Functional safety in longitudinal control systems

Abstract

The invention relates to functional safety in a longitudinal control system. The invention relates to performing ADS functionality. Acceleration of the vehicle is controlled using a control system based on the vehicle sensor data and the planned acceleration. The control system includes a first set of control components having a first ASIL and a second set of control components having a second ASIL, the first ASIL being lower than the second ASIL. Acceleration deviations caused by the first set of control components are detected based on automobile sensor data. Finally, if an acceleration deviation is detected, a safe acceleration state is determined using a second set of control components, where the safe acceleration state is selected from a set of safe acceleration states based on vehicle sensor data, the set including at least: a maximum deceleration, a reduced deceleration, and a reduced acceleration.

Description

Technical Field

[0001] The present invention generally relates to ensuring functional safety when controlling a vehicle, and more precisely, to ensuring functional safety when performing longitudinal control of a vehicle as part of an automated driving system (ADS) function. Background Art

[0002] The ADS function of modern vehicles needs to control the movement of the vehicle in a manner that ensures functional safety in the sense of ISO standard 26262:2018. To this end, each ADS function needs to comply with the automotive safety integrity level (ASIL) required for the functionality of the ADS function. Each ADS function is implemented by a system comprising a set of components, which therefore needs to comply with the required ASIL. However, some individual components in the system may only comply with a lower ASIL and not the required ASIL. Therefore, the system that implements a given ADS function needs to ensure the required ASIL, even though some components do not comply with the required ASIL. To achieve this, the system needs to identify erroneous control decisions of components with lower ASILs and take mitigating control decisions. In a system that implements longitudinal control as part of an ADS function, once an erroneous control decision of a component with a lower ASIL is identified, such mitigating decision needs to determine the appropriate acceleration of the vehicle. However, once an erroneous control decision is determined, such mitigating decision needs to determine a safe acceleration of the vehicle.

[0003] Therefore, an object of the present disclosure is to determine a safe acceleration in a system performing longitudinal control of a vehicle as part of an ADS functionality when an erroneous control decision is determined that a component does not comply with the required ASIL level. Summary of the Invention

[0004] To achieve this object, the present disclosure provides a method for performing an ADS function, which enables a vehicle to provide at least conditional driving automation, including: using a control system to control the acceleration of the vehicle based on vehicle sensor data and a planned acceleration obtained by one or more vehicle sensors of the vehicle. The control system includes a first group of control components with a first ASIL and a second group of control components with a second ASIL, the first ASIL being lower than the second ASIL. The method also includes detecting an acceleration deviation caused by the first group of control components based on the vehicle sensor data. Finally, the method includes: if an acceleration deviation is detected, using the second group of control components to determine a safe acceleration state, wherein the safe acceleration state is selected from a safe acceleration state set based on the vehicle sensor data, the set including at least: maximum deceleration, reduced deceleration, and reduced acceleration.

[0005] The present disclosure also provides an automobile control unit, comprising at least one processing unit and a memory coupled to the at least one processing unit and configured to store machine-readable instructions. The machine-readable instructions enable the at least one processing unit to implement a control system, the control system being configured to control the acceleration of a vehicle, the control system comprising a first group of control components having a first ASIL and a second group of control components having a second ASIL, the first ASIL being lower than the second ASIL. The machine-readable instructions enable the at least one processing unit to: control the acceleration of the vehicle using a control system based on automobile sensor data obtained by one or more automobile sensors of the vehicle and a planned acceleration, detect an acceleration deviation caused by the first group of control components based on the automobile sensor data, and if an acceleration deviation is detected, determine a safe acceleration state using the second group of control components, wherein the safe acceleration state is selected from a safe acceleration state set based on the automobile sensor data, the set comprising at least: maximum deceleration, reduced deceleration, and reduced acceleration

[0006] The present disclosure also provides a vehicle including a plurality of sensors and a vehicle control unit. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Examples of the present disclosure will be described with reference to the following drawings, wherein like reference numerals refer to like components.

[0008] Figure 1 A flowchart of a method for performing ADS functionality according to an example of the present disclosure is provided.

[0009] Figure 2 A block diagram of a control system configured to control vehicle acceleration according to an example of the present disclosure is provided.

[0010] Figure 3 A vehicle including a plurality of automotive sensors according to an example of the present disclosure is illustrated.

[0011] Figure 4 An automotive control unit according to an example of the present disclosure is illustrated.

[0012] It should be understood that the above-mentioned drawings are in no way intended to limit the present disclosure. Rather, these drawings are provided to aid understanding of the present disclosure. Those skilled in the art will readily appreciate that aspects of the present invention shown in one drawing may be combined with aspects in another drawing or may be omitted without departing from the scope of the present disclosure. DETAILED DESCRIPTION

[0013] The present disclosure generally provides an automotive control unit, a vehicle, and a method configured to perform an ADS function that enables the vehicle to provide at least conditional driving automation. More precisely, the present disclosure uses a control system (such as Figure 2The exemplary control system 200 shown in FIG. 2 is used to enable the ADS function, which receives the planned acceleration a planned , which is the acceleration determined by one or more driving automation system (DAS) functions of the vehicle, and plans the acceleration a planned Converted into a torque to be applied by the brake and / or engine, i.e. braking torque M brake and engine torque M engine It should be understood that the expression "moment" may be used interchangeably with the expression "torque" throughout this disclosure.

[0014] In the context of this disclosure, DAS functionality refers to functionality that performs vehicle driving automation aspects according to the driving automation taxonomy defined in SAE International's standard J3016, regardless of the driving automation level. In contrast, ADS functionality in this disclosure refers to functionality that performs vehicle driving automation aspects corresponding to at least Level 3 according to the driving automation taxonomy defined in SAE International's standard J3016.

[0015] The control system 200 includes control components such as Figure 2 The various components shown in FIG are illustrated in FIG. Figure 2 In the example shown in FIG1 , these control components have two different ASILs. The fact that the control components of control system 100 have different ASILs is illustrated by patterned control component 121, which has a lower ASIL than the other control components of control system 100. The higher ASIL of the control components of control system 100 corresponds to the ASIL that control system 100 needs to comply with.

[0016] The control system 200 receives the odometer signal S odometry , which may include odometer data of the vehicle and may, for example, indicate the current acceleration, acceleration deviation, speed and / or position deviation of the vehicle 300. odometry , the control system 200 detects the acceleration deviation, that is, the planned acceleration a of the vehicle planned If the control system 200 determines that the acceleration deviation exceeds, for example, the specification requirements or standard control capabilities of the control system 100, the control system switches to a safe acceleration state to maintain compliance with the required ASIL of the control system 200, thereby ensuring the functional safety of the control loop 100.

[0017] This general concept will now be explained with reference to the accompanying drawings, in which Figure 1 A flowchart of a method for performing ADS functions is provided, and Figure 2 A block diagram of a control system 200 is provided. Figure 3The diagram shows a vehicle including a plurality of vehicle sensors and a vehicle control unit. Finally, Figure 4 An example of an automotive control unit is illustrated in more detail.

[0018] It should be understood that Figure 1 The dashed boxes in illustrate optional steps of method 100.

[0019] The method 100 is configured to perform an ADS function so that a vehicle (such as Figure 3 The vehicle 300) is capable of providing at least conditional driving automation.

[0020] Briefly go to Figure 3 , vehicle 300 and the more general expression "vehicle" in the context of this disclosure refers to any type of motor vehicle configured to transport people and / or goods. The motor of vehicle 300 can be any type of motor, such as an electric motor or an internal combustion engine. Vehicle 300 can be, for example, Figure 2 The vehicle 300 is shown as a passenger vehicle. However, it should be understood that the vehicle 300 may also be a bus, a truck, or any other type of vehicle that includes one or more sensors 310 and a vehicle control unit 300, such that the vehicle 300 is capable of providing at least conditional driving automation. In other words, the vehicle control unit 300 and the one or more sensors 310 may be configured to enable the vehicle 300 to provide vehicle control functionality with at least conditional driving automation, i.e., Level 3 of the driving automation taxonomy defined in the SAE International standard J3016. That is, the vehicle 300 may be configured to provide at least one ADS that performs the overall dynamic driving task (DDT) under regular / normal operation in a continuous and operational design domain (ODD)-specific manner based on vehicle sensor data provided by the one or more sensors 310, with the user of the vehicle 300 acting as a user with DDT fallback capability if the ADS is requested to take over the DDT or in the event of a system failure related to the execution of the DDT in other vehicle systems.

[0021] ODD in the context of this disclosure refers to the operating conditions under which a given DAS function is specifically designed to operate, including but not limited to environmental, geographic and temporal constraints, and / or the necessary presence or absence of certain traffic or road characteristics.

[0022] DDT in the context of this disclosure includes all real-time operational and tactical functions required to operate the vehicle 300 in road traffic, but does not include strategic functions such as routing and destination and waypoint selection. In the context of DDT, DDT fallback refers to a user with DDT fallback capability taking over the execution of DDT or ADS functions, or a user with DDT fallback capability achieving a minimum risk condition, i.e., a stable, stopped condition of the vehicle 300, after a system failure related to DDT execution or when exiting ODD.

[0023] It will be appreciated that the vehicle 300 may be configured to implement a higher level of driving automation, such as advanced driving automation, ie, Level 4 or higher of the driving automation taxonomy defined in SAE International's standard J3016.

[0024] It should be understood that, given the ODD specificity of the ADS functions performed by the method 100 , the vehicle 300 may perform DAS functions with a higher or lower level of automation outside of the ODD of the ADS functions performed by the method 100 .

[0025] One or more sensors 310 are configured to capture vehicle sensor data indicative of the environment of vehicle 300. Thus, the vehicle sensor data provides situational awareness to one or more vehicle control modules, thereby providing situational awareness to vehicle 300, at least to enable driver assistance. For example, the vehicle sensor data captured by one or more sensors 310 can provide vehicle 300 with information regarding the location and size of other vehicles, road markings, or traffic signs. To this end, one or more sensors 310 may be radar sensors, which may be configured to emit radio waves to determine the distance, angle, and speed of objects around the vehicle based on reflected radio waves. One or more sensors 310 may be light detection and ranging (LIDAR) sensors, which may be configured to emit laser beams to determine the distance, angle, and speed of objects around vehicle 300 based on reflected laser beams. One or more sensors 310 may be cameras, which capture images of the vehicle's environment. One or more sensors 310 may be thermal imaging cameras, which capture images of the vehicle's environment based on infrared radiation. It should be understood that LIDAR sensors, radar sensors, or cameras are merely examples of sensor types for one or more sensors 310. For example, one or more sensors 310 may also be ultrasonic sensors. The one or more sensors 310 can be global navigation satellite system (GNSS) sensors that are configured to receive location data (such as satellite signals) to determine the location of the vehicle 200. More generally, the one or more sensors 310 can be any type of sensor capable of capturing automotive sensor data indicative of the environment of the vehicle 300. Additionally, the one or more sensors 310 can also be any type of sensor capable of capturing odometer data (e.g., speed and acceleration) of the vehicle 300. This capture capability can be integrated into the sensor types discussed above, or can be provided by a dedicated motion sensor. It will be further understood that the one or more sensors 310 can include multiple sensors of various types. Additionally, the one or more sensors 310 of the same type can exhibit different properties, for example, by being configured to capture sensor data of different ranges, such as close range, medium range, and long range. For example, vehicle 300 may include three short-range radar sensors each at the front and rear of vehicle 300, a mid-range to long-range radar sensor at the rear of vehicle 200, a lidar sensor at the front of vehicle 300, a rear camera at the rear of vehicle 200, a front camera at the front of the vehicle, a front camera at the rearview mirror, and a rear short-range to mid-range radar sensor in each door-mounted exterior mirror. It will be appreciated that vehicle 300 may include more than Figure 3 More or fewer automotive sensors as shown in and discussed in the above examples.

[0026] In step 110, method 100 uses Figure 2 The control system 200 is based on the planned acceleration a planned and vehicle sensor data obtained by the one or more vehicle sensors 310 to control the acceleration of the vehicle 300. In other words, the method 100 controls the longitudinal movement of the vehicle 300 as part of the ADS function, while the lateral movement of the ADS function is controlled by other systems of the vehicle 300. For example, the method 100 can control the acceleration of the vehicle 300 as part of the implementation of a controlled highway cruise function, that is, a function that provides Level 3 driving automation on a controlled highway with a maximum driving speed of a specified driving speed, such as 60 km / h, 90 km / h, or 120 km / h.

[0027] Planned acceleration a planned The acceleration to be performed by the vehicle 300 during the planning horizon duration may be indicated. That is, the planned acceleration a planned The acceleration determination module coupled to the control system 200 may be used for the system clock (e.g., as described below with reference to Figure 4 The acceleration determination module may be any type of DAS function configured to determine the planned acceleration a based on a driving environment model of the vehicle 300 derived from vehicle sensor data. planned , that is, the acceleration that the vehicle 300 should perform based on the driving environment. The acceleration determination module can determine the planned acceleration a for the planned horizon. planned , that is, the planned acceleration a can be adjusted based on the driving environment planned The time range or acceleration determination module can determine the planned acceleration a planned For example, the planning horizon can be in the range of 1 second to 10 seconds. Although the planning acceleration a can be determined for the planning horizon planned , but it can still be re-determined at each clock cycle. That is, the acceleration determination module can determine at each clock cycle (which may be in the ms or ns range) what the acceleration of the vehicle 300 should be, for example, in the next 2 seconds or 5 seconds. In other words, the planned acceleration a planned It may correspond to the acceleration that the vehicle 300 should exhibit in a future time range, and the time interval for updating the acceleration is shorter than the time range in which the vehicle 300 should exhibit the acceleration.

[0028] It should be understood that to indicate the planned acceleration to be performed by the vehicle, the planned acceleration a planned A plurality of planned vehicle parameters may be included, which may include a planned velocity and a planned position at a planned time, as well as any other parameters that may be planned with respect to longitudinal movement control performed by method 100. To this end, the planned acceleration a plannedIt can also be considered as the trajectory vector v trajectory , which can include any number of planned vehicle parameters.

[0029] The control system 200 comprises a first set of control components having a first ASIL and a second set of control components having a second ASIL. The first ASIL is lower than the second ASIL. In the context of the present disclosure, a component may refer to one or more hardware components and / or software units that perform logically separable functions within the performance of an ADS function. In the context of the present disclosure, ASIL refers to the requirements that a given component needs to meet and the safety measures that a given component needs to implement in order to avoid unreasonable risks, i.e. in order to provide the required functional safety in the sense of standard ISO 26262:2018. Therefore, the components of the control system 200 may have an ASIL ranging from a quality management (QM) level to a D level, where the QM level indicates the lowest ASIL and the D level indicates the highest ASIL. Therefore, it will be understood that in the context of the present disclosure, QM is regarded as an ASIL. The following will be combined with Figure 2 Discussion of control system 200.

[0030] Figure 2 An exemplary control system 200 is shown, which includes an acceleration control 210 and a torque control 220, which constitute control components of the control system 200 and thus each represent a logically separable function as discussed above. It should be understood that any control component of the control system 200 discussed below may be implemented by one or more hardware components and / or software units, and may also include subcomponents and / or subunits. It should also be understood that any control component of the control system 200 may implement additional functionality that supplements the functionality of these components discussed below.

[0031] The acceleration control 210 may be configured to receive a planned acceleration a planned and car sensor data, in Figure 2 In the example of odometry The acceleration control 210 may be configured to obtain the odometer data S odometry The instantaneous acceleration of the vehicle 300 is derived. Based on the instantaneous acceleration derived from the vehicle sensor data and the planned acceleration a planned , the acceleration control 210 can determine the target acceleration a target , which is the instantaneous acceleration that the vehicle 300 should exhibit at a given point in time. In other words, the target acceleration a target Indicates the instantaneous acceleration that the vehicle 300 should exhibit in order to achieve the planned acceleration a of the vehicle 300 taking into account the instantaneous acceleration planned In summary, the acceleration control 210 can therefore take the planned acceleration a plannedand vehicle sensor data to determine the target acceleration a target .

[0032] To achieve this functionality, acceleration control 210 may include target acceleration determination 211 and acceleration divergence determination 212. Acceleration divergence determination 212 may be configured to determine the instantaneous acceleration of vehicle 300 relative to the planned acceleration a. planned The divergence of the two accelerations is the difference between them. planned Including additional planned vehicle parameters as discussed above, the determination of divergence may also take into account the divergence between other planned vehicle parameters and derive instantaneous vehicle parameters accordingly. The acceleration divergence determination 212 may thus be configured to receive at least odometer data S from the vehicle sensor 310. odometry And receive the planned acceleration a from the acceleration determination module planned The acceleration divergence determination 212 may also be configured to provide the determined divergence to the target acceleration determination 211, which may be configured to be based on a method suitable for comparing the instantaneous acceleration of the vehicle 300 with the planned acceleration a. planned The target acceleration a is determined by any type of control scheme in which the difference between target .

[0033] The torque control 220 may receive the target acceleration a target and can be configured to set the target acceleration a target Converted into braking torque M brake and engine torque M engine Thus, the torque control 220 may be configured to determine control parameters of the vehicle 300 that affect the acceleration of the vehicle 300 in order to achieve the planned acceleration a planned To achieve this functionality, the torque control 220 may include an acceleration to torque converter 221, which may be configured based at least on the odometer data S odometry and target acceleration a target To determine the calculated braking torque M brake_calc and the calculated engine torque M engine_calc The calculated braking torque M brake_calc and the calculated engine torque M engine_calc The control system 200 can use the braking torque M as a control parameter brake and engine torque M engine output, as discussed below.

[0034] The acceleration-to-torque converter 221 may have a lower ASIL than the other control components of the control system 200. For example, the acceleration-to-torque converter 221 may comply with ASIL QM, while the other control components of the control system 200 comply with ASIL B. This fact is illustrated by the schematization of the acceleration-to-torque converter 221. Therefore, the acceleration-to-torque converter 221 may correspond to a first group of control components with a first ASIL, while the acceleration-to-torque converter 221 may correspond to a first group of control components with a first ASIL. Figure 2 The other control components of the control system 200 may correspond to a second group of control components having a second ASIL, which may be, for example, ASIL B. In this example, the control system 200 may therefore need to comply with ASIL B. It will be understood that Figure 2 The number of components in the first and second groups shown in are provided as examples only, and the first and second groups of control components may include any number of control components required for actual implementation of the control system 200 .

[0035] Based on the above discussion of the control system 200, step 110 may include step 111, wherein the method 100 may be based on at least the planned acceleration a planned and vehicle sensor data (which may include at least odometer data S odometry ) to determine the target acceleration a for each clock cycle of the system clock of the vehicle 300 target This step may be performed by acceleration control 210, target acceleration determination 211, and acceleration divergence determination 212. In addition, step 110 may include step 112, in which method 100 may determine the target acceleration a target Converted into braking torque M brake and engine torque M engine Step 121 may be performed by torque control 220 and acceleration to torque conversion 221 .

[0036] In step 120 , the method 100 may receive an override signal S override , the override signal can cause the acceleration to be controlled to the target acceleration a target Set to the value indicated by the override signal. Override signal S override This enables another DAS function (such as the acceleration determination module discussed above) to set the target acceleration a target , and therefore the vehicle 300 should exhibit instantaneous acceleration regardless of the control decisions made by the acceleration control 210 , the target acceleration determination 211 , and the acceleration divergence determination 212 .

[0037] In step 130, the method 100 detects acceleration deviations caused by a first set of control components based on vehicle sensor data. Figure 2In the context of the example control system 200, the acceleration control 210 and the acceleration divergence determination 212 may detect an acceleration divergence from the vehicle sensor data (ie, at least the odometer data S odometry ) The instantaneous acceleration of the vehicle 300 and the planned acceleration a planned The deviation of exceeds the deviation threshold. Since the braking torque M brake and engine torque M engine It can be determined by the acceleration to torque conversion 221, i.e. the control component with the first ASIL and therefore the lower ASIL in the first group of control components, so it is assumed that the deviation is caused by the acceleration to torque conversion 221. In other words, the method 100 detects in step 130 that the control parameters of the vehicle 300 determined by the control system 200 in step 110 do not achieve the planned acceleration a planned , for example due to a control problem or error condition of the group of components with the first ASIL.

[0038] It should be understood that if the planned acceleration a planned / trajectory vector v trajectory Including additional planned vehicle parameters as discussed above, the detection of acceleration deviations in step 130 may include the detection of deviations in additional vehicle parameters.

[0039] If an acceleration deviation is detected in step 130, the method 100 determines a safe acceleration state using the second set of control components. The safe acceleration state is selected from a set of safe acceleration states based on vehicle sensor data and includes at least maximum deceleration, reduced deceleration, and reduced acceleration. In other words, if the control system 200 determines the vehicle control parameter braking torque M based on the normal operation discussed above with respect to step 110, brake and engine torque M engine If the acceleration deviation is caused, the second group of components with the second ASIL takes over the vehicle control parameter braking torque M brake and engine torque M engine and determine a safe acceleration in order to ensure the functional safety of the control system 200 and, therefore, the longitudinal control of the ADS function performed by the method 100 .

[0040] The reduced deceleration and reduced acceleration are reduced relative to the deceleration or acceleration determined by the control system 200 under normal operation. That is, when the second group of components with the second ASIL takes over the vehicle control parameter braking torque M brake and engine torque M engine When determining the braking torque M, the above discussion of step 110 may be continued. brake and engine torque M engineThe normal determination of the acceleration state may be considered and used to determine the safe acceleration state, but may not be output to the brake and the engine. In addition, step 140 may include step 141, in which the method 100 may be based on the planned acceleration a planned One of the following items in the safe acceleration state set is determined: reduced deceleration and reduced acceleration. In other words, when the safe acceleration state is selected by reducing the deceleration or acceleration determined by normal operation of the control system 200, the reduced deceleration and reduced acceleration can be determined, which can take into account the planned acceleration a planned Furthermore, the reduced deceleration and the reduced acceleration may be determined based on one or more preset offsets with respect to the acceleration determined in step 110 , which offsets may be absolute offsets or relative offsets and may depend on the magnitude of the acceleration deviation.

[0041] If any other acceleration state is deemed insufficient to ensure functional safety of the control system 200 during determination of the safe acceleration state in step 140 , the maximum deceleration is used as a fallback safe acceleration state in order to achieve a minimum risk condition.

[0042] To implement steps 140 and 141, Figure 2 The control system 200 , and more precisely the torque control 220 , may also include a brake torque multiplexer 222 , a safety torque determination 223 , and an engine torque multiplexer 224 .

[0043] The safety torque determination 223 may be configured to select one of the safety acceleration states from the safety acceleration state set and determine the corresponding vehicle control parameter safety braking torque M brake_safe and safe engine torque M engine_safe To this end, the safe torque determination 223 may be configured to receive the calculated braking torque M from the acceleration to torque conversion 221. brake_calc and the calculated engine torque M engine_calc , as indicated by the bidirectional connection between the two control components, and may also be configured to receive a safety acceleration request signal S req_safe_acc Safe acceleration request signal S req_safe_acc The acceleration control 210 and the acceleration divergence determination 212 may be generated in step 130 when an acceleration deviation is detected. Similarly, the acceleration control 210 and the acceleration divergence determination 212 may be configured to generate the safe acceleration selection signal S req_safe_acc Safe acceleration selection signal S req_safe_acc The brake torque multiplexer 222 and the engine torque multiplexer 224 may output the calculated brake torque M brake_calc and the calculated engine torque M engine_calcOr safety braking torque M brake_safe and safe engine torque M engine_safe As the braking torque M brake and engine torque M engine , depending on whether an acceleration deviation is detected in step 130. In other words, the safety acceleration selection signal S req_safe_acc It can be used as a selection signal for the brake torque multiplexer 222 and the engine torque multiplexer 224, and can select the safe brake torque M based on the detection of the acceleration deviation in step 130. brake_safe and safe engine torque M engine_safe as output.

[0044] The safe torque determiner 223 may select and determine the safe acceleration state according to the above discussion based on any type of control scheme suitable for selecting and determining the safe acceleration state in a manner that complies with the ASIL of the control system 200 and ensures the functional safety of the control system 200 .

[0045] In step 150, if the method 100 determines that a performance-related fault has occurred in the control system 200 as part of steps 130 and 140 and therefore due to acceleration deviation, the method 100 may cause the vehicle 300 to perform a DDT rollback. If the ADS functionality implemented by the method 100 provides Level 3 driving automation, step 150 may include step 151, in which the method 100 may issue a request to a rollback-capable user of the vehicle 300 to intervene. In higher levels of automation, the DDT rollback may include entering a "limp home" mode, which may cause the vehicle 300 to continue to slowly drive to the destination or slowly drive to a repair facility.

[0046] Finally, method 100 may include step 160, in which method 100 may achieve a minimum risk condition for vehicle 300. Method 100 may make this decision if, for example, maximum deceleration was selected in step 140, or if vehicle 300 is unable to continue traveling due to a performance-related failure of control system 200.

[0047] In summary, as part of the ADS function, method 200 utilizes control components of different ASILs to perform longitudinal control and ensures the functional safety of vehicle 300 in the event of a failure of a control component with a lower ASIL by detecting acceleration deviations and determining corresponding safe acceleration states.

[0048] Figure 4An automotive control unit 400 is shown configured to perform method 100. The automotive control unit 400 may include a processor 410, a graphics processing unit (GPU) 420, an automotive processing system 430, a memory 440, a removable storage device 450, a storage device 460, a cellular interface 470, a global navigation satellite system (GNSS) interface 480, and a communication interface 490.

[0049] The processor 410 can be any type of single-core or multi-core processing unit that uses a reduced instruction set computing (RISC) or complex instruction set computing (CISC). Exemplary RISC processing units include ARM-based cores or RISC V-based cores. Exemplary CISC processing units include x86-based cores or x86-64-based cores. The processor 410 can execute instructions to cause the vehicle control unit 400 to perform the method 200. The processor 410 can be directly coupled to any component of the vehicle control unit 400, or can be directly coupled to the memory 430, the GPU 420, and the device bus.

[0050] The GPU 420 can be any type of processing unit that is optimized for processing graphics-related instructions or more generally for parallel processing of instructions. In this way, the GPU 420 can be configured to generate information displayed to the driver of the vehicle via a head-up display (HUD) or a display arranged in the driver's field of view, such as ADAS information or telemetry data. The GPU 420 can be coupled to the HUD and / or display via connection 420C. The GPU 420 can also execute at least a portion of the method 100 to achieve fast parallel processing of instructions related to the method 100. It should be noted that in some embodiments, the processor 410 can determine that the GPU 420 does not need to execute instructions related to the method 200. The GPU 420 can be directly coupled to any component of the vehicle control unit 400, or can be directly coupled to the processor 410 and the memory 430. In some embodiments, the GPU 420 can also be coupled to a device bus.

[0051] The vehicle processing system 430 can be any type of system-on-chip that is configured to provide trillions of operations per second (TOPS) to enable the vehicle control unit 400 to implement one or more ADAS while driving. The vehicle processing system 430 can interface only with the processor 410 or can interface with other devices via a system bus. The vehicle processing system 430 can, for example, execute instructions associated with one or more vehicle sensor data processing modules and one or more vehicle control modules.

[0052] Memory 440 can be any type of fast storage device that enables processor 410, GPU 420, and vehicle processing system 430 to store instructions for fast retrieval during instruction processing, as well as cache and buffer data. Memory 440 can be a unified memory coupled to processor 410, GPU 420, and vehicle processing system 430 to enable memory 440 to be allocated to processors 410, GPU 420, and vehicle processing system 430 as needed. Alternatively, processor 410, GPU 420, and vehicle processing system 430 can be coupled to separate processor memory 440a, GPU memory 440b, and vehicle processing system memory 440c.

[0053] The removable storage device 450 may be a storage device that can be removably coupled to the vehicle control unit 400. Examples include a digital versatile disc (DVD), a compact disc (CD), a universal serial bus (USB) storage device (such as an external SSD), or a magnetic tape. It should be noted that the removable storage device 450 may store data (such as instructions of the method 200, vehicle sensor data, intermediate data, and / or vehicle control data), or may be omitted.

[0054] Storage device 460 may be a storage device that enables storage of program instructions and other data. For example, storage device 460 may be a hard disk drive (HDD), a solid-state disk (SSD), or some other type of non-volatile memory. Storage device 460 may, for example, store instructions for method 100, vehicle sensor data, intermediate data, and / or vehicle control data.

[0055] Removable storage device 450 and storage device 460 may be coupled to processor 410 via a system bus. The system bus may be any type of bus system that enables processor 410 and optional GPU 420, as well as vehicle processing system 430, to communicate with other devices of vehicle control unit 400. Bus 440 may be, for example, a Peripheral Component Interconnect Express (PCIe) bus or a Serial AT Attachment (SATA) bus.

[0056] The cellular interface 470 may be any type of interface that enables the vehicle control unit 400 to communicate via a cellular network, such as a 4G network or a 5G network.

[0057] GNSS interface 480 may be any type of interface that enables vehicle control unit 300 to receive location data provided by a satellite network such as Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), or Galileo. Location data may be one of the vehicle sensor data types in the present disclosure.

[0058] The communication interface 490 can enable the vehicle control unit 400 to interface with external devices directly or via a network. The communication interface 480 can, for example, enable the vehicle control unit 300 to couple to a wired or wireless network, such as Ethernet, Wi-Fi, a controller area network (CAN) bus, or any other suitable bus system in the vehicle. For example, the vehicle control unit 400 can be coupled to one or more vehicle sensors 310 to receive vehicle sensor data.

[0059] The vehicle control unit 400 may be integrated with the vehicle 300 , for example, located under the vehicle compartment, under the dashboard, or in the trunk of the vehicle 300 .

[0060] The present invention can be further illustrated by the following examples.

[0061] In one example, a method for performing an ADS function that enables a vehicle to provide at least conditional driving automation includes: using a control system to control the acceleration of a vehicle based on vehicle sensor data obtained by one or more vehicle sensors of the vehicle and a planned acceleration. The control system includes a first set of control components having a first ASIL and a second set of control components having a second ASIL, the first ASIL being lower than the second ASIL. The method also includes detecting an acceleration deviation caused by the first set of control components based on the vehicle sensor data. Finally, the method includes determining a safe acceleration state using the second set of control components if the acceleration deviation is detected, wherein the safe acceleration state is selected from a set of safe acceleration states based on the vehicle sensor data, the set including at least: maximum deceleration, reduced deceleration, and reduced acceleration.

[0062] In an example method, the planned acceleration may indicate an acceleration to be performed by the vehicle during a planned horizon duration, wherein the planned acceleration may be determined for each clock cycle of a system clock by an acceleration determination module coupled to the control system.

[0063] The example method may also include causing the vehicle to perform a DDT rollback.

[0064] In an example method, causing the vehicle to perform a DDT rollback may include issuing a request to a rollback-capable user of the vehicle to intervene.

[0065] The example method may also include causing the vehicle to achieve a minimum risk condition.

[0066] In an example method, controlling acceleration may include determining a target acceleration for each clock cycle of a system clock of the vehicle based on at least the projected acceleration and vehicle sensor data, and converting the target acceleration to a brake torque and an engine torque.

[0067] The example method may also include receiving an override signal that causes control of the acceleration to set a target acceleration of the control system to a value indicated by the override signal.

[0068] In an example method, determining the safe acceleration state may include determining one of the following in a set of safe acceleration states based on the planned acceleration: the reduced deceleration, and the reduced acceleration.

[0069] In an example, a vehicle control unit includes at least one processing unit and a memory coupled to the at least one processing unit and configured to store machine-readable instructions. The machine-readable instructions cause the at least one processing unit to implement a control system configured to control acceleration of a vehicle, the control system including a first set of control components having a first ASIL and a second set of control components having a second ASIL, the first ASIL being lower than the second ASIL. The machine-readable instructions cause the at least one processing unit to use the control system to control acceleration of the vehicle based on vehicle sensor data obtained from one or more vehicle sensors of the vehicle and a planned acceleration, detect an acceleration deviation caused by the first set of control components based on the vehicle sensor data, and if an acceleration deviation is detected, determine a safe acceleration state using the second set of control components, wherein the safe acceleration state is selected from a set of safe acceleration states based on the vehicle sensor data, the set comprising at least: maximum deceleration, reduced deceleration, and reduced acceleration.

[0070] In the example automotive control unit, the machine-readable instructions may further cause at least one processing unit to perform any one of the aforementioned example methods.

[0071] In one example, a vehicle includes a plurality of vehicle sensors and the aforementioned example vehicle control unit.

[0072] The foregoing description is provided to illustrate the deployment of functional safety in a longitudinal control system. It should be understood that this description is in no way intended to limit the scope of the present disclosure to the precise embodiments discussed throughout the description. Rather, those skilled in the art will appreciate that the examples of the present disclosure may be combined, modified, or condensed without departing from the scope of the present disclosure as defined by the following claims.

[0073] Reference Signs List

[0074] 100 methods

[0075] 110-160 Methods and Steps

[0076] 200 Control System

[0077] 210 Acceleration Control

[0078] 211 Target acceleration determination

[0079] 212 Acceleration Divergence Determination

[0080] 220 Torque Control

[0081] 221 Acceleration to Torque Conversion

[0082] 222 Braking Torque Multiplexer

[0083] 223 Safe Torque Determination

[0084] 224 Engine Torque Multiplexer

[0085] 300 vehicles

[0086] 310 Automotive Sensors

[0087] 400 Automotive Control Units

[0088] 410 CPU

[0089] 420 GPU

[0090] 420c connection

[0091] 430 Automotive Processing Systems

[0092] 440 Memory

[0093] 450 Removable storage device

[0094] 460 Storage Device

[0095] 470 Cellular Interface

[0096] 480 GNSS interface

[0097] 490 Communication Interface

Claims

1. A method for executing an automated driving system (ADS) function, wherein the ADS function enables a vehicle to provide at least conditional driving automation, the method comprising: controlling an acceleration of the vehicle using a control system based on vehicle sensor data obtained by one or more vehicle sensors of the vehicle and a projected acceleration, wherein the control system includes a first set of control components having a first automotive safety integrity level (ASIL) and a second set of control components having a second ASIL, the first ASIL being lower than the second ASIL; detecting an acceleration deviation caused by the first set of control components based on the vehicle sensor data; as well as If the acceleration deviation is detected, a safe acceleration state is determined using the second set of control components, wherein the safe acceleration state is selected from a set of safe acceleration states based on the vehicle sensor data, the set including at least: maximum deceleration, reduced deceleration, and reduced acceleration. 2 . The method of claim 1 , wherein the planned acceleration indicates an acceleration to be performed by the vehicle within a planning horizon duration, the planned acceleration being determined for each clock cycle of a system clock by an acceleration determination module coupled to the control system.

3. The method according to any one of the preceding claims, further comprising: The vehicle is caused to perform a dynamic driving task DDT fallback.

4. The method of claim 3, wherein causing the vehicle to perform a DDT rollback comprises: A request to intervene is issued to a user of the vehicle that has roll-back capability.

5. The method according to any one of the preceding claims, further comprising: The vehicle is brought into a minimum risk condition.

6. The method of any preceding claim, wherein controlling the acceleration comprises: determining a target acceleration for each clock cycle of a system clock of the vehicle based at least on the projected acceleration and the vehicle sensor data; as well as The target acceleration is converted into brake torque and engine torque.

7. The method according to any one of the preceding claims, further comprising: An override signal is received that causes the controlling of the acceleration to set a target acceleration of the control system to a value indicated by the override signal.

8. The method of any one of the preceding claims, wherein determining the safe acceleration state comprises: Based on the planned acceleration, one of the following items in the safe acceleration state set is determined: the reduced deceleration, and the reduced acceleration.

9. An automobile control unit (400), comprising: at least one processing unit (410, 420, 430); as well as a memory (440, 450) coupled to the at least one processing unit (410, 420, 430) and configured to store machine-readable instructions, wherein the machine-readable instructions cause the at least one processing unit (410, 420, 430) to implement a control system configured to control acceleration of a vehicle, the control system comprising a first set of control components having a first Automotive Safety Integrity Level (ASIL) and a second set of control components having a second ASIL, the first ASIL being lower than the second ASIL, and wherein the machine-readable instructions further cause the at least one processing unit (410, 420, 430): controlling the acceleration of the vehicle using the control system based on vehicle sensor data obtained by one or more vehicle sensors of the vehicle and a projected acceleration; detecting an acceleration deviation caused by the first set of control components based on the vehicle sensor data; as well as If the acceleration deviation is detected, a safe acceleration state is determined using the second set of control components, wherein the safe acceleration state is selected from a set of safe acceleration states based on the vehicle sensor data, the set including at least: maximum deceleration, reduced deceleration, and reduced acceleration.

10. The automotive control unit (400) according to claim 9, wherein the machine-readable instructions further cause the at least one processing unit (410, 420, 430) to perform the method according to any one of claims 2 to 8.

11. A vehicle (300) comprising a plurality of vehicle sensors and a vehicle control unit (410, 420, 430) according to any one of claims 9 and 10.

Images