Automatic driving vehicle and working method thereof

Abstract

An autonomous driving vehicle includes: at least one sensor that senses an environment of the vehicle and generates environment information; a processor that monitors a state of the vehicle to generate vehicle state information and controls automatic driving of the vehicle; and a controller that controls an operation of the vehicle according to control of the processor, the processor configured to sense whether a minimum risk operation needs to be performed based on at least one of the ambient environment information and the vehicle state information during autonomous driving of the vehicle, and, in a case where the minimum risk operation needs to be performed, determine whether the minimum risk operation needs to be performed. A minimum risk operation type is determined based on the vehicle state information, and control is performed to stop the vehicle based on the determined minimum risk operation type, the minimum risk operation type including a minimum risk operation type without a lane change and a minimum risk operation type accompanying a lane change.

Description

[0001] This case is filed on October 20, 2021 、Application No. 202180073768.X(PCT / KR2021 / 014662) 、The name of the invention is Vehicle for performing minimal risk operations and method of operating the same Divisional application. Technical Field

[0002] The present invention relates to a vehicle for performing a minimum risk maneuver and a method of operating such a vehicle. Background Art

[0003] Recently, cutting-edge driver assistance systems (Advanced Driver Assistance Systems) are being developed to assist drivers in driving. ADAS has multiple sub-technical categories that can provide convenience for drivers. This type of ADAS is also called autonomous driving, and is also called ADS (Automated Driving System).

[0004] On the other hand, when a vehicle is performing autonomous driving, unexpected accidents or incidents may occur, and if appropriate countermeasures are not taken to deal with such incidents, the vehicle may be put in a dangerous state. Summary of the invention

[0005] Technical problem to be solved by the invention

[0006] According to the present invention, when the vehicle is in danger due to an event occurring during the driving of the vehicle, a minimum risk operation for eliminating (or alleviating) the danger can be performed.

[0007] Technical solutions for solving technical problems

[0008] The vehicle of the present invention is capable of performing automatic driving without driver intervention, and in the event of a specific event occurring during the automatic driving process, performing a minimum risk maneuver (MRM: Minimal Risk Manoeuvre). With the start of the minimum risk maneuver, the danger to the vehicle is eliminated. After the danger to the vehicle is eliminated, the minimum risk maneuver is ended, thereby switching to a minimum risk condition (Minimal Risk Condition).

[0009] Effects of the Invention

[0010] According to the present invention, even if the vehicle is in danger due to an event occurring during the automatic driving process, a minimum risk operation capable of eliminating the danger can be performed, thereby allowing the vehicle to escape danger and switch to a minimum risk state, thereby further improving the driving stability of the vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A vehicle according to the present invention is shown.

[0012] Figure 2 It is a diagram showing the state of a vehicle according to the first embodiment of the present invention.

[0013] Figure 3 This is a flowchart showing the operation of the vehicle according to the first embodiment of the present invention.

[0014] Figure 4 An example of minimal risk operation is shown for the first embodiment of the present invention.

[0015] Figure 5 An example of minimal risk operation is shown for the first embodiment of the present invention.

[0016] Figure 6 An example of minimal risk operation is shown for the first embodiment of the present invention.

[0017] Figure 7 An example of minimal risk operation is shown for the first embodiment of the present invention.

[0018] Figure 8 An example of minimal risk operation is shown for the first embodiment of the present invention.

[0019] Fig. 9 is a block diagram for illustrating steps of performing a minimum risk operation according to a second embodiment of the present invention.

[0020] Fig.10 It is a diagram for explaining the MRM step of the second embodiment of the present invention.

[0021] Fig.11 It is a diagram for explaining the MRM type of the second embodiment of the present invention.

[0022] Fig.12 It is a diagram for explaining the minimum sensing range of the second embodiment of the present invention.

[0023] Fig.13 It is a diagram for explaining the minimum sensing range of the second embodiment of the present invention.

[0024] Fig.14 is a flow chart showing a method of selecting a type of minimum risk operation according to a third embodiment of the present invention.

[0025] Fig.15 1 is a flowchart showing a safe zone stop operation according to a minimum risk operation according to a fourth embodiment of the present invention.

[0026] Fig.16 1 is a flowchart showing emergency situation determination and emergency situation processing according to a fifth embodiment of the present invention.

[0027] Fig.17 is a flow chart showing a method for generating notifications based on minimal risk operations according to a sixth embodiment of the present invention.

[0028] Fig.18 Detailed description of the invention is given by way of flowchart of a method for granting control authority according to a seventh embodiment of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be described below with reference to the accompanying drawings.

[0030] When a plurality of embodiments are described in the present invention, each embodiment may be an independent embodiment, or two or more embodiments may be mixed.

[0031] Figure 1 A vehicle according to a first embodiment of the present invention is shown. Figure 1 The vehicle (100) is capable of supporting automated driving. According to an embodiment, the vehicle (100) is capable of steering, accelerating, braking, changing speed, or parking without driver operation, and is capable of driving according to driver control when the driver intervenes. For example, the vehicle (100) may be a vehicle capable of performing automated driving at a level of Level 3 or higher as specified by SAE (Society of Automation Engineers), but the present invention is not limited thereto.

[0032] For example, the autonomous driving described in this specification may include: at least one of the ADS functions such as PDCMS (Pedestrian Detection and Collision Mitigation System), LCDAS (Lane Change Decision Aid System), LDWS (Land Departure Warning System), ACC (Adaptive Cruise Control), LKAS (Lane Keeping Assistance System), RBDPS (Road Boundary Departure Prevention System), CSWS (Curve Speed ​​Warning System), FVCWS (Forward Vehicle Collision Warning System), and LSF (Low Speed ​​Following).

[0033] The vehicle (100) may include a sensor (110), a controller (120), a processor (130), a display (140), and a communication circuit (150).

[0034] The sensor (110) can sense the environment around the vehicle (100) and generate data related to the surroundings of the vehicle (100). According to an embodiment, the sensor (100) may include at least one of a camera, a light detection and ranging (LIDAR) sensor, a radar (radio detection and ranging (RADAR)) sensor, and a position sensor.

[0035] The camera can capture images around the vehicle (100) and generate images around the vehicle (100) based on the captured images. The camera can sense the front, rear and / or sides of the vehicle (100) and generate image data based on the sensed images. For example, the camera can generate image data of other objects (e.g., other vehicles, people, objects, lanes, obstacles) located in front, rear and / or sides of the vehicle (100).

[0036] According to an embodiment, the camera may include an image sensor, an image processor, and a camera MCU. For example, the image sensor may sense an image of a subject captured through a lens, the image processor may receive and process data from the image sensor, and the camera MCU may receive data from the image processor.

[0037] The laser radar sensor can use light (or laser) to sense the front, rear and / or sides of the vehicle (100) and generate sensing data based on the sensing results. For example, the laser radar sensor can sense or identify other objects (such as other vehicles, people, objects, lanes, obstacles) located in front, rear and / or sides of the vehicle (100).

[0038] According to the embodiment, the laser radar sensor may include a laser transmission module, a laser detection module, a signal collection and processing module, and a data transmission / reception module. As a laser light source, a laser light source with a wavelength in the wavelength region of 250nm to 11μm or a wavelength adjustable laser light source may be used. In addition, according to the signal modulation method, the laser radar sensor can be divided into a TOF (time of flight) method and a phase shift method.

[0039] The radar sensor can use electromagnetic waves (or radio waves) to sense the front, rear and / or sides of the vehicle (100), and generate sensing data according to the sensing results. For example, the radar sensor can sense or identify other objects (such as other vehicles, people, objects, lanes, obstacles) located in front, rear and / or sides of the vehicle (100).

[0040] The radar sensor can sense objects up to 150m ahead within a horizontal angle range of 30 degrees using a frequency modulated carrier wave (FMCW) or a pulse carrier wave (Pulse Carrier). The radar sensor can process the data generated according to the sensing results, and such processing may include magnifying the sensed forward object or focusing it to the object area in the overall field of view.

[0041] The position sensor can determine the current position of the vehicle (100). According to an embodiment, the position sensor may include a GPS sensor, and the GPS sensor can determine the position, speed and current time of the vehicle (100) by communicating with a satellite. According to an embodiment, the GPS sensor can measure the delay time of radio waves emitted from the satellite and calculate the position of the vehicle (100) based on the distance from the track.

[0042] The controller (120) can control the operation of the vehicle (100) according to the control of the processor (130). According to an embodiment, the controller (120) can control the steering, driving, braking and speed change of the vehicle (100). For example, the controller (120) can control the components for performing the steering, driving, braking and speed change of the vehicle (100).

[0043] The controller (120) can control the steering of the vehicle (100) according to the control of the processor (130). According to an embodiment, the controller (120) can control an electric power steering system (MPDS) for driving a steering wheel. For example, in the event of a collision of the vehicle, the controller (120) can control the vehicle to steer in a direction to avoid the collision or minimize the damage.

[0044] The controller (120) can control the driving of the vehicle (100) according to the control of the processor (130). According to an embodiment, the controller (120) can execute deceleration, acceleration, or engine start / stop (on / off) of the vehicle (100). For example, the controller (120) can execute acceleration or deceleration according to the control of the processor (130), and can execute engine start / stop when starting or ending the operation of the vehicle (100).

[0045] In addition, the controller (120) can control the driving of the vehicle (100) without driver control. For example, the controller (120) can perform automatic driving of the vehicle (100) according to the control of the processor (130).

[0046] The controller (120) can control the braking of the vehicle (100) according to the control of the processor (130). According to an embodiment, the controller (120) can control whether the brake of the vehicle (100) is actuated and control the pedal force of the brake. For example, the controller (120) can control to automatically operate the emergency brake when a collision is expected.

[0047] The processor (130) can control the overall operation of the vehicle (100). According to an embodiment, the processor (130) can be an ECU (electrical control unit) capable of overall control of components within the vehicle (100). For example, the processor (130) can include a CPU (central processing unit) or an MCU (micro processing unit) capable of performing arithmetic processing.

[0048] The processor (130) may perform a judgment related to the control of the vehicle (100), and control the controller (120) according to the judgment result. According to an embodiment, the processor (130) may receive data from the sensor (100), and generate a control command for controlling the controller (120) based on the received data. The processor (130) may transmit the control command to the controller (120). In addition, the processor (130) may receive an input or control from a driver, and control the controller (120) according to the input from the driver.

[0049] In addition, the above description assumes that the controller (120) and the processor (130) are independent components, but according to an embodiment, the controller (120) and the processor (130) can be integrated into one component. For example, the controller (120) and the processor (130) can be integrated into one device and work in conjunction with each other.

[0050] The display (140) can visually display information related to the vehicle (100). According to an embodiment, the display (140) can provide various information related to the vehicle (100) to the driver of the vehicle (100) according to the control of the processor (130). For example, the display (140) can visually display the current state of the vehicle (100) according to the control of the processor (130).

[0051] The communication circuit (150) is capable of communicating with the outside of the vehicle (100). According to an embodiment, the communication circuit (150) can receive data from the outside of the vehicle (100) or transmit data to the outside of the vehicle (100) according to the control of the processor (130). For example, the communication circuit (150) can perform communication using a wireless communication protocol or a wired communication protocol.

[0052] For example, the vehicle (100) may utilize the communication circuit (150) to communicate with other vehicles (vehicle to vehicle) or with infrastructure (vehichle to infra).

[0053] Figure 2 FIG. 1 is a diagram showing a state of a vehicle according to a first embodiment of the present invention. Figure 1 and Figure 2 , the state of the vehicle (100) can be changed as Figure 2 The diagram shown changes (or shifts).

[0054] The state of the vehicle (100) may be any one of a driving state (S1), a minimal risk maneuver (MRM) state (S2), a minimum risk condition state (S3), and a minimum risk maneuver end state (S4). According to an embodiment, the states (S1-S4) may be transferred to other states when certain conditions are met.

[0055] The driving state (S1) may refer to a state in which the vehicle (100) is driving. According to an embodiment, in the driving state (S1), the vehicle (100) may be driven according to the control of the processor (130). For example, the driving state (S1) may refer to a state in which the vehicle (100) is performing automatic driving.

[0056] The minimum risk operation state (S2) may refer to a state in which the vehicle (100) performs a minimum risk operation according to a minimum risk operation request. According to an embodiment, the vehicle (100) being driven may start the minimum risk operation when the minimum risk operation is required. That is, the driving state (S1) may be transferred to the minimum risk operation state (S2).

[0057] In the minimum risk operation state (S2), the vehicle (100) can perform an operation for reducing the risk of the vehicle (100). According to an embodiment, the vehicle (100) can determine whether the minimum risk operation is required by various methods, and when the above-mentioned minimum risk operation is required, a request for the minimum risk operation can be generated. For example, the vehicle (100) can perform at least one of steering, deceleration, acceleration, lane change and emergency braking to perform the minimum risk operation. The minimum risk operation will not inhibit other safety functions of the vehicle (100) (such as automatic emergency braking, pedestrian collision sensing braking, bicycle collision sensing braking, etc.). That is, the minimum risk operation and other safety functions of the vehicle (100) can be performed in parallel or sequentially.

[0058] After the minimum risk operation starts, the vehicle (100) performs the minimum risk operation in priority to the current driving, and can obtain the driver's control authority. That is, the vehicle (100) can cancel or stop the scheduled driving and perform the minimum risk operation.

[0059] When the vehicle (100) performs autonomous driving, a specific event may occur that prevents the autonomous driving from continuing. When the above-mentioned specific event occurs, the vehicle (100) may be in an (unexpected) dangerous state. In order to resolve (or alleviate) this dangerous state, a minimum risk operation may be performed on the vehicle (100). For example, the vehicle (100) may automatically sense the specific event and automatically perform the minimum risk operation in response to the occurrence of the above-mentioned specific event.

[0060] The above-mentioned specific events may include failure of a component of the vehicle (100), deviation from the path of the vehicle (100), or control failure of the vehicle (100).

[0061] According to an embodiment, when autonomous driving, components for performing autonomous driving, or other components of the vehicle (100) fail, the vehicle (100) can perform a minimum risk operation.

[0062] In addition, according to an embodiment, the vehicle (100) may perform a minimum risk operation when approaching a boundary of an operational design domain (ODD). The operational design domain may be a drivable range designed to allow automatic driving of the vehicle (100). For example, when the vehicle (100) approaches an outer boundary of the operational design domain from the inside of the operational design domain, the vehicle (100) may perform a minimum risk operation.

[0063] In addition, according to an embodiment, when the control authority of the vehicle (100) fails to be transferred to the driver (take over), the vehicle (100) can perform a minimum risk operation. When the driver is unable to control the vehicle (100) (for example, SAE's dynamic driving task (DDT)) when changing from an automatic driving mode to a manual driving mode (for example, in the case of Level 3 automatic driving), the vehicle (100) can start a minimum risk operation. For example, when the control authority of the vehicle (100) fails to be transferred to the driver when changing from an automatic driving mode to a manual driving mode, a minimum risk operation can be started. That is, when a specific control action of the driver is required (for example, operating the brakes or steering, etc.), but the driver does not perform the above-mentioned specific control action, the minimum risk operation can be started.

[0064] When the minimum risk operation cannot be performed, the vehicle (100) may collide with other vehicles, pedestrians or other structures due to the misoperation of the (automatic) driving, thereby possibly injuring the driver, passengers or pedestrians. In addition, the vehicle (100) may deviate from the road due to the above-mentioned misoperation. In other words, without the minimum risk operation, the automatic driving of the vehicle (100) may not be performed as well as expected. In order to avoid such undesirable specific events, the minimum risk operation is required.

[0065] In the minimum risk operation state (S2), that is, after starting the minimum risk operation, the vehicle (100) can perform actions that minimize the risk of the vehicle (100), the driver or passengers of the vehicle (100) until the risk around the vehicle (100) is eliminated and a risk-free state is ensured.

[0066] According to an embodiment, with the start of the minimum risk operation, the vehicle (100) can perform at least one of stopping the vehicle, controlling the steering of the vehicle, maintaining the lane, providing visual, auditory and tactile prompts, slowing down the vehicle, accelerating the vehicle, starting / ending automatic driving, starting and shutting down the vehicle, transmitting emergency signals, controlling hazard warning lights, deceleration warnings, controlling brakes, etc., transferring control authority to other passengers, and remote control.

[0067] The minimum risk condition state (S3) may refer to a state in which the danger of the vehicle (100) is removed or reduced. According to an embodiment, as the vehicle (100) performs the minimum risk operation, the danger of the vehicle (100) may be removed. That is, the minimum risk operation state (S2) may be transferred to the minimum risk condition state (S3). For example, the minimum risk condition may refer to a state in which the vehicle (100) is stable or a situation in which the vehicle (100) is stopped. Such a minimum risk condition may be satisfied by the driver's operation or by the vehicle (100) autonomously.

[0068] When the danger to the vehicle (100) is removed, the minimum risk condition may be satisfied. In other words, in order to satisfy the minimum risk condition, a minimum risk operation may be performed.

[0069] On the other hand, if the minimum risk condition is not satisfied, the vehicle (100) may continue to perform the minimum risk operation. In this case, the transition from the minimum risk operation state (S2) to the minimum risk condition state (S3) may not occur. For example, the vehicle (100) may ignore other controls except the control of the vehicle (100) for the minimum risk operation when the minimum risk condition is not satisfied. That is, after the minimum risk operation starts, the vehicle (100) continues to perform the minimum risk operation regardless of the driver's control.

[0070] The minimum risk operation end state (S4) may refer to a state where the risk of the vehicle (100) is removed (ie, the minimum risk condition is satisfied) and the minimum risk operation is ended. That is, the minimum risk condition state (S3) may be transferred to the minimum risk operation end state (S4).

[0071] According to an embodiment, when the minimum risk condition of the vehicle (100) is satisfied after performing the minimum risk operation, the vehicle (100) may end the minimum risk operation. For example, when the vehicle (100) stops, the minimum risk operation may be suspended or ended.

[0072] According to an embodiment, when the minimum risk operation condition is met and the reference time has passed, the vehicle (100) can end the minimum risk operation. For example, when the minimum risk operation is performed and the vehicle (100) stops, if the above-mentioned stop state is maintained for the reference time, the vehicle (100) can end the minimum risk operation.

[0073] After the minimum risk operation is completed, the vehicle (100) can start driving again. According to an embodiment, after the minimum risk operation is completed, the vehicle (100) can start a new driving or continue the previous driving according to the driver's operation or according to the control of the processor (130).

[0074] In general, reference Figure 2 According to the figure, the vehicle (100) of the present invention can perform (automatic) driving (i.e., driving state (S1)). In the event that a specific event occurs during the driving of the vehicle (100), the vehicle (100) can perform a minimum risk operation (i.e., minimum risk operation state (S2)). After the minimum risk operation starts, the risk of the vehicle (100) is removed (i.e., minimum risk condition state (S3)). When the risk is removed, the vehicle (100) ends the minimum risk operation (i.e., minimum risk end state (S4)). After the minimum risk operation ends, the vehicle (100) can drive again.

[0075] Figure 3 2 is a flow chart showing the operation of the vehicle according to the first embodiment of the present invention. Figures 1 to 3 , generating a minimum risk operation request (S110). According to an embodiment, the processor (130) may sense the state of the vehicle (100) and the surroundings of the vehicle (100), and generate a minimum risk operation request according to the sensing result. Alternatively, the vehicle (100) may recognize a request communicated from the outside. The above-mentioned minimum risk operation request may refer to any command requiring the vehicle (100) to perform a minimum risk operation.

[0076] In the case of a minimum risk operation request, the vehicle (100) may determine a fault state (S120). According to an embodiment, the vehicle (100) may monitor the states of the components of the vehicle (100) and identify the components that have failed. The vehicle (100) may monitor the states of the components of the vehicle (100) in real time. The vehicle (100) may determine which sensor is currently available (or capable of operation) among the sensors (110).

[0077] In addition, the vehicle (100) may determine the fault state and the cause (or condition) of the fault state. For example, the vehicle (100) may further determine the cause of the determined fault state.

[0078] The vehicle (100) may select the type of operation with the least risk (S130). According to an embodiment, the vehicle (100) may select the type of operation with the least risk that matches the current fault state according to the result of the fault state determination.

[0079] The types of the above-mentioned minimum risk operations may include stopping the vehicle, controlling the vehicle's steering, maintaining the lane, providing visual, auditory and tactile prompts, slowing down the vehicle, accelerating the vehicle, starting / ending automatic driving, starting and shutting down the vehicle, transmitting emergency signals, controlling hazard warning lights, deceleration warnings, controlling brakes, etc., transferring control authority to other passengers, and at least one of remote control.

[0080] The vehicle (100) may start the minimum risk operation using the selected minimum risk operation category (S140). According to an embodiment, the vehicle (100) may control the vehicle (100) according to the selected minimum risk operation category. For example, the processor (130) of the vehicle (100) may transmit a control command corresponding to the selected minimum risk operation category to the controller (120), and the controller (120) may control the vehicle (100) according to the control command.

[0081] Figure 4 An example of minimal risk operation showing the first embodiment of the present invention. Figures 1 to 4 , showing a minimum risk operation without lane change and a minimum risk operation with lane change. That is, with the start of the minimum risk operation, the vehicle (100) may perform the minimum risk operation on the vehicle (100) without lane change, or may perform lane change and perform the minimum risk operation on the vehicle (100). The minimum risk operation without lane change may include a straight stop, a current lane stop, and an out-of-lane stop may include an adjacent lane stop and a shoulder stop. A stop with a lane change (Lane Change plus Stop) may refer to an out-of-lane stop.

[0082] The vehicle (100) can perform at least one of a straight-ahead stop, a current lane stop, and an out-of-lane stop according to a current fault state and the type of usable sensors (sensor validity).

[0083] Straight stop means that the vehicle (100) is stopped by executing longitudinal (i.e., driving direction) control without lateral control. According to an embodiment, the vehicle (100) may stop straight by decelerating without steering control of the vehicle (100). For example, the vehicle (100) may stop straight by decelerating (e.g., brake operation) without steering control of the vehicle (100).

[0084] In the case where only the braking control of the vehicle (100) can be performed and other control functions fail, a straight-ahead stop can be performed by controlling the brakes of the vehicle (100) or removing the driving force of the vehicle (100).

[0085] Stopping the current lane means that the vehicle (100) stops in the driving lane (i.e., the current lane) before the minimum risk operation starts. According to an embodiment, the vehicle (100) can stop within the boundary range of the current lane in which it is traveling along with the current lane. For example, the vehicle (100) can use the sensor (110) to identify the current lane, and use the steering function to control the steering of the vehicle (100) according to the current lane, thereby being able to stop within the boundary of the above-mentioned current lane.

[0086] According to an embodiment, the vehicle (100) may perform a current lane stop through lateral and longitudinal control, or lateral control.

[0087] For example, in a case where only steering and braking control of the vehicle (100) is possible but front and rear sensing of the current lane is not possible, the vehicle (100) can perform a slow stop while maintaining the current lane through lateral and longitudinal control, thereby performing a stop in the current lane.

[0088] For example, when the vehicle (100) can be controlled to turn and the front and rear sensing of the current lane can be performed, the vehicle (100) can maintain the current lane through lateral control while performing emergency braking to stop the current lane. In this case, the braking control may not work properly.

[0089] Stopping outside the lane means that the vehicle (100) stops outside the driving lane (i.e., the current lane) before the minimum risk operation begins. According to an embodiment, the vehicle (100) can use the steering control function to leave the current lane and stop. For example, the vehicle (100) can stop within the boundary range of other lanes adjacent to the current lane, or stop within the shoulder range.

[0090] The vehicle (100) can use the sensor (110) to identify other lanes adjacent to the current lane and stop within the boundary of the other lanes. At this time, the vehicle (100) can use the sensor (110) to perform a lane change from the current driving lane to the other lane.

[0091] The vehicle (100) can use the sensor (110) to identify the shoulder of the road and stop within the boundary of the current shoulder. At this time, the vehicle (100) can apply the conditions for identifying the shoulder of the road (such as a solid lane) to determine whether the adjacent lane is the shoulder of the road.

[0092] According to an embodiment, the vehicle (100) can perform an out-of-lane stop through lateral and longitudinal control.

[0093] For example, when the vehicle (100) is capable of steering and braking control and sensing of the front and rear of the current and adjacent lanes, the vehicle (100) can change the current lane through lateral and longitudinal control and perform a slow stop or an emergency brake, thereby performing an out-of-lane stop. In addition, when the vehicle (100) is capable of steering and braking control and sensing of the front and rear of the current and adjacent lanes, the vehicle (100) can change the current lane through lateral and longitudinal control and perform a slow stop or an emergency brake, thereby performing a shoulder stop.

[0094] Figure 5 This is an example of a minimum risk operation of the first embodiment of the present invention. The vehicle (100) can be operated according to Figure 5 The example shown performs minimal risk operations. Figure 5 In the event of a driver (or human) related failure, departure from an operating design range (ODD), or a failure caused by an unavoidable external condition, the vehicle (100) can perform a minimum risk operation.

[0095] The vehicle (100) is capable of generating (or providing) a notification when the driver does not perform control of the vehicle (100). According to an embodiment, the vehicle (100) may perform autonomous driver monitoring to sense the driver's state, and based on the sensing result, when the transfer of control authority to the driver is not ready, the notification providing function is used to provide the driver with a notification about the preparation for the transfer of control authority. For example, the vehicle (100) may provide the driver with a notification about the preparation for the transfer of control authority through a visual, auditory, or tactile notification.

[0096] In the case where the driver does not respond, the vehicle (100) can perform automatic driving. According to an embodiment, the vehicle (100) can perform dynamic driver monitoring to sense the driver's state, and according to the sensing result, in the case where the driver does not respond to the control authority transfer preparation (i.e., the control authority transfer cannot be performed), the automatic driving is performed without transferring the control authority to the driver.

[0097] When the vehicle (100) leaves the operational design range (ODD), the vehicle (100) can reduce the speed of the vehicle (100) or stop the vehicle (100). According to an embodiment, when the vehicle (100) leaves the operational design range (ODD), the vehicle (100) can reduce the speed of the vehicle (100) or stop the vehicle (100) by using at least one of steering control, acceleration control, and braking control.

[0098] The vehicle (100) can determine whether the vehicle (100) is out of the operating design range (ODD) by sensing the road shape (out of a curve, intersection or roundabout), road surface conditions (pot holes, bumps, icy roads, water), weather (rain, fog, snow), and other conditions (speed limit, traffic jam, etc.), and reduce the speed of the vehicle (100) or stop the vehicle (100) based on the judgment result.

[0099] In the event of a malfunction caused by an unavoidable external condition, the vehicle (100) can reduce the speed of the vehicle (100), perform a lane stop, or perform an (emergency) shoulder stop (ESS). According to an embodiment, in the event of a malfunction caused by an unavoidable external condition, the vehicle (100) can reduce the speed of the vehicle (100), perform a lane stop, or perform an (emergency) shoulder stop using at least one of steering control, acceleration control, and braking control.

[0100] The vehicle (100) can determine whether a collision has occurred with another vehicle or a component of the vehicle has failed (such as a tire blowout), and based on the determination result, reduce the speed of the vehicle (100), stop within the lane, or perform an (emergency) roadside stop.

[0101] Figure 6 This is an example of a minimum risk operation of the first embodiment of the present invention. The vehicle (100) can be operated according to Figure 6 The example shown performs minimal risk operations. Figure 6 , the vehicle (100) can perform minimal risk operations in the event of a control system failure.

[0102] The vehicle (100) can perform minimal risk operations in the event of a failure in the actuator (drive) function.

[0103] For example, when a steering function fails, the vehicle (100) may perform an in-lane stop or reduce the speed of the vehicle (100) using at least one of acceleration control and braking control.

[0104] For example, when an acceleration mechanism fails, the vehicle (100) can use at least one of steering control and braking control to perform in-lane stopping, deceleration, or shoulder stopping.

[0105] For example, when a deceleration mechanism fails, the vehicle (100) can perform a road shoulder stop using at least one of a steering control and an acceleration control.

[0106] For example, when other driving mechanisms fail, the vehicle (100) can use at least one of steering control, acceleration control, and brake control to perform in-lane stopping, deceleration, or shoulder stopping.

[0107] The vehicle (100) can perform minimal risk operations in the event of a failure of the autonomous driving function.

[0108] For example, when the lane sensing function fails, the vehicle (100) can utilize the front vehicle tracking function to perform in-lane stopping or deceleration.

[0109] For example, when the front object sensing function fails, the vehicle (100) can perform in-lane stopping using at least one of steering control and braking control.

[0110] For example, when the rear and side object sensing functions fail, the vehicle (100) may perform in-lane stopping or deceleration using at least one of steering control and braking control.

[0111] For example, when the autonomous driving ECU fails, the vehicle (100) can utilize a replacement autonomous driving ECU to perform in-lane stopping or deceleration.

[0112] For example, when the in-vehicle network fails, the vehicle (100) can use network redundancy to stop or decelerate in the lane. That is, even if the in-vehicle network fails, the pre-secured redundancy can be used to transmit commands on the network to stop or decelerate in the lane.

[0113] For example, when a connection for connected ADS fails, the vehicle (100) may perform in-lane stopping, deceleration, or shoulder stopping using at least one of steering control and braking control.

[0114] Figure 7 This is an example of a minimum risk operation of the first embodiment of the present invention. The vehicle (100) can be operated according to Figure 7 The example shown performs minimal risk operations. Figure 7 , the vehicle (100) can perform minimal risk operations in the event that the driver (or person) makes an erroneous action or the control system fails.

[0115] The vehicle (100) may provide a notification to the driver in the event of a driver (or person) related fault. According to an embodiment, the vehicle (100) may perform autonomous driver monitoring to sense the driver's state and provide a visual, audible, or tactile notification to the driver in the event of a driver (or person) related fault. For example, the vehicle (100) may provide a deceleration warning to the driver.

[0116] The vehicle (100) can provide notification to the outside or perform longitudinal control of the vehicle (100) in the event of a failure in the control system.

[0117] For example, in the event of a control system failure, the vehicle (100) can utilize lighting control to turn on or off hazard warning lights, or utilize communication control functions (or network redundancy) to transmit emergency messages to a control center.

[0118] For example, in the event of a control system failure, the vehicle (100) can utilize a braking control function to reduce the speed of the vehicle (100), utilize a power control function to shut down power to the engine (or drive mechanism), or utilize steering and braking control to perform an in-lane stop.

[0119] Figure 8 This is an example of a minimum risk operation of the first embodiment of the present invention. The vehicle (100) can be operated according to Figure 8 The example shown performs minimal risk operations. Figure 8 , the vehicle (100) can perform minimal risk operations in the event of a control system failure.

[0120] The vehicle (100) can perform longitudinal control of the vehicle (100) or transfer (or hand over) control authority in the event of a control system failure.

[0121] For example, in the event of a control system failure, the vehicle (100) can utilize at least one of the steering function, the acceleration function, and the braking function to maintain the driving lane of the vehicle (100), perform a shoulder stop, or maintain a minimum steering angle.

[0122] For example, in the event of a control system failure, the vehicle (100) can use the power control function and the authority redundancy function to control the on / off of the automatic driving function. The vehicle (100) can turn off the automatic driving function by turning off the start of the vehicle (100), or by transferring the authority of the automatic driving of the vehicle (100) to another subject (such as a driver). The vehicle (100) can turn on the automatic driving function in the opposite way.

[0123] For example, in the event of a control system failure, the vehicle (100) can utilize the authority redundancy function to perform authority transfer to other passengers. The vehicle (100) can be converted to a manual driving mode by transferring control authority to other passengers.

[0124] For example, in the event of a control system failure, the vehicle (100) can perform remote control using at least one of a communication control function and an authority redundancy function. The vehicle (100) can transfer the control authority of the vehicle (100) to an external device, thereby controlling the vehicle (100) to be remotely controlled.

[0125] Fig. 9 is a block diagram for illustrating steps for performing a minimum risk operation according to a second embodiment of the present invention.

[0126] During the period of autonomous driving performed according to ADS, an event may occur in which autonomous driving cannot be continued. For example, an event may occur that is equivalent to a failure of the autonomous driving system of level 3 to level 5 autonomous driving. Alternatively, an event may occur in which an autonomous driving vehicle of level 3 or 4 autonomous driving is in danger of violating the ODD (operational design domain) restrictions. ODD is an operational design domain and may refer to the boundaries of a road, etc. Alternatively, an event may occur in which the driver cannot obtain driving authority even though the ADS requests the driver's intervention in the autonomous driving level 3 to level 5 system.

[0127] In this situation, the ADS should ensure the safety of the vehicle passengers by performing the minimum risk maneuver. To this end, the system needs to select the most appropriate MRM type. In this selection, the vehicle's status, surrounding traffic conditions, etc. can be considered. When performing the minimum risk maneuver, the vehicle can perform a longitudinal stop, and if lateral control is possible, lateral control can be performed at the same time.

[0128] The present invention provides the following five MRM types. However, the scope of the present invention is not limited thereto and may include other MRM types of the same or similar morphology.

[0129] As the first type of straight stop of the MRM, it performs only longitudinal stop without accompanying longitudinal control.

[0130] An in lane stop as a second type of MRM is a type in which the vehicle stops within a boundary of a lane in which the vehicle is currently traveling.

[0131] Lane change plus stop intraffic lane, which is a third type of MRM, is a type of stopping accompanied by lane change within a boundary of a road having a plurality of lanes.

[0132] The fourth type of MRM is a shoulder stop, which is a type of stop on a shoulder accompanying a lane change and leaving a road boundary.

[0133] The fifth type of MRM is a parking lane stop, which is a type of stopping within a parking lane along with a lane change and leaving a road boundary.

[0134] The vehicle involved in the present invention may include a subject vehicle and a target vehicle. The subject vehicle is a vehicle to be subjected to the minimum risk operation, and the target vehicle is a vehicle around the subject vehicle that may collide with the subject vehicle.

[0135] In addition, the potential stopping area involved in the present invention is an area close to the current position of the host vehicle, and refers to an area where the host vehicle can stop. For example, the potential stopping area can be determined using position information such as an HD map, sensing information input by a sensor, information input by a communication device, etc.

[0136] In addition, the lane boundary involved in the present invention can be determined based on visually identifiable marks. In the absence of visually identifiable marks, temporarily identifiable road features can be determined as lane boundaries. Alternatively, the lane boundary can also be determined using information received from GPS or using V2V, V2I information received from a communication device.

[0137] refer to Fig. 9 , the figure shows the normal working steps of ADS (S910). This step (S910) is the step of the automatic driving system (ADS) performing the function normally as expected. ADS can determine whether the minimum risk operation is required.

[0138] In the case that event A1 occurs in the ADS normal operation step (S910), a transition to the MRM execution step (S920) may occur. Event A1 may be that a minimum risk operation is requested through the ADS.

[0139] When event A2 occurs in the ADS normal operation step (S910), a transition to the driver intervention request step (S950) may occur. Event A2 may be a driver intervention request (RTI: Request To Intervene) made by ADS, or a situation of autonomous driving level 3. Alternatively, event A2 may be a warning generated by ADS to the driver, or a situation of autonomous driving level 4 or 5. This event A2 is optional.

[0140] In the driver intervention request step (S950), the ADS may make a request to the driver to receive driving authority. Since there may be situations where humans cannot drive, this step is only performed under specific ADS (such as ADS with level 3 autonomous driving). Specifically, in the event that event B1 occurs in the driver intervention request step (S950), a transition to the MRM execution step (S920) may occur. Event B1 may be that a predetermined time has passed after a driver intervention request (RTI) occurs. Or in the event that event B2 occurs, a transition to the ADS waiting or ADS closing step (S940) may occur. Event B2 may be a situation where driver intervention begins (such as level 3 autonomous driving), or a situation where a warning is issued (such as level 4 or 5 autonomous driving).

[0141] In the MRM execution step (S920), the ADS can control the main vehicle. Specifically, the ADS can monitor the status of the ADS, determine the MRM type, and execute the main vehicle control in the MRM execution step (S920), and can warn the main vehicle's surrounding factors (such as surrounding vehicles) of risks. In the event that event C1 occurs in the MRM execution step (S920), a transition to the MRC (Minimal Risk Condition) step (S930) may occur. Event C1 may be a situation where the speed of the main vehicle is 0, that is, the main vehicle stops. In the event that event C2 occurs in the MRM execution step (S920), a transition to the ADS standby or ADS shutdown step (S940) may occur. Event C2 may be a situation where driver intervention occurs during the execution of MRM.

[0142] In the MRC step (S930), the host vehicle may be in a stopped state. In this step, the host vehicle may perform stopped state management, which may refer to vehicle control to maintain the vehicle in a stopped state regardless of the inclination of the road surface at the stop. In the event that event D1 occurs in the MRC step (S930), a transition to the ADS standby or ADS off step (S940) may occur. Event D1 may be a situation where the driver receives control authority of the vehicle and controls the vehicle when the driver turns off ADS.

[0143] In the ADS standby or ADS off step (S940), the ADS may be terminated. In this step, the vehicle may no longer perform autonomous driving.

[0144] The above-mentioned steps S910, S920, S930, and S950 are in the state of ADS activation, and step S940 may be in the state of ADS deactivation.

[0145] Fig.10 It is a diagram for explaining the MRM step of the second embodiment of the present invention.

[0146] When an MRM request is generated (S1010), the system status is monitored (S1020). Specifically, the degree of failure of vehicle components is analyzed, the system impact is confirmed, the status of system components is determined, and thus the current performance of autonomous driving is determined.

[0147] Then determine the MRM type (S1030). Specifically, the most suitable MRM type at the time point of implementing MRM can be determined. This determination is based on internal information (such as the status of the system or vehicle) and external information (such as the degree of congestion of surrounding traffic, ODD). The MRM type determined in this way can also be converted to other MRM types when a specific event occurs.

[0148] Then, MRM is implemented (S1040). Specifically, the longitudinal control and / or lateral control of the vehicle may be input, and the vehicle control is performed accordingly.

[0149] According to the MRM implementation step (S1040), the MRC state (S1050) can be achieved, or the ADS state monitoring step (S1020) can be returned to repeat the steps S1020, S1030, and S1040. The repetition time can be a time predetermined by the system. In the case of driver intervention (S1060) during the execution of MRM, the MRM can be terminated.

[0150] Fig.11 It is a diagram for explaining the MRM type of the second embodiment of the present invention.

[0151] As described above, the MRM type may include five types, namely, the first to fifth types.

[0152] MRM Type 1 is a straight stop type, which only performs longitudinal deceleration control and does not perform lateral control. MRM Type 1 is a situation where lateral control cannot be performed, such as when there is a lane detection obstacle, a control obstacle of the lateral actuator (steering wheel), etc. When executing MRM according to MRM Type 1, the vehicle may deviate from the lane boundary or deviate to the outside of the road. Therefore, in MRM Type 1, control of accelerating the vehicle may not be allowed.

[0153] The second type of MRM is the lane stop type, where both longitudinal deceleration control and lateral control can be performed. In this type, environmental information such as sensors, map data, and communication information can be used to determine the target vehicle and path ahead. In the case where lane change control can be performed but driving beyond a predetermined distance is not possible, the second type of MRM can be determined.

[0154] The third type of MRM is the lane change and road non-deviating stop type, which can perform longitudinal deceleration control and longitudinal acceleration control, and can also perform lateral control. In this type, environmental information such as sensors, map data, and communication information can be used to judge the target vehicle and path in front. The third type of MRM can be determined when it is impossible to move to a potential stopping area outside the traffic flow. For example, it is determined when the ADS system is working normally but the potential stopping area cannot be detected, or when it is impossible to drive to the potential stopping area through the ADS system due to time and / or system limitations. For stable lane changes, acceleration control can also be performed. Whether to change lanes or the number of lanes that need to be changed can be determined according to the situation.

[0155] The fourth type of MRM is the shoulder stop type, which can perform longitudinal acceleration control and longitudinal deceleration control, and can also perform lateral control. In this type, environmental information such as sensors, map data, and communication information can be used to determine the target vehicle and path ahead. The fourth type of MRM can be determined when it is possible to drive to the shoulder of the highway and there are no obstacles on the shoulder. Acceleration control can also be performed when it is determined necessary based on the traffic flow to the shoulder.

[0156] The fifth type of MRM is the stop line stop type, which can perform longitudinal acceleration control and longitudinal deceleration control, and can also perform lateral control. In this type, environmental information such as sensors, map data, and communication information can be used to determine the target vehicle and path ahead. The fifth type of MRM can be determined when it is possible to drive to the parking space and when there are no obstacles in the parking space. Acceleration control can also be performed when it is determined necessary based on the traffic flow to the parking space.

[0157] The MRM types described above can be executed within a predetermined execution time. Such execution time may include a minimum execution time and / or a maximum execution time. If the MRM is not executed within the preset execution time, the MRM type can be converted to a subordinate type that can be executed immediately.

[0158] In order to determine the type of MRM as described above, the state of the vehicle can be monitored. For example, the system performance and limitations can be monitored in real time. Based on such monitoring, the ADS can determine the most appropriate MRM type under the current situation. Specifically, as the internal state of the vehicle, the ADS can monitor whether there are mechanical defects or electronic defects. The ADS can monitor the failure of vehicle components such as sensors and actuators in real time and continuously. In addition, this state can be monitored in the case of switching from the ADS off state to the ADS on state, or in the opposite case. In addition, in order to determine the type of MRM, the environmental state outside the vehicle can also be monitored in real time and continuously. For example, the environmental state outside the vehicle can include whether the external condition is a highway or an urban area, whether it is in a state where the lane state can be detected, whether the tire pressure is appropriate, etc.

[0159] The MRM type determined as described above can be converted to an upper level (higher level) or a lower level (lower level). This will be described in detail.

[0160] The MRM type can be converted to a higher-level type. For example, when a low-level MRM type is determined due to a temporary defect or the like, and the defect is repaired during the execution of the MRM, it can be changed to a higher-level MRM type. The upward conversion of the MRM type can be determined based on the status information of the vehicle components. In addition, the upward conversion of the MRM type can be determined by considering the current vehicle speed and / or external environmental information. For example, when the MRM is executed at a level above a predetermined level in a low-level MRM type, although the MRM type can be converted to a higher-level type, the current low MRM type can still be maintained. Alternatively, although it is executed at a predetermined level, it can also be converted to a high-level MRM type based on environmental information that there are no vehicles around. The MRM type that is changed upward is preferably converted to the highest level type based on the status information of the vehicle components, the vehicle speed, the environmental information, etc. as described above.

[0161] The MRM type can be converted to a lower type. For example, in the case of defects such as vehicle components occurring during the execution of MRM, in the case of worsening defects, in the case of lane changes that cannot be made due to changes in traffic conditions, etc., it is possible to downgrade from a high-level MRM type to a low-level MRM type. The downgrade conversion of the MRM type can be determined based on the status information of the vehicle components. In addition, the downgrade conversion of the MRM type can be determined by considering the current vehicle speed and / or external environmental information. For example, when the MRM is executed at a level above a predetermined level in a high-level MRM type, although the MRM type should be converted to a lower type, the current high MRM type can still be maintained. Alternatively, although it is executed at a predetermined level, it can also be downgraded to a low-level MRM type based on environmental information of vehicles around. The downgraded MRM type is preferably converted to the highest level type based on the status information of the vehicle components, the vehicle speed, the environmental information, etc. as described above.

[0162] Specifically, for example, the upward change from the MRM type 1 to the MRM type 2 is as follows: When the lane ahead or the vehicle ahead is not recognized but the recognition obstacle is resolved, the upward change can be performed.

[0163] The upward change from MRM type 1 or 2 to MRM type 4 or 5 is as follows. The upward change can be performed when the internal conditions that enable the execution of the upper type are met (such as the reactivation of the controller or the speed of the main vehicle meets the predetermined speed (such as 60 km / h)), when the external conditions that enable the execution of the upper type are met (such as the removal of a congested road section), when the lower type vehicle has stopped but its stop position is judged to be a place with high accident risk (such as the first lane of a highway, on a railway, at an interchange, etc.), and when the internal conditions that enable the vehicle to be accelerated are met.

[0164] The down-regulation change from MRM types 3, 4, and 5 to MRM types 1 and 2 is as follows. Down-regulation change can be performed when the internal conditions do not meet the execution of the upper type (for example, failure of the control device during MRM execution, time-out, and the speed of the host vehicle is below the predetermined speed) or when the external conditions for executing the upper type are not met (in the case of a congested road section).

[0165] On the other hand, the host vehicle speed that becomes the MRM working condition may differ depending on the MRM type. For example, in the case of the first type of MRM or the second type of MRM, it can be determined regardless of the host vehicle speed (regardless of whether the vehicle speed is low or high). This is because, in the case of the first type and the second type, since a low-level MRM is performed, it is preferred that the MRM function be able to operate in all speed ranges. Only when the host vehicle speed is above a predetermined speed can the third to fifth types of MRM be determined. The predetermined speed required here may be the minimum speed required for automatic lane change. That is, even if the result of evaluating the internal conditions and the external conditions enables a high-level type (third to fifth) of MRM, it is preferred that the vehicle be able to move quickly and stop, and therefore, below the predetermined speed, the high-level type cannot be determined.

[0166] As described above, the determining factors for determining the predetermined speed of the high-level type (third to fifth types) MRM may include the maximum sensing distance of the front and rear sensors of the vehicle, the maximum speed limit, and the measurement error. Specifically, the predetermined speed may be determined so that the identification distance value calculated in consideration of the maximum speed limit and the relative speed measurement error is less than the maximum sensing distance of the side rear radar.

[0167] For example, the identification longitudinal distance of the vehicle that becomes the identification target of the lane deviation driving and lane change assist function is 80m to 200m based on the front bumper of the host vehicle. Therefore, the identification distance value (S_critical) can be determined as 70m obtained by 80m-10m. This determination takes into account the full length of the host vehicle and the full length of the target vehicle. When the predetermined speed for determining MRM is set to 60km / h, considering the maximum speed limit of 110kmh / h in Korean law and the measurement error of 5km / h, the identification distance value of 61.68m can be derived. This identification distance value (61.68m) is less than the maximum sensing distance of 70m of the side rear radar, so the predetermined speed for determining MRM is suitable to be 60km / h.

[0168] Furthermore, during the execution of the MRM, the deceleration of the host vehicle is preferably a value smaller than a predetermined value. This is to avoid obstructing the traffic flow and to minimize the possibility of collision with other vehicles. This predetermined deceleration may vary depending on the MRM type, or may be a fixed value (e.g., 4 m / s ) regardless of the MRM type. 2 )

[0169] Furthermore, the minimal risk maneuver can be overridden by driver intervention (RTI) or driver override.

[0170] After the minimum risk operation is started, it cannot be canceled unless certain conditions are met. For example, after the minimum risk operation is started, it cannot be canceled unless the minimum risk operation is completed and the MRC state is reached, or unless the operation is performed by an authorized driver. In an embodiment, the authorized driver may include a user registered in the vehicle and an adult driver and / or a driver whose state is judged to be a normal state in the case of a driver monitoring camera.

[0171] In addition, when there are passengers when performing the minimum risk operation, an alarm can be performed inside / outside. For example, information related to the minimum risk operation can be displayed inside / outside. If there are no passengers, an alarm can be performed only outside. For example, the hazard warning lights can be flashed.

[0172] The automatic driving system can determine the time when the braking control starts. For example, it can be determined that the braking control starts after a specified time has passed after a specific action is performed. Preferably, the braking control can be started 2.5 seconds after an alarm is displayed to the outside, such as the flashing of the hazard warning lights. This is to prevent collisions from vehicles behind.

[0173] Furthermore, when performing the minimum risk maneuver, at least one of the host vehicle's required speed, maximum deceleration, minimum sensing range, brake control, acceleration control, lateral control, MRC position, and maximum / minimum execution time may be different depending on the MRM type.

[0174] For example, as the first type of MRM, a straight stop will be described.

[0175] In the case of the first type of MRM, the required speed of the host vehicle is not limited. That is, the first type of MRM can be determined regardless of the speed of the host vehicle.

[0176] In the case of the first type of MRM, the maximum deceleration is preferably 4 m / s 2 the following.

[0177] In the case of the first type of MRM, reference Fig.12 The minimum sensing range is explained. In the case of the first type of MRM, it is necessary to detect obstacles at least in front of the host vehicle. The minimum longitudinal sensing distance d long,min It may be determined based on the maximum deceleration and the speed of the host vehicle as follows.

[0178] [Mathematical formula 1]

[0179]

[0180] In addition, the minimum lateral sensing distance d lat,min It can be determined to be the same as the host vehicle width.

[0181] The higher the MRM type, the wider the minimum sensing range based on the MRM type is set. This is because the higher the MRM type, the more types and numbers of sensors that can be used. From a safety perspective, the higher the MRM type, the wider the minimum sensing area is set.

[0182] Alternatively, the lower the MRM type, the wider the minimum sensing range based on the MRM type. This is because the lower the level of MRM, the greater the risk of collision with surrounding vehicles, so the lower the level, the wider the minimum sensing area needs to be.

[0183] In the case of the first type of MRM, the brake control: when the senseable distance is less than the minimum sensing distance, or when it cannot be sensed, the brake control using the maximum deceleration can be performed. However, in the case of being able to sense an obstacle within the minimum sensing distance, the brake can be controlled at a deceleration lower than the maximum deceleration. That is, in the case of the first type of MRM, since the vehicle may cross the lane, it is preferred to allow maximum deceleration. For example, in a situation where surrounding sensing is not possible, when sudden braking is not expected to cause a collision with the rear, when the road is a curved road, when an obstacle is sensed within a specific distance ahead, etc., in the case of the first type of MRM, the maximum deceleration can be performed. However, as described later, in the case of the second type of MRM, it is preferred to decelerate at a deceleration lower than the maximum deceleration.

[0184] In the case of the first type of MRM, no lateral control is performed. In addition, no lateral control is performed and the MRC position can deviate from the lane boundary.

[0185] In the case of the first type of MRM, the minimum / maximum execution time is as follows. The minimum execution time may be a time longer than the time required for the host vehicle to go from the MRM start time point to the end time point using a fixed maximum deceleration under flat conditions. The maximum execution time may be a time shorter than the time required for the host vehicle to go from the MRM start time point to the end time point using a neutral gear under flat conditions. For example, it may be the time required to stop from the MRM start time point using a neutral gear under flat conditions, or a time shorter than this.

[0186] As another example, as the second type of MRM, a description is given of a lane stop. In the case of the second type of MRM, there is no restriction on the required speed of the host vehicle. That is, the second type of MRM can be determined regardless of the speed of the host vehicle.

[0187] In the case of the first type of MRM, the maximum deceleration is preferably 4 m / s 2 the following.

[0188] In the case of the first type of MRM, reference Fig.13 The minimum sensing range is explained. In the case of the second type of MRM, at least obstacles located in front of the host vehicle and in the same lane need to be detected. The minimum longitudinal sensing distance d long,min It may be determined based on the maximum deceleration and the speed of the host vehicle as follows.

[0189] [Mathematical formula 2]

[0190]

[0191] In addition, when the vehicle stops within a lane, considering that the lane is curved, the sensing range should cover a curvature of 500 m.

[0192] [Mathematical formula 3]

[0193] R road,min [m]=500

[0194] In addition, the minimum lateral sensing distance d lat,min Determined to be the same as the width of the lane after taking the curvature into account.

[0195] The higher the MRM type, the wider the minimum sensing range based on the MRM type is set. This is because the higher the MRM type, the more types and numbers of sensors that can be used. From a safety perspective, the higher the MRM type, the wider the minimum sensing area is set.

[0196] Alternatively, the lower the MRM type, the wider the minimum sensing range based on the MRM type. This is because the lower the level of MRM, the greater the risk of collision with surrounding vehicles. The lower the level, the wider the minimum sensing area needs to be.

[0197] Brake control in case of MRM type 2: When the sensible distance is less than the minimum sensing distance, or when it cannot be sensed, brake control using the maximum deceleration can be performed. However, when an obstacle located within the minimum sensing distance can be sensed, the brake can be controlled at a deceleration lower than the maximum deceleration.

[0198] In case of the MRM type 2, lateral control may be performed within a range capable of maintaining the host vehicle within the same lane.

[0199] In the case of the first type of MRM, the minimum / maximum execution time is as follows. The minimum execution time may be a time longer than the time required for the host vehicle to use a fixed maximum deceleration from the MRM start time point to the end time point under flat conditions. It may be a time shorter than the time required for the host vehicle to use a neutral gear from the MRM start time point to the end time point under flat conditions.

[0200] Fig.14 FIG. 1 is a flow chart showing a method for selecting the minimum risk operation type according to a third embodiment of the present invention. Fig.14 , the vehicle (100) may determine the fault state (S210). According to an embodiment, the vehicle (100) may determine the fault state using the controller (120) or using the response from the components of the vehicle (100). The fault state includes whether the automatic driving system can control the vehicle. For example, the so-called brake, steering, sensor, etc. are in a fault state, which may refer to a state in which the automatic driving system (ADS) cannot control them.

[0201] The vehicle (100) can determine whether the deceleration and acceleration functions of the vehicle (100) can be performed (S220). According to an embodiment, the vehicle (100) can determine whether a driving unit such as an engine of the vehicle (100), an accelerator pedal, a brake, and components related thereto are operating normally.

[0202] When the deceleration and acceleration functions of the vehicle (100) can be performed (Y of S220), the vehicle (100) can determine whether the steering function of the vehicle (100) can be performed (S230). According to the embodiment, the vehicle (100) can determine whether the steering wheel of the vehicle (100) and its related components are working normally.

[0203] When the steering function of the vehicle (100) is unavailable (N of S230), the vehicle (100) can perform a straight stop as a minimum risk operation. That is, if only the deceleration and acceleration functions of the vehicle (100) are available, the vehicle (100) performs a straight stop as a minimum risk operation.

[0204] When the steering function of the vehicle (100) is available (Y of S230), the vehicle (100) can determine whether road condition sensing can be performed (S250). According to an embodiment, the vehicle (100) can determine whether the sensors (110) and their related components are operating normally.

[0205] When the road condition sensing function of the vehicle (100) is not available (N of S250), the vehicle (100) can perform a straight stop or a current lane stop as a minimum risk operation (S260). That is, when the deceleration and acceleration functions and the steering function of the vehicle (100) are available and the road condition sensing is not available, the vehicle (100) can perform a straight stop or a current lane stop as a minimum risk operation.

[0206] According to an embodiment, the vehicle (100) can travel along a lane using a steering function, and stop the vehicle in the lane using a deceleration and acceleration function.

[0207] When the road condition sensing function of the vehicle (100) is available (Y of S250), the vehicle (100) may perform a straight stop, a current lane stop, or a lane-outside stop as a minimum risk operation (S270). That is, when the deceleration and acceleration function, the steering function, and the road condition sensing function of the vehicle (100) are all available, the vehicle (100) may perform a straight stop, a current lane stop, or a lane-outside stop as a minimum risk operation. The lane-outside stop may include an adjacent lane stop and a road shoulder stop.

[0208] According to the embodiment, the vehicle (100) can use the road condition sensing function to sense the front, back, left, and right states of the vehicle (100), and according to the sensing result, use the steering function to change the lane, and use the deceleration and acceleration functions to stop the vehicle outside the lane. For example, the vehicle (100) can set a region of interest (region of interset) around the vehicle (100) to sense the front, back, left, and right states of the vehicle (100). The shape of the above-mentioned region of interest can be various shapes such as a circle, an ellipse, a quadrilateral, a triangle, etc.

[0209] Fig.15 FIG. 4 is a flowchart showing a safe zone stop action according to a minimum risk operation according to a fourth embodiment of the present invention. Fig.15 , the vehicle (100) can park the vehicle (100) in a safe zone when performing the minimum risk operation. In this specification, a safe zone refers to an area on the road where the vehicle (100) can park safely, such as a rest stop, a shoulder, an unused variable lane, etc.

[0210] The vehicle (100) may start the minimum risk operation (S210). According to an embodiment, the vehicle (100) may start the minimum risk operation in response to a request for the minimum risk operation.

[0211] The vehicle (100) may use the navigation information to determine whether there is a safe zone (S220). According to an embodiment, the vehicle (100) may use the current position of the vehicle (100) and the navigation information to determine whether there is a safe zone on the road around the vehicle (100). The above navigation information may be stored in a memory of the vehicle (100) or received via a network.

[0212] For example, the vehicle (100) can determine whether there is a safe zone located nearby with the current position of the vehicle (100) as the center based on the navigation information.

[0213] The vehicle (100) may use the sensor (110) to determine whether there is a safety zone (S230). According to an embodiment, the vehicle (100) may use at least one of a camera, a laser radar sensor, and a radar sensor to obtain a video or image around the vehicle (100), and by analyzing the video, determine whether there is a safety zone around the vehicle (100). For example, the vehicle (100) may identify a sign around the vehicle (100) and determine whether the identified sign indicates the existence of a safety zone.

[0214] The vehicle (100) may use infrastructure communication to determine whether a safety zone exists (S250). According to an embodiment, the vehicle (100) may obtain information about a safety zone around the vehicle (100) from the infrastructure, and determine whether a safety zone exists around the vehicle (100) based on the information. For example, the vehicle (100) may provide the current location of the vehicle (100) to the infrastructure, and obtain information about a safety zone around the vehicle (100) from the infrastructure.

[0215] The vehicle (100) may stop in a safety zone (S250) based on the judgment (S220 to S240). According to an embodiment, the vehicle (100) may stop the vehicle in the common safety zone indicated by the judgment (S220 to S240) when there is a common safety zone. For example, the vehicle (100) may determine that a safety zone exists when a first safety zone judged based on navigation information, a second safety zone judged using a sensor, and a third safety zone judged based on information from infrastructure are at the same or adjacent locations, and the vehicle (100) may be driven toward the common safety zone and stop.

[0216] In the case where there is no common safety zone indicated by each determination (S220 to S240), the vehicle (100) may determine that there is no safety zone and continue driving without stopping.

[0217] In addition, according to an embodiment, the vehicle (100) may stop the vehicle in the common safety zone indicated by the executed judgments when a part of the judgments (S220 to S240) cannot be executed (for example, due to a fault) if there is a common safety zone indicated by the executed judgments. For example, when it is impossible to receive information from the infrastructure, the vehicle (100) may determine that there is a safety zone when the first safety zone determined based on the navigation information and the second safety zone determined using the sensor are at the same or adjacent positions, and move the vehicle (100) toward the common safety zone and stop the vehicle. That is, the vehicle (100) may determine the existence of the safety zone based on whether the safety zones determined by the executed judgments are common.

[0218] Fig.16 FIG. 5 is a flowchart showing the emergency situation determination and the emergency situation processing according to the fifth embodiment of the present invention. Fig.16 , the vehicle (100) performs automatic driving (S210).

[0219] The vehicle (100) may confirm the status of the vehicle (100) (S220). According to an embodiment, the vehicle (100) may confirm the status of each component and function of the vehicle (100).

[0220] The vehicle (100) can confirm the status of the hardware and software components of the vehicle (100). According to an embodiment, the vehicle (100) can determine whether the components and functions of the vehicle (100) are faulty and the fault location. For example, the vehicle (100) can determine whether the sensor (110) is faulty and the fault location, whether the driving functions of the vehicle such as the steering function, the deceleration function, the acceleration function, and the brake are faulty, whether automatic driving can be performed, whether the object recognition function is faulty, whether there is an external impact, whether it is damaged, etc.

[0221] The vehicle (100) may determine whether to perform a minimum risk operation (S230). According to an embodiment, the vehicle (100) may determine whether to perform a minimum risk operation based on a determined state of the vehicle (100). For example, the vehicle (100) may calculate the severity of the current state of the vehicle (100) based on at least one of the number of faulty parts (i.e., faulty components and faulty functions) of the vehicle (100), the location of the faulty parts, and the type of the faulty parts, and determine whether to perform a minimum risk operation based on the calculated severity.

[0222] When it is determined to perform the minimum risk operation (Y of S230), the vehicle (100) may perform the minimum risk operation (S240). According to an embodiment, the vehicle (100) may calculate the severity of the vehicle (100) state based on the determined vehicle (100) state, and perform the minimum risk operation when the calculated severity exceeds a pre-specified degree, and do not perform the minimum risk operation when the calculated severity does not exceed the pre-specified degree.

[0223] When it is determined that the minimum risk operation is not to be performed (N of S230), the vehicle (100) may implement a diagnostic function (S250). According to an embodiment, the diagnostic function is a function of self-checking the components and functions of the vehicle (100), and through the diagnostic function, some problems of the components and functions can be solved (or adjusted). The diagnostic function may be executed by the processor (130).

[0224] According to an embodiment of the present invention, when the vehicle (100) is not in a serious state, the diagnostic function can be implemented without executing the minimum risk operation. Thus, not only can the start condition of the minimum risk operation be accurately determined, but also the start of unnecessary minimum risk operation can be suppressed, thereby achieving the effect of increasing the stability of the vehicle (100).

[0225] The vehicle (100) may determine whether the vehicle state has been improved (S260). According to an embodiment, the vehicle (100) may determine whether the failure or problem of the components and functions of the vehicle (100) has been solved. For example, the vehicle (100) may confirm the state of the vehicle (100) again.

[0226] If the vehicle state of the vehicle (100) has improved (Y in S260), the vehicle (100) may perform automatic driving. That is, the vehicle (100) may resume automatic driving if the problem has been solved.

[0227] In the case where the state of the vehicle (100) has not been improved (N of S260), the vehicle (100) may be switched to manual driving. According to an embodiment, in the case where the vehicle (100) still has a fault despite the implementation of the diagnostic function, the vehicle (100) may be switched to manual driving. For example, in the case where the automatic driving function has a problem and has not been improved, the vehicle (100) may perform manual driving by transferring control authority to the driver instead of continuing to maintain automatic driving.

[0228] According to an embodiment, the vehicle (100) may transmit a signal notifying the vehicle (100) of a fault when the state of the vehicle (100) does not improve. For example, the vehicle (100) may transmit a signal notifying the vehicle (100) of a fault to a pre-specified control center (or server).

[0229] Fig.17 FIG. 6 is a flowchart showing a method for generating a notification according to a minimum risk operation according to a sixth embodiment of the present invention. Fig.17 , the vehicle (100) may travel (S210). According to an embodiment, the vehicle (100) may travel by automatic driving or manual driving.

[0230] The vehicle (100) may perform a minimum risk operation (S220). According to an embodiment, when a minimum risk operation request occurs during driving, the vehicle (100) may perform the minimum risk operation in response to the request.

[0231] The minimal risk operation is performed, and the vehicle (100) may generate a notification (S230). According to an embodiment, the vehicle (100) may generate a notification related to the minimal risk operation.

[0232] The vehicle (100) may provide notifications about implementing minimal risk operations to surrounding vehicles or surrounding facilities (e.g., infrastructure, police stations, fire stations, hospitals, etc.). According to an embodiment, the vehicle (100) may set an area of ​​a certain range with the vehicle (100) as the center, and provide notifications to other vehicles or facilities within the above area.

[0233] The vehicle (100) may transmit a signal including specific information, or provide the above notification using visual and auditory means. For example, the vehicle (100) may transmit a signal including information related to minimal risk operations, or provide notification by turning on / off hazard warning lights or honking a horn.

[0234] According to an embodiment, the information related to the minimum risk operation may include whether the minimum risk operation is implemented, the execution time point of the minimum risk operation, the type of vehicle (100) performing the minimum risk operation, information about the location and status, but is not limited to this, and may include various information related to the minimum risk operation.

[0235] Fig.18 FIG. 7 is a flowchart showing a method for granting control authority according to a seventh embodiment of the present invention. Fig.18 , the vehicle (100) may travel (S210). According to an embodiment, the vehicle (100) may travel by automatic driving or manual driving.

[0236] The vehicle (100) may perform a minimum risk operation (S220). According to an embodiment, when a minimum risk operation request occurs during driving, the vehicle (100) may perform the minimum risk operation in response to the request.

[0237] The vehicle (100) may determine the subject of the control authority of the minimum risk operation (S230). According to an embodiment, the vehicle (100) may determine whether the control authority of the minimum risk operation is granted to the vehicle (100) or to the driver. In the present invention, the so-called control authority refers to the authority for controlling the minimum risk operation, and the subject with the above authority can control according to the minimum risk operation.

[0238] The vehicle (100) may determine the subject of control authority based on the reason for requiring the minimum risk operation. As described above, in the event of a specific event (e.g., risk) occurring to the vehicle (100), a request for the minimum risk operation may be generated. The vehicle (100) may determine the subject of control authority based on the characteristics of the event requesting the minimum risk operation.

[0239] According to an embodiment, in the case where a minimum risk operation request is generated by a driver, the vehicle (100) may determine that the driver is the subject of the control authority for the minimum risk operation. For example, in the case where the cause of the fault is caused by the driver (e.g., insufficient execution experience, etc.), the vehicle (100) may determine that the subject of the control authority for the minimum risk operation is the driver. In the case where the cause of the minimum risk operation request is the driver, even if the driver intervenes, the automatic driving system may not transfer the control authority to the driver. Even if the driver intervenes, the automatic driving system may continue to perform the minimum risk operation.

[0240] According to an embodiment, when a minimum risk operation request is generated by the vehicle (100), the vehicle (100) may determine that the subject of the control authority of the minimum risk operation is the vehicle (100). For example, when the cause of the fault lies in the vehicle (100) (such as a sensor (110) fault or functional fault, etc.), the vehicle (100) may determine that the subject of the control authority of the minimum risk operation is the vehicle (100).

[0241] The vehicle (100) may grant control authority to the vehicle (100) or the driver (S240) based on the subject judgment result of the control authority. According to an embodiment, when the subject of the control authority is the vehicle (100), the vehicle (100) performs the minimum risk operation, and when the subject of the control authority is the driver, the driver performs the minimum risk operation.

[0242] In the case where the subject of the control authority is determined to be the vehicle (100), the vehicle (100) may perform the minimum risk operation until the minimum risk condition is met. According to an embodiment, even if the driver intervenes in the control before the minimum risk condition is met, the vehicle (100) may perform the minimum risk operation without transferring the control authority. For example, in the case where the subject of the control authority is determined to be the vehicle (100), even if the driver performs steering, braking or acceleration operations, the vehicle (100) may continue to perform the minimum risk operation.

[0243] When the subject of the control authority is determined to be the driver, the vehicle (100) can transfer the control authority of the minimum risk operation to the driver when the driver performs the operation. According to an embodiment, when the driver performs the operation during the execution of the minimum risk operation, the vehicle (100) can terminate the minimum risk operation, and the vehicle (100) can be controlled according to the driver's operation. For example, when the driver performs steering, braking or acceleration operations, the vehicle (100) terminates the minimum risk operation performed by the vehicle (100), and the vehicle (100) can be controlled by the driver's operation.

[0244] According to the present invention, the subject with control authority for minimum risk operation can be determined, thereby preventing damage caused by uncertainty of control authority in an emergency situation, thereby achieving the effect of increasing the stability of the vehicle in the minimum risk operation by controlling by the determined subject.

[0245] The vehicle operating method according to the present invention can be implemented by instructions stored in a computer-readable storage medium and executable by a processor.

[0246] The storage medium may include a relational database, a non-relational database, an in-memory database, or other suitable databases that can store data and allow access to these data through a storage controller, including distributed databases, regardless of direct and / or indirect, raw, formatted, organized, or any other accessible state. In addition, the storage medium may include any type of storage device such as a 1st level storage device, a 2nd level storage device, a 3rd level storage device, an offline storage device, a volatile storage device, a non-volatile storage device, a semiconductor storage device, a magnetic storage device, an optical storage device, a flash memory device, a hard disk storage device, a floppy disk drive, a magnetic tape, or other suitable data storage medium.

[0247] In this specification, instructions may be any source code or object code consisting of any combination of one or more programming languages ​​including assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or existing procedural programming languages ​​such as Smalltalk, C++, and "C" programming language or similar programming languages.

[0248] Although the present invention is described with reference to the embodiments shown in the drawings, this is only for illustration, and those skilled in the art will appreciate that various modifications and equivalent other embodiments can be implemented therefrom. Therefore, the actual technical protection scope of the present invention should be determined based on the technical concept of the requested protection scope.

Claims

1. An autonomous driving vehicle, in, include: at least one sensor for sensing the surrounding environment of the vehicle and generating surrounding environment information; a processor that monitors the state of the vehicle to generate vehicle state information and controls autonomous driving of the vehicle; and a controller that controls the operation of the vehicle according to the control of the processor, The processor is configured to: During the automatic driving of the vehicle, sensing whether a minimum risk operation is required based on at least one of the surrounding environment information and the vehicle state information, In the case where the minimum risk operation is required, determining the minimum risk operation type based on the vehicle state information, controlling to stop the vehicle based on the determined minimum risk operation type, The minimum risk operation type includes a minimum risk operation type without lane change and a minimum risk operation type accompanied by lane change.

2. The vehicle according to claim 1, wherein: The vehicle status information indicates whether the functions required for autonomous driving can work normally. The function includes at least one of a lane sensing function, a lane change function, a lateral control function, a deceleration function, a safety zone sensing function, and an object sensing function.

3. The vehicle according to claim 2, wherein: The processor determines whether at least one of the functions required for the automatic driving is in a fault state based on the vehicle state information, In the event that the at least one function is in a faulty state, the minimum risk maneuvering type is determined as the minimum risk maneuvering type without lane change.

4. The vehicle according to claim 3, wherein: The minimum risk operation type without lane change includes at least one of a straight stop type and an in-lane stop type, The straight stop type is to select one of the first deceleration and the second deceleration based on at least one of whether the object sensing function fails, whether there is an obstacle, and the distance to the obstacle, and stop at the selected deceleration. The in-lane stop type is to select one of the first deceleration and the third deceleration based on at least one of whether the object sensing function fails, whether there is an obstacle, and the distance to the obstacle, and stop at the selected deceleration while maintaining the lane. The second deceleration and the third deceleration are smaller than the first deceleration.

5. The vehicle according to claim 4, wherein: The processor is configured to: In a case where the lane sensing function, the lateral control function, the lane change function and the object sensing function among the functions cannot work normally, and the deceleration function can work normally, determining the minimum risk operation type as the straight stop type, The vehicle is controlled to stop at the first deceleration according to the straight-ahead stop type.

6. The vehicle of claim 4, wherein: The processor is configured to: In a case where the lane sensing function, the lateral control function and the lane change function among the functions cannot work normally, and the deceleration function and the object sensing function can work normally, the minimum risk operation type is determined as the straight stop type, sensing whether the obstacle exists and / or the distance to the obstacle according to the straight stop type, When the sensing result shows that there is no obstacle in front of the vehicle, controlling the vehicle to stop at the second deceleration; When the sensing result indicates that there is an obstacle in front of the vehicle and the distance to the obstacle is greater than a specified critical distance, controlling the vehicle to stop at the second deceleration. When the sensing result indicates that there is an obstacle in front of the vehicle and the distance to the obstacle is less than or equal to a specified critical distance, the vehicle is controlled to be stopped at the first deceleration.

7. The vehicle of claim 4, wherein: The processor is configured to: In a case where the lane change function among the functions cannot work normally, and the deceleration function, the object sensing function, the lane sensing function and the lateral control function can work normally, determining the minimum risk operation type as the in-lane stop type, sensing whether the obstacle exists and / or the distance to the obstacle according to the in-lane stop type, When the sensing result shows that there is no obstacle in front of the vehicle, the vehicle is controlled so as to maintain the lane in which it is traveling and stop at the third deceleration. When the sensing result indicates that there is an obstacle in front of the vehicle and the distance to the obstacle is greater than a specified critical distance, the vehicle is controlled in such a manner that the vehicle maintains the lane in which it is traveling and stops at the third deceleration. When the sensing result indicates that there is an obstacle in front of the vehicle and the distance to the obstacle is less than or equal to a specified critical distance, the vehicle is controlled so as to maintain the lane in which it is traveling and stop at the first deceleration.

8. The vehicle of claim 3, wherein: In a case where all functions required for the autonomous driving can operate normally and the minimum risk operation needs to be performed, the minimum risk operation type is determined as the minimum risk operation type accompanied by lane change.

9. The vehicle of claim 1, wherein: The processor is configured to: If it is determined that the minimum risk operation type is associated with a lane change, it is determined whether there is a safety zone. If there is a safety zone, the vehicle is stopped in the safety zone according to the minimum risk operation type associated with a lane change.

10. The vehicle of claim 9, wherein: The at least one sensor includes at least one of a camera, a lidar sensor, and a radar sensor, The processor is configured to determine whether the safety zone exists based on surrounding video or images acquired from at least one of the camera, the lidar sensor, and the radar sensor.

11. A method for operating an autonomous vehicle, in, include: During the automatic driving of the vehicle, a step of sensing the surrounding environment of the vehicle and acquiring surrounding environment information; During the automatic driving of the vehicle, a step of monitoring the state of the vehicle and obtaining vehicle state information; During the automatic driving of the vehicle, a step of sensing whether a minimum risk operation is required based on at least one of the surrounding environment information and the vehicle state information; In the event that the minimum risk maneuver is required, determining the type of minimum risk maneuver based on the vehicle status information; and The step of stopping based on the determined minimum risk operation type, The minimum risk operation type includes a minimum risk operation type without lane change and a minimum risk operation type with lane change.

12. The method of claim 11, wherein: The vehicle status information indicates whether the functions required for autonomous driving can work normally. The function includes at least one of a lane sensing function, a lane change function, a lateral control function, a deceleration function, a safety zone sensing function, and an object sensing function.

13. The method of claim 12, wherein: The step of determining the minimum risk operation type based on the vehicle status information comprises: A step of determining whether at least one of the functions required for the automatic driving is in a fault state based on the vehicle state information; and In the event that the at least one function is in a faulty state, the minimum risk maneuvering type is determined as the minimum risk maneuvering type without lane change.

14. The method of claim 13, wherein: The minimum risk operation type without lane change includes at least one of a straight stop type and an in-lane stop type, The straight stop type is to select one of the first deceleration and the second deceleration based on at least one of whether the object sensing function fails, whether there is an obstacle, and the distance to the obstacle, and stop at the selected deceleration. The in-lane stop type is to select one of the first deceleration and the third deceleration based on at least one of whether the object sensing function fails, whether there is an obstacle, and the distance to the obstacle, and stop at the selected deceleration while maintaining the lane. The second deceleration and the third deceleration are smaller than the first deceleration.

15. The method of claim 14, wherein: The step of determining the minimum risk operation type based on the vehicle status information comprises: In the case that the lane sensing function, the lateral control function, the lane change function and the object sensing function among the functions cannot work normally, and the deceleration function can work normally, the step of determining the minimum risk operation type as the straight stop type, The step of stopping based on the determined minimum risk operation type comprises: and performing control in a manner that the vehicle is stopped at the first deceleration according to the straight-ahead stop type.

16. The method of claim 14, wherein: The step of determining the minimum risk operation type based on the vehicle status information comprises: In the case that the lane sensing function, the lateral control function and the lane change function among the functions cannot work normally, and the deceleration function and the object sensing function can work normally, the step of determining the minimum risk operation type as the straight stop type, The step of stopping based on the determined minimum risk operation type comprises: A step of sensing whether the obstacle exists and / or the distance to the obstacle according to the straight stop type; When the sensing result shows that there is no obstacle in front of the vehicle, controlling the vehicle to stop at the second deceleration; A step of controlling the vehicle to stop at the second deceleration when the sensing result indicates that there is an obstacle in front of the vehicle and the distance to the obstacle is greater than a specified critical distance; and The step of controlling the vehicle to stop at the first deceleration when the sensing result indicates that there is an obstacle in front of the vehicle and the distance to the obstacle is less than or equal to a specified critical distance.

17. The method of claim 14, wherein: The step of determining the minimum risk operation type based on the vehicle status information comprises: In the case where the lane change function among the functions cannot work normally, and the deceleration function, the object sensing function, the lane sensing function and the lateral control function can work normally, the step of determining the minimum risk operation type as the in-lane stop type, The step of stopping based on the determined minimum risk operation type comprises: A step of sensing whether the obstacle exists and / or the distance to the obstacle according to the in-lane stop type; When the sensing result shows that there is no obstacle in front of the vehicle, controlling the vehicle to maintain the lane in which it is traveling and to stop at the third deceleration; When the sensing result indicates that there is an obstacle in front of the vehicle and the distance to the obstacle is greater than a specified critical distance, controlling the vehicle to maintain the lane in which it is traveling and to stop at the third deceleration; and When the sensing result indicates that there is an obstacle in front of the vehicle and the distance to the obstacle is less than or equal to a specified critical distance, the vehicle is controlled in such a manner that the vehicle maintains the lane in which it is traveling and stops at the first deceleration.

18. The method of claim 13, wherein: The step of determining the minimum risk operation type based on the vehicle status information comprises: In a case where all functions required for the autonomous driving can operate normally and the minimum risk operation needs to be performed, the minimum risk operation type is determined as the minimum risk operation type accompanied by lane change.

19. The method of claim 11, wherein: The step of stopping based on the determined minimum risk operation type comprises: Steps to determine whether a safe zone exists; and If a safety zone exists, the vehicle is stopped in the safety zone according to the minimum risk maneuver type associated with the lane change.

20. The method of claim 19, wherein: The step of determining whether the safety zone exists comprises: The step of determining whether the safety zone exists based on surrounding video or image acquired from at least one of the camera, the lidar sensor and the radar sensor.

Images