emergency stop trajectory

Abstract

The invention relates to a method for securing the driving behavior of a vehicle by providing an emergency stop trajectory for the vehicle. Furthermore, the invention relates to a computer program product, a device and a storage medium for this purpose.

Description

Technical Field

[0001] The invention relates to a method for securing the driving behavior of a vehicle by providing an emergency stop trajectory for the vehicle. The invention also relates to a computer program product, a device and a storage medium for this purpose. Background Art

[0002] In the context of autonomous vehicles, the protection of driving trajectories is becoming increasingly important. In this regard, many existing systems use the following approach: in addition to the main path, additional parallel paths are generated, which are designed with the help of independent planning algorithms. As a result, these systems are already very complex and expensive without a protection logic for the trajectory.

[0003] An alternative solution could be to guarantee the reachable area in extreme cases, for example when the steering wheel is completely stopped. In such a scenario, additional planning algorithms can be omitted, but it must be taken into account that the potentially reachable area of ​​the vehicle can be significantly expanded. This can lead to driving behavior that complies with large lateral distances to objects, which can be difficult to implement in practice. Summary of the invention

[0004] The subject matter of the invention is a method, a computer program product, a device and a computer-readable medium. Further features and details of the invention are derived from the corresponding description and the drawings. Features and details described in the context of the method according to the invention are of course also applicable in the context of the computer program product according to the invention, the device according to the invention and the computer-readable medium according to the invention, and vice versa, so that in terms of the disclosure of the individual inventive aspects, reference is always made to one another or can be made to one another.

[0005] The subject matter of the present invention is in particular a method for securing the driving behavior of a vehicle by providing an emergency stop trajectory for the vehicle, the method comprising the following steps:

[0006] - providing a master trajectory of the vehicle, wherein the master trajectory describes a normal forward motion path of the vehicle,

[0007] - generating at least one temporary trajectory based on the main trajectory, wherein the at least one temporary trajectory describes the stopping process of the vehicle,

[0008] - checking the at least one generated provisional trajectory using at least one criterion in order to assess whether the generated provisional trajectory is suitable for use as an emergency stop trajectory for an emergency stop maneuver of the vehicle, wherein the at least one criterion is specific to driving safety during an emergency stop maneuver and / or drivability of the vehicle for an emergency stop maneuver,

[0009] - Based on the check, an emergency stop trajectory is provided, in order to ensure the driving behavior of the vehicle by means of the provided emergency stop trajectory.

[0010] In the framework of the present invention, the trajectory is preferably the course of the following spatial curve: the main body, in particular the vehicle, moves along the spatial curve. Here, for example, the center of gravity of the main body is used to describe the trajectory. Emergency stop maneuvers are, for example, complete braking of the vehicle or special steering. In short, conventional forward movement can be understood as normal driving of the vehicle. Driving safety can, for example, mean that passengers or pedestrians of the vehicle are not harmed. Driving ability can mean that the emergency stop maneuver can be implemented mechanically by the vehicle. It can be advantageous to generate at least one temporary trajectory based on the main trajectory, because due to the data as the basis, no recalculation is required, and the computing workload can therefore be advantageously reduced. In this regard, this is advantageous because the calculation of the main trajectory can be based on a complex planning algorithm. It is also possible that the main trajectory does not specifically consider driving safety, so that the driving safety is advantageously taken into account by the emergency stop trajectory.

[0011] According to a further advantage, it can be provided that the movement path of the main trajectory describes the longitudinal movement and the lateral movement of the vehicle, wherein the lateral movement of the at least one generated temporary trajectory corresponds to the lateral movement of the main trajectory. By limiting the longitudinal movement when generating the temporary trajectory, the amount of data to be processed and thus the computing effort can be reduced.

[0012] In the context of the invention, it can be provided that the step of generating at least one temporary trajectory comprises generating at least two temporary trajectories in which the stopping process described by the respective temporary trajectory is changed. Thus, advantageously, different scenarios or braking maneuvers can be tested and checked with reference to at least one standard by means of the respective temporary trajectories.

[0013] Furthermore, within the framework of the invention, it is optionally possible that the step of generating is performed during driving of the vehicle and that the change of the stopping process is performed at least as a function of the current speed of the vehicle. Since the current speed influences the stopping process, the stopping process should advantageously be changed taking into account the current speed. Thus, it can be provided that a determined emergency stopping maneuver is provided for a determined speed.

[0014] In the context of the present invention, it is possible to consider that the stopping process is modified at least as a function of the system delay of the vehicle in order to ensure that the corresponding provisional trajectory takes the system delay into account and / or is collision-free taking into account the system delay. The system delay can be a lag caused by calculations of the vehicle, for example calculations of an onboard computer of the vehicle. The system delay can be modified as a function of the load factor caused by these calculations and can be taken into account separately when generating the corresponding provisional trajectory.

[0015] Furthermore, it may be possible that the at least one criterion is selected from at least one of the following criteria:

[0016] the drivability of the respective temporary trajectory, wherein the drivability indicates whether the respective temporary trajectory can be achieved by the longitudinal and transverse guides of the vehicle,

[0017] a permitted staying area of ​​the vehicle along the respective temporary trajectory, wherein, preferably, the permitted staying area indicates a predefined area of ​​the surroundings of the vehicle,

[0018] The collision avoidance of the vehicle along the respective provisional trajectory, wherein the collision avoidance preferably assesses the risk of collision of the vehicle with one or more road users or at least one static object.

[0019] The permitted stopping area can be predetermined by the vehicle, such as its own lane, roadway or a mapped area. The possible stopping area of ​​the vehicle is derived, for example, from the area that the vehicle may cover when passing through the trajectory, taking into account the inaccuracy of the regulation and the inaccuracy of the positioning. Preferably, when checking the collision-freeness, it is evaluated how great the risk of collision with one or more objects participating in the traffic during the realization of the trajectory is. Preferably, all objects are taken into account, not only moving objects, but also stationary objects (such as parked vehicles or construction site lights). When checking, not only the inaccuracy of the own regulation and positioning when realizing the trajectory can be taken into account, but also the inaccuracy of the object determination and the inaccuracy of the predicted behavior of the object can be taken into account. For example, a static object can be a bridge pier.

[0020] Furthermore, it is conceivable that at least one temporary trajectory is generated as the current temporary trajectory after a defined period of time, wherein if the result of the check of the current temporary trajectory using at least one criterion indicates that the current temporary trajectory is not suitable for use as an emergency stop trajectory, the method further comprises the following steps:

[0021] - controlling the vehicle along a provisional trajectory that was generated temporally before the current provisional trajectory.

[0022] In the context of the invention, it can also be provided that the current provisional trajectory is generated after a defined period of time. With the aid of this procedure, it is advantageously possible to continuously check whether at least one criterion is met and to react quickly if it is not met by controlling the vehicle along a previous provisional trajectory. In this case, in particular, a previous provisional trajectory that is chronologically preceding the current provisional trajectory has already met at least one criterion.

[0023] The vehicle can be configured as a motor vehicle and / or a passenger motor vehicle and / or an autonomous vehicle, for example. The vehicle can have a vehicle device and / or a driver assistance system, for example, for providing an autonomous driving function. The vehicle device can be implemented to control and / or accelerate and / or brake and / or steer the vehicle at least partially automatically.

[0024] A computer program, in particular a computer program product, is also the subject of the present invention, which computer program comprises instructions which, when executed by a computer, cause the computer to carry out the method according to the invention. The computer program according to the invention thus brings the same advantages as those described in detail with reference to the method according to the invention.

[0025] A device for data processing is also the subject of the present invention, which is designed to implement the method according to the present invention. For example, a computer can be provided as the device, which implements the method according to the present invention. The computer can have at least one processor for implementing the computer program. A non-volatile data memory can also be provided, in which the computer program can be stored and from which the computer program can be read by the processor for implementation.

[0026] A computer-readable storage medium may also be the subject of the present invention, which storage medium has a computer program according to the present invention and / or comprises instructions which, when executed by a computer, cause the computer to implement the method according to the present invention. The storage medium is, for example, configured as a data memory, such as a hard disk and / or a non-volatile memory and / or a memory card. The storage medium may, for example, be integrated into a computer. In addition, the method according to the present invention may also be implemented as a computer-implemented method. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Further advantages, features and details of the invention are apparent from the following description, in which various exemplary embodiments are described in detail with reference to the drawings. The features mentioned in the claims and in the description may be essential to the invention individually or in any combination. The drawings show:

[0028] Figure 1Schematic visualizations of a vehicle, a method, an apparatus, a storage medium and a computer program according to embodiments of the invention are shown.

[0029] Figure 2 A schematic diagram showing a method according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0030] exist Figure 1 Schematically depicts a vehicle 14 , a method 100 , an apparatus 10 , a storage medium 15 and a computer program 20 according to an exemplary embodiment of the present invention.

[0031] According to Figure 1 In the method 100 of the embodiment of the invention, in a first step 101, a main trajectory 4 of a vehicle 14 is provided, wherein the main trajectory 4 describes the normal forward movement path of the vehicle 14. In a second step 102, at least one temporary trajectory is generated based on the main trajectory 4, wherein the at least one temporary trajectory describes the stopping / braking process of the vehicle 14. In a third step 103, the at least one temporary trajectory generated is checked using at least one criterion to evaluate whether the generated temporary trajectory is suitable for use as an emergency stop trajectory 5 for an emergency stop maneuver of the vehicle 14. The at least one criterion is specifically used for driving safety and / or drivability in an emergency stop maneuver. In particular, the movement path for the emergency stop maneuver of the vehicle 14 is described by the emergency stop trajectory 5. In a fourth step 104, based on the check, a suitable emergency stop trajectory 5 is provided so that the driving behavior of the vehicle 14 is guaranteed by the provided emergency stop trajectory 5.

[0032] The invention is based in particular on a concept in which planning algorithms for the lateral movement of the vehicle can be dispensed with, but the potential stopping area of ​​the vehicle can nevertheless be limited. This allows the complexity of AD systems (Automated Driving Systems) to be significantly reduced and, in this connection, the maintenance effort to be significantly reduced.

[0033] For example, automated vehicles have the task of relieving the driver of driving tasks or taking over the driving tasks in order to temporarily or completely relieve the driver from the driving task. These systems therefore have particularly high safety requirements, which primarily relate to the availability, reliability and integrity of the system and in particular also to a high SOTIF (English: Safety Of The Intended Functionality; German: Sicherheit derbeabsichtigten Intended functional safety) requirements. Here, the automated driving system (English: Automatic Driving (AD)-System) includes, for example, many different software components and hardware components, which may be needed for detecting situations (such as vehicle state estimation, surrounding environment detection, positioning), for creating a surrounding environment model including planning its own behavior (such as fusion, situation analysis and evaluation, planning) and for implementing the planned behavior (longitudinal control and lateral control). Here, preferably, planning one's own behavior plays a role, because when planning, in addition to considering one's own driving goals, the behavior of other traffic participants and traffic regulations can also be considered. The planned behavior can be described by a trajectory.

[0034] In order to be able to solve this task, time-consuming and complex algorithms can be used in planning. This fact leads to a huge cost for security in particular. For the following automated vehicles, the security cost can be significantly reduced by means of an embodiment of the present invention: for this automated vehicle, it is sufficient to perform an emergency stop maneuver in the case of a fault being identified. For this purpose, in parallel with the main implementation path (also referred to as the main path or main trajectory in the framework of the present invention) of the calculated planned trajectory, a second implementation path, the so-called security path or emergency stop trajectory, can be generated and used. Preferably, the security path or emergency stop trajectory contains all the modules required to ensure safety requirements. If the emergency stop trajectory identifies that there is no violation of the safety target, then preferably, the vehicle is controlled by the planned behavior of the main trajectory. However, if a violation of the safety target is identified, the vehicle control is especially taken over and the emergency stop maneuver is implemented along the emergency stop trajectory. In addition, it can be applicable that the system, especially the system of the vehicle, can only be activated when it is identified that there is no violation of the safety target. This can allow that in the main path, not only the modules that are guaranteed but also the modules that are not guaranteed can be used.

[0035] One aspect of the invention is in particular to extend a system for vehicle automation with a parallel path. The parallel path preferably calculates at least one temporary trajectory based on the trajectory of the main path in order to determine a safe emergency stop trajectory 5 and thus advantageously ensure the safety of the system. In addition to ensuring the emergency stop trajectory 5 described below, the use of a safe steering system and a braking system in the parallel path can ensure the safe implementation of this trajectory. For example, this can use the main path method with increased verification effort.

[0036] The individual safeguards in the parallel path can be realized by the following steps. By superimposing different braking maneuvers, the emergency stop trajectory 5 is calculated based on an arbitrary trajectory (for example, different emergency stop braking maneuvers are also considered according to the speed range). In terms of its lateral movement, the emergency stop trajectory 5 preferably remains on the main trajectory 4. Taking into account the system delay can ensure that the emergency stop trajectory 5 is still collision-free in the next time step. Another step can be to verify the safety requirements by means of a validation of the emergency stop trajectory 5 through modular checks. Preferably, these modular checks evaluate each emergency stop trajectory 5 in terms of the drivability 8, reliable stop area 6 and collision-freeness of the emergency stop trajectory. If the emergency stop trajectory 5 meets all checks, the emergency stop trajectory can be considered safe. As a further step, preferably in the judge 11, the selection of the target trajectory can be performed. In particular, if there is at least one safe emergency stop trajectory 5, the judge adopts the main trajectory 4. Otherwise, preferably, the emergency stop trajectory 5 with the smallest collision risk in the last time step is selected as the target trajectory. The scheme can have a modular architecture, which can be used in different hardware architectures. In particular, the concept allows simple consideration of system insecurities, such as positioning inaccuracies, inaccuracies in the determination of the vehicle movement, or system delays, in the calculation of the emergency stop trajectory 5 or in the safety check. Additional planning algorithms for lateral movements, including planning and ensuring steering movements, can be omitted. This reduces the overall complexity, for example, and thus allows the concept to be implemented even on smaller processors. The modular design makes it possible to easily adapt the concept, for example by means of additional checks, such as compliance with traffic regulations or only executing maneuvers according to system specifications.

[0037] In the present invention, in one embodiment, a simplified module is used in the guarantee path, which simplifies the module to calculate the emergency stop trajectory 5 from any input trajectory, which does not necessarily have to be guaranteed, and with the help of which a safe system behavior can be provided. Preferably, the module includes the calculation of the emergency stop trajectory 5, the trajectory evaluation and the judgement device 11.

[0038] The submodule "Calculate emergency stop trajectory" uses in particular the planned trajectory from the main path, i.e. the main trajectory, as input. The longitudinal movement of the trajectory can be recalculated in that, instead of the previous longitudinal behavior, the longitudinal behavior of the emergency stop maneuver is used as the basis of the trajectory starting from the switch-on time point. The switch-on time point is calculated, for example, from the current time point in a manner including the maximum cycle time for the entire module. Preferably, the result of this calculation is an emergency stop trajectory 5, which has the same lateral movement as the input trajectory and ends in a stopped state. By changing the braking behavior for the emergency stop maneuver, a set of emergency stop trajectories 5 can be obtained instead of one emergency stop trajectory 5, which can all have the same lateral movement as the input trajectory. The change in braking behavior is derived in particular from the minimum and maximum requirements for the emergency stop maneuver. Preferably, the minimum requirement is derived from the emergency stop maneuver, which the vehicle 14 can implement at any time in the current driving state, as long as the vehicle is within the system boundary / ODD (Operational Design Domain). The maximum requirement for the emergency stop maneuver is preferably derived from the most powerful, permissible emergency stop maneuver to a standstill for automated vehicle 14 in the current driving state.

[0039] Preferably, the lateral behavior of the input trajectory is used as the basis for calculating the emergency stop trajectory 5. This eliminates the need for additional planning algorithms for lateral movements in the safety path, which, depending on the application domain (English: Operational Design Domain, ODD) of the networked and autonomous vehicle 14, can be very complex and can therefore significantly increase the safety effort. In addition, by eliminating this, the total calculation time of the safety path can be reduced, which can reduce the reaction time of the system, especially in critical situations that occur suddenly.

[0040] Preferably, the submodule "trajectory evaluation" evaluates the calculated emergency stop trajectory 5 with respect to its drivability 8, reliable stopping area 6 and collision-freeness. Preferably, when checking the drivability 8, it is evaluated whether the trajectory can be realized by the longitudinal and transverse guides located downstream and whether the trajectory moves within the system limits. This can be, for example, a test, such as determining the change in the longitudinal or transverse behavior when adjusting the trajectory within the limits that can be realized, or determining whether the possible total force on the vehicle is exceeded until the maximum friction force is reached, taking into account the lateral guiding force in the transverse direction of the wheel and the braking force or driving force in the longitudinal direction of the wheel. In addition, it can be tested whether the longitudinal movement and the transverse movement remain within the system limits at any time.

[0041] Only when all checks are satisfied, the trajectory preferably passes the check of drivability 8, otherwise, it fails. When checking the allowed stopping area 6, it is particularly evaluated whether the possible stopping area 6 of the vehicle 14 is located in the stopping area 6 allowed by the system at any time point of the trajectory. The allowed stopping area 6 can be pre-given by the AD system, such as one's own lane, lane or mapped area. The possible stopping area 6 of the vehicle 14 is derived, for example, from the following area: the vehicle 14 may cover the area when passing through the trajectory, taking into account the inaccuracy of the adjustment and the inaccuracy of the positioning. If the trajectory meets the check, the trajectory can pass the check of the stopping area 6, otherwise, it fails. Preferably, when checking collision-free, it is evaluated: how great is the risk of collision with one or more objects participating in the traffic during the realization of the trajectory. Here, preferably, all objects are considered, not only moving objects, but also stationary objects (such as parked vehicles 14 or construction site lights). In the check, not only the inaccuracies of the own control and positioning when implementing the trajectory can be taken into account, but also inaccuracies in the object determination and inaccuracies in the predicted behavior of the object. Preferably, the check for collision avoidance is considered to have been passed if a collision 7 can be safely avoided taking into account the mentioned inaccuracies. Otherwise, in particular, collision avoidance is not guaranteed and the check is considered to have failed. In this case, the determined risk of collision can also be provided.

[0042] Preferably, the submodule "determinator" 11 analyzes the structure of the "trajectory evaluation". If there is at least one trajectory that has passed all checks, it can now be guaranteed that there is at least one safe emergency stop trajectory 5 in the next time step. In this case, the safety path preferably behaves passively. If none of the trajectories meets all checks, the safety goal is potentially violated and the safety path can take over the vehicle control, wherein the emergency stop trajectory 5 with the lowest collision risk in the previous time step is preferably transmitted to the vehicle control device. This emergency stop trajectory can always be safe because the cycle time is taken into account when calculating this emergency stop trajectory 5.

[0043] The described solution is preferably constructed in a modular manner, and checks on additional safety goals can be added if necessary. For example, if there is a safety goal for the automated vehicle 14 that requires compliance with traffic regulations, such as compliance with right-of-way regulations, it is possible to integrate additional checks in the submodule "trajectory evaluation", which checks this safety goal. The results of this check can then be taken into account accordingly in the submodule "judge" 11. The described solution can be additionally expanded in that, in addition to the planned trajectory, additional trajectories are used as inputs to the submodule "calculate emergency stop trajectory" 5, the additional trajectories containing other lateral movements. As a result, in particular, the processing possibilities for safe paths are increased, and therefore there is at least one emergency stop trajectory 5 that passes all checks.

[0044] Figure 2 A possible embodiment of the method is shown schematically. Thus, in particular, the values ​​of estimation 1 of the vehicle state, positioning 2 and perception of the surroundings 3 are incorporated into the provision of the main trajectory 4. Preferably, an emergency stop trajectory 5 is generated based on the main trajectory 4. The emergency stop trajectory can be evaluated using standard drivability 8, the permitted stopping area of ​​the vehicle 6 and collision avoidance 7. Next, preferably, the judge 8 performs the following judgment: whether there is a safe emergency stop trajectory 4, or whether the emergency stop trajectory 4 with the highest collision avoidance 7 is selected. In the next step, a motion control 11 can be implemented, which initiates the movement of different actuators 13 of the vehicle through corresponding values.

[0045] The above description of the embodiments describes the invention only in the framework of examples. Of course, the individual features of the embodiments can be freely combined with each other as long as it is technically reasonable, without leaving the framework of the invention.

Claims

1. A method (100) for securing the driving behavior of a vehicle (14) by providing an emergency stop trajectory (5) for the vehicle (14), the method comprising the following steps: - providing (101) a main trajectory (4) of the vehicle (14), wherein The main trajectory (4) describes the normal forward motion path of the vehicle (14), - generating (102) at least one temporary trajectory based on the main trajectory (4), wherein the at least one temporary trajectory describes a stopping process of the vehicle (14), - checking (103) at least one generated temporary trajectory using at least one criterion in order to evaluate whether the generated temporary trajectory is suitable for use as an emergency stop trajectory (5) for an emergency stop maneuver of the vehicle (14), wherein the at least one criterion is specific to driving safety during the emergency stop maneuver and / or drivability of the emergency stop maneuver by the vehicle (14), wherein the emergency stop trajectory (5) describes a movement path for the emergency stop maneuver of the vehicle (14), Based on the check (103), the emergency stop trajectory (5) is provided (104), so that the driving behavior of the vehicle (14) is guaranteed by the provided emergency stop trajectory (5).

2. The method (100) according to claim 1, It is characterized in that The movement path of the main trajectory (4) describes the longitudinal movement and the lateral movement of the vehicle (14), wherein the lateral movement of at least one generated temporary trajectory corresponds to the lateral movement of the main trajectory (4).

3. The method (100) according to any one of the preceding claims, It is characterized in that The step of generating (102) at least one temporary trajectory comprises generating at least two temporary trajectories in which the stopping process described by the respective temporary trajectories is changed.

4. The method (100) according to claim 3, It is characterized in that The step of generating (102) is performed while the vehicle (14) is moving, and the change of the stopping process is performed at least according to the current speed of the vehicle (14).

5. The method (100) according to any one of claims 3 or 4, It is characterized in that The stopping process is modified at least as a function of a system delay of the vehicle (14) in order to ensure that a corresponding provisional trajectory takes into account the system delay and / or is collision-free taking into account the system delay.

6. The method (100) according to any one of the preceding claims, It is characterized in that The at least one criterion is selected from at least one of the following criteria: - the drivability (8) of the respective temporary trajectory, wherein the drivability (8) indicates whether the respective temporary trajectory can be achieved by the longitudinal and transverse guidance of the vehicle (14), a permitted stopping area (6) of the vehicle (14) along the respective temporary trajectory, wherein the permitted stopping area (6) preferably indicates a predefined area of ​​the surroundings of the vehicle (14), - a collision avoidance (7) of the vehicle (14) along a respective provisional trajectory, wherein the collision avoidance (7) preferably assesses a risk of collision of the vehicle (14) with one or more road users or at least one static object.

7. The method (100) according to any one of the preceding claims, It is characterized in that After a defined period of time, the at least one temporary trajectory is generated as a current temporary trajectory, wherein if the result of a check (103) of the current temporary trajectory using the at least one criterion indicates that the current temporary trajectory is not suitable for use as the emergency stop trajectory (5), the method (100) further comprises the following steps: - controlling the vehicle (14) along a provisional trajectory that was generated before the current provisional trajectory in terms of time.

8. A computer program product (20) comprising instructions which, when executed by a computer (10), cause the computer to carry out the method (100) according to any one of the preceding claims.

9. A device (10) for data processing, which is designed to carry out the method (100) according to any one of claims 1 to 7.

10. A computer-readable storage medium (15), comprising instructions which, when executed by a computer (10), cause the computer to perform the steps of the method (100) according to any one of claims 1 to 7.

Images