Methods for improving the safety of a vehicle's driver assistance system

Abstract

The present invention comprises a method (100) for improving the safety of a driver assistance system (60) of a vehicle (70), comprising the following steps: ⌷ Detection (102) of a hazardous situation (20) of the vehicle (70) based on at least one situation-dependent driving parameter (22); ⌷ Providing (104) a defined basic action path (30) which includes at least one first action section (32) wherein within the first action section (32) at least one first vehicle-side action (40) is triggered depending on the detected hazard situation (20) which is suitable to bring the vehicle (70) into a safe state; ⌷ Assess (108) the detected hazard situation (20) for the vehicle (70); ⌷ Adapt (110) the basic action path (30) depending on the assessment of the detected hazard situation (20) for the vehicle (70).

Description

[0001] The present invention relates to a method for improving the safety of a driver assistance system of a vehicle. State of the art

[0002] Automated driving functions up to SAE Level 3 require concepts for handing over control to the driver in the event of a fault or warning the driver if they fail to fulfill their remaining duty to monitor the automated driving function. The higher the level of automation, the more the driver is relieved of their workload and the higher the risk that a driver cannot immediately regain control of the vehicle at any time. This can be caused by the driver's hands not being on the steering wheel.

[0003] Alternatively, a driver may be overtired or so inattentive that it takes several seconds for them to regain control. It is therefore essential that a driver assistance system monitors its own functionality, any potential hazards to the vehicle in the near future, as well as the driver's ability to drive and attention, and, if necessary, prompts the driver to take control of the vehicle in a timely manner.

[0004] State-of-the-art methods for handing over control to the driver are known. In simple driver assistance systems such as ACC, the assistance function is immediately deactivated in the event of a fault, and the driver is informed via the HMI.

[0005] Lane-keeping systems provide a visual and / or audible warning if the driver takes their hands off the steering wheel. If they don't take control of the steering wheel for a certain period of time, the assistance function is deactivated.

[0006] For assistance functions where the driver's hands are no longer on the steering wheel, their attention is monitored (e.g. GM Super Cruise). If attention is no longer present, an escalation path of measures is triggered, which can be stopped by the driver at any point through the required interaction. The driver is initially warned visually. If this does not regain the driver's attention, they are additionally warned by acoustic and haptic signals. If this is also unsuccessful, an acoustic spoken announcement appears, prompting the driver to take control of the steering wheel immediately. If this also fails, the assistance function brakes the vehicle to a controlled stop and immobilizes the vehicle.

[0007] A disadvantage of the state of the art is that the process of completing such an escalation path was predefined during the development phase. DE 10 2016 225 181 A1 discloses a general example of an escalation path. This can result in valuable time being lost, which may not be available depending on the situation. This problem is exacerbated when the associated vehicle architecture, for example, does not have steering and / or braking redundancy, so that in the event of a fault, there is no time to switch to a fallback steering or braking system. If the escalation path is completely completed for all types of faults, valuable time is wasted and a safety risk may arise.

[0008] It is therefore the object of the present invention to provide a solution by means of which the safety of an (automated) driving function can be increased in an efficient and reliable manner. Disclosure of the invention

[0009] This object is achieved by a method for improving the safety of a driver assistance system of a vehicle having the features of the independent claim.

[0010] According to a first aspect, the disclosure relates to a method for improving the safety of a driver assistance system of a vehicle. The driving function can be automated.

[0011] In a first step, a dangerous situation of the vehicle is detected based on at least one situation-dependent driving parameter.

[0012] In a second step, a defined basic action path is provided, which has at least a first action section, wherein within the first action section at least one first vehicle-side action is triggered depending on the detected dangerous situation, which is suitable for bringing the vehicle into a safe state.

[0013] In a third step, the detected danger situation for the vehicle is assessed.

[0014] In a fourth step, the basic course of action is adapted depending on the assessment of the detected hazardous situation for the vehicle.

[0015] A fundamental concept of the present invention is that, in the event of an impending danger or a safety-critical situation, modifications to the basic action path are made during runtime based on a basic definition of an escalation path or basic action path depending on the identified need for action. For example, the first steps of the basic action path can be skipped at the start. Alternatively, individual steps of the basic action path can be skipped during execution. Furthermore, the duration and / or parameters relevant to the individual steps of the basic action path can be adjusted.

[0016] In this way, the basic course of action is flexibly adapted to the existing or detected situation for the vehicle and does not have to be completed in full if the detected safety-critical situation does not allow it or if there is no time to bring the vehicle into a safe state.

[0017] The following advantages can be achieved with the method according to the invention: One advantage is that the total duration of the escalation path or basic action path can be variably adjusted during runtime in the vehicle. If an escalation path is always started with the lowest escalation level and is always completed, the driver may get the impression that they still have enough time and do not need to react immediately. However, depending on the situation, this time may not be available, meaning the driver does not understand the seriousness of the situation. The method presented here allows the escalation path to be adjusted. This can increase the safety of a driving function. Alternatively, a driving function can be operated at higher speeds, for example, with a level of safety comparable to current systems.

[0018] A further advantage of the method according to the invention is that, at the same time, a separate escalation path or basic action path or action path does not have to be defined for every conceivable hazardous situation. Even for complex functions, a single basic definition of an action path can be sufficient. This particularly simplifies the development of modern driver assistance functions. In addition, the driver generally experiences a similar escalation path sequence across different driving functions. This increases trust in a driver assistance function and thus customer acceptance.

[0019] A possible design of the procedure provides that at least the first vehicle-side action consists of at least one of the following actions to warn at least one person in the vehicle: Visual warning, haptic warning, acoustic warning, olfactory warning, an automated intervention in the vehicle's behavior. This achieves the advantage that, depending on a detected safety-critical or safety-relevant situation, the appropriate vehicle-side action is triggered to bring the vehicle into a safe state.

[0020] One possible embodiment of the method is that the adaptation of the basic action path provides for adjusting the degree of execution of at least the first vehicle-side action. This achieves the advantage that, depending on a detected safety-critical or safety-relevant situation or the severity of an identified safety risk for the vehicle, the corresponding and appropriate vehicle-side action is triggered to bring the vehicle into a safe state.

[0021] One possible design of the procedure provides for the adjustment of the basic action path when the recorded time for the occurrence of the detected hazardous situation is shorter than the time required to complete the entire basic action path. This ensures that the vehicle can be brought into a safe state in a timely manner.

[0022] One possible embodiment of the method provides that the basic action path has at least a second action section that follows the first action section, with at least one second vehicle-side action being triggered within the at least second action section depending on the detected hazardous situation. This provides the advantage that the basic action path has a clear and structured sequence of action sections.

[0023] One possible embodiment of the method involves adapting the basic action path so that the first and second action steps and / or the vehicle-side actions overlap in time. This provides the advantage that, depending on a detected safety-critical or safety-relevant situation for the vehicle, the corresponding and appropriate vehicle-side action is triggered to bring the vehicle into a safe state.

[0024] One possible design of the procedure provides for the vehicle-side actions to extend across the respective first and second action stages. This allows for a flexible and driving-situation-dependent adaptation of the basic action path.

[0025] One possible embodiment of the method provides for the respective first and second action steps to differ with respect to the response of the driver assistance system when a driver in the vehicle reacts to the at least one vehicle-side action. This allows for a flexible and driving-situation-dependent adaptation of the basic action path.

[0026] One possible embodiment of the method provides for the targeted exclusion of individual action sections when adapting the basic action path if this is necessary to achieve a defined safety state of the vehicle. This allows for flexible and driving-situation-dependent adaptation of the basic action path to always bring the vehicle into a safe state. During the execution of the adapted action path, the safety of the vehicle occupants is also taken into account if certain driving maneuvers are excluded for the implementation of the adapted action path in order to bring the vehicle into a safe state.

[0027] One possible embodiment of the method provides for the adaptation of the basic action path to skip individual vehicle-side actions. This allows for a flexible and driving-situation-dependent adaptation of the basic action path to bring the vehicle into an adequately secured state.

[0028] A possible embodiment of the method provides that the at least one situation-dependent driving parameter represents at least one of the following hazardous situations for the vehicle, which require an adjustment of the basic course of action: malfunction of the vehicle's driver assistance system, detection of a traffic situation for the vehicle that can no longer be safely controlled by the vehicle's driver assistance system. This achieves the advantage that, depending on a detected safety-critical or safety-relevant situation for the vehicle, the corresponding and appropriate vehicle-side action is triggered to bring the vehicle into a safe state.

[0029] One possible embodiment of the method provides for the vehicle to be at least partially autonomous. This provides the advantage of increasing the safety of the vehicle occupants during the method by enhancing the safety of a potentially automated driving function.

[0030] According to a second aspect, the disclosure relates to a computer program containing machine-readable instructions which, when executed on one or more computers and / or computer instances, cause the computer or computer instances to carry out the method according to the invention.

[0031] According to a third aspect, the disclosure relates to a machine-readable data carrier and / or download product comprising the computer program.

[0032] According to a fourth aspect, the disclosure relates to one or more computers and / or computer instances with the computer program, and / or with the machine-readable data carrier and / or the download product.

[0033] Further measures improving the invention are presented in more detail below together with the description of the preferred embodiments of the invention with reference to figures.

[0034] Further measures improving the invention are presented in more detail below together with the description of the preferred embodiments of the invention with reference to figures. Examples of implementation

[0035] It shows: Fig. 1 Schematic flow diagram of the method 100 for improving the safety of a driver assistance system 60 of a vehicle 70 according to an embodiment of the present invention; and Fig. 2 Schematic definition of a basic action path according to an embodiment of the present invention.

[0036] Fig. 1 shows a schematic flow diagram of the method 100 for improving the safety of a driver assistance system 60 of a vehicle 70 according to an embodiment of the present invention.

[0037] The vehicle 70 can preferably be designed as an at least partially autonomously driving vehicle which provides automated driving functions.

[0038] In a step 102, a dangerous situation 20 of the vehicle 70 is detected on the basis of at least one situation-dependent driving parameter 22.

[0039] The at least one situation-dependent driving parameter 22 can represent at least one of the following dangerous situations for the vehicle 70, which require an adaptation of the basic action path 30: malfunction of the driver assistance system 60 of the vehicle 70, detection of a traffic situation for the vehicle 70, which can no longer be safely controlled by the driver assistance system 60 of the vehicle 70.

[0040] In a step 104, a defined basic action path 30 is provided, which has at least a first action section 32, wherein within the first action section 32 at least one first vehicle-side action 40 is triggered as a function of the detected dangerous situation 20, which is suitable for bringing the vehicle 70 into a safe state.

[0041] Optionally, the at least first vehicle-side action 40 may consist of at least one of the following actions for warning at least one person in the vehicle 70: visual warning, haptic warning, acoustic warning, olfactory warning, an automated intervention in a vehicle behavior of the vehicle 70.

[0042] In a step 108, an evaluation 108 of the detected dangerous situation 20 for the vehicle 70 takes place.

[0043] In a step 110, the basic action path 30 is adapted depending on the assessment of the detected dangerous situation 20 for the vehicle 70.

[0044] Adapting 110 the basic action path 30 can optionally provide for adjusting the degree of execution of at least the first vehicle-based action 40. For example, depending on the identified severity of the hazard, the volume of an emitted acoustic warning tone could be gradually increased along the action path. A similar principle can be applied to visual, haptic, and olfactory warnings. The triggering of a jerk or movement action in the transverse or longitudinal direction of the vehicle can also vary in intensity.

[0045] Furthermore, the adaptation 110 of the basic action path 30 can also take place if a recorded time period for the occurrence of the recorded dangerous situation 20 is shorter than a time period for completing the entire basic action path 30.

[0046] Fig. 2 shows a schematic and exemplary definition of a basic action path 30 according to an embodiment of the present invention.

[0047] In principle, the basic action path 30 can have at least one second action section 34 which follows the first action section 32, wherein within the at least second action section 34 at least one second vehicle-side action 43 is triggered depending on the detected dangerous situation 20.

[0048] In the example of Fig. 2, the action path 30 has a first action section 32, a second action section 34, and a third action section 36. The horizontally running and displayed axis symbolizes a temporal progression.

[0049] The individual action sections 32, 34, 36 of the action path 30 can each consist of vehicle-side actions 41, 42, 43, 44, 45, 46, 47.

[0050] Examples of vehicle-side actions 41, 42, 43, 44, 45, 46, 47 can be: - A visual warning to the driver, e.g., the illumination of a warning symbol in the instrument cluster and / or on the steering wheel. The illumination can be continuous or with a time-varying brightness. Different colors can also be used. - A haptic warning to the driver, e.g. through a vibration of the steering wheel and / or the seat and / or the belt (e.g. by tightening and releasing an existing belt tensioner once or several times). - An acoustic warning to the driver, e.g., via warning tones or spoken announcements. The driver can also be addressed by name to increase the impact. - An automated short braking action, which leads to a noticeable longitudinal jerk. - An automated short steering movement in both directions one after the other, which leads to a noticeable lateral jerk, but the vehicle is kept within the lane. - A visual, haptic, or acoustic warning to one or more passengers. This can be done by first checking whether passengers are present. If no passengers are present, this can prevent unnecessary delays until the next escalation level is reached. - An olfactory warning, if the vehicle is equipped with such a system. This can release a scent through the ventilation system that stimulates the driver's attention, such as peppermint, or scents that trigger short-term negative associations, such as hydrogen sulfide-based substances (rotten eggs). - Adjusting the interior climate, for example, the volume flow of the fan can be increased briefly as a warning or the temperature can be adjusted. - Braking the vehicle to a standstill. This can also be used to secure the vehicle, for example, by activating the parking brake. Hazard warning lights can also be activated to warn other road users. Braking can occur within the current lane, or an automated lane change can be performed first, for example, to park the vehicle on the hard shoulder. - Making an emergency call, for example, via a corresponding service provider such as the "eCall" service and / or to stored contacts. Additional information can be transmitted with this emergency call, such as the location, type, and time of the accident, as well as the number of passengers. In particular, the duration of the escalation path up to the time of the accident can be transmitted. This is advantageous because it makes it clear, even before emergency services arrive, that the driver has been unresponsive for a certain period of time prior to the accident. - A warning can also be issued by the driver assistance system on a connected smartphone. This has the advantage that such a warning is delivered to the driver in a manner familiar even outside the vehicle, for example, a vibration in the trouser pocket. Furthermore, driver distraction is often due to the smartphone, meaning the driver's attention is already focused on it. Therefore, warning the driver in this way is particularly beneficial. This increases the likelihood of regaining their attention to their driving task.

[0051] An action path 30 divided into individual action sections 32, 34, 36 can then be adapted depending on the detected safety-critical situation for the vehicle 70 as follows and by way of example: Adapting 110 the basic action path 30 can provide for the respective action sections 32, 34, 36 and / or the vehicle-side actions 40 to 47 to overlap or overlap in time. Therefore, it is not necessary for a vehicle-side action to be completed before the next action is initiated. This can increase the overall intensity of a warning.

[0052] The vehicle-side actions 40, 43 can extend over the respective individual action sections 32, 34, 36.

[0053] The respective action sections 32, 34, 36 can differ with respect to a reaction of the driver assistance system 60 in the case of a reaction of a driver in the vehicle 70 to the at least one vehicle-side action 40, 43. This will be explained below by way of example on the basis of the action path 30 of the Fig. 2 will be explained: - If the driver reacts within the first action phase 32, for example, the driver assistance function remains active. This can be useful, for example, if it has been detected that the driver has not been looking at the road for a certain period of time, and the escalation path is then initiated. If the driver reacts within the first action phase 32, the function continues. However, if the second action section 34 of the action path 30 is initiated, the driver is prompted to take over manually. If the driver reacts within the second action section 34, the function is still deactivated. Since the driver did not react in a first action section 32, there are legitimate doubts regarding the driver's attention at this point, so that safe operation of a driver assistance function can no longer be guaranteed. Alternatively, the function can be continued at a lower level of assistance until the situation has been resolved and driving can resume with normal functionality. - If the driver does not react in a first action section 32 or in a second action section 34, the actions of a third action section 36 are carried out even without a driver's reaction, for example an automated braking of the vehicle 70 to a standstill.

[0054] Returning to the further possibilities for adapting the basic action path 30, further examples should be given: Furthermore, during the adaptation 110 of the basic action path 30, a targeted exclusion of the execution of individual action sections 32, 34, 36 can take place if this is necessary and expedient to achieve a defined safety state of the vehicle 70.

[0055] Furthermore, the adaptation 110 of the basic action path 30 can provide for skipping individual vehicle-side actions 40, 43.

[0056] Further aspects of the present invention are described in more detail below.

[0057] The aforementioned action sections 32, 34, 36 of action path 30 can overlap in time, just like the vehicle-side actions themselves. An action can also be executed for so long that it extends over several sections.

[0058] Starting from a basic definition of the action path, the action path is now fully followed or modifications are made to the escalation path, depending on the identified situation.

[0059] Detected situations may include the following: 1. The driver assistance system detects that the driver is no longer paying attention to the traffic situation, even though they should be. This detection can be achieved, for example, using interior cameras or by detecting that the driver is no longer touching the steering wheel with their hands. 2. A problem is detected in the driver assistance system, for example the failure of a steering or brake actuator or contamination of an environment detection sensor, so that continued operation of the driver assistance function can no longer be carried out safely. 3. A traffic situation or route is detected which cannot be safely controlled by the driver assistance system.

[0060] In the first situation 1), for example, there is no need to deviate from the basic definition of an action path and it is followed completely.

[0061] However, the second and third situations (2) and (3) above, in particular, may require more rapid action. If such a situation is identified, an adapted version of the basic definition of the action path can be implemented.

[0062] For example, the first actions or sections of the action path can be skipped at the start. Alternatively, individual actions of the action path can be skipped as the player progresses. Alternatively, the strength of one or more actions can be adjusted.

[0063] It is particularly advantageous to determine a time span until a safety-critical situation is reached. For example, a dangerous traffic situation such as a construction site can be determined to be in the future. This time span can then be compared with the duration of the action path in the base definition. If the duration of the action path is too long, the modifications mentioned can be made until the duration of the modified action path is shorter than the calculated time span.

[0064] A further advantage of the method according to the invention is that some components of the action path can be specifically excluded depending on the situation. For example, in the case of a curve, no lateral jerk may be explicitly permitted in order not to endanger driving stability and driver takeover.

[0065] The following is another exemplary scenario for the action path 30 according to the Fig.2 are given: If the driver reacts within the actions of the first action section 32, the driver assistance function continues. If the driver reacts within the actions of the second action section 34, vehicle control is transferred from the driver assistance function to the driver. If the driver does not react, the actions in the third action section 36 are implemented even without a driver reaction.

[0066] For example, vehicle-side action 40 is a visual warning in the form of a steering wheel light. This warning is maintained for a period of 5 seconds. Before this period has elapsed, action 41 is initiated, in which a warning tone is played over the vehicle's loudspeakers for 2 seconds. Action 42 involves vibration of the driver's seat for 2 seconds.

[0067] In the second action section 34, action 43 now includes an acoustic spoken request to take over control of the vehicle, followed by action 44, which includes a warning tone with a higher volume than in action 41.

[0068] Before action 44 has finished, action 45 is started, which includes a warning jolt in the longitudinal direction.

[0069] In the third action section 36, an automatic braking to a standstill is carried out in action 46 and an emergency call is made by action 47 before the end of action 46.

[0070] If a lack of attention on the part of the driver of vehicle 70 is detected, the entire action path 30 is executed. Alternatively, however, if a safety-critical situation is detected for vehicle 70 for which the duration of completing the action path is too high, individual actions or entire sections are removed from the action path, or the action path starts with an action that starts chronologically after action 40, or the action path ends with an action that ends chronologically before action 47.

[0071] The adjustment of action path 30 can also occur if it has already been started. For example, if action path 30 was initially started in such a way that it would actually be completed due to the driver's lack of attention, and then an additional event occurs, such as another vehicle narrowly merging, the aforementioned modifications can be adjusted to the current action path, for example, actions 43 and 44 can be skipped.

[0072] An adjustment of the course of action can be made, for example, due to the following events: - Lack of attention / fatigue of the driver - Driver's health problems - Changes in the surface condition of the road (e.g. asphalt, gravel, potholes, dirt, changes in friction coefficient) - Changes in weather and / or visibility conditions (e.g. rain, fog, frost, position of the sun, visibility range) - Change in the road layout and / or type of road (construction site, curvature of the road, width of the road, change in road markings or lane boundaries, gradient; motorway, country road, city road) - Changes to legal requirements (e.g. maximum speed, prohibition of the use of certain automated driving functions) - Objects on the road (e.g. lost cargo, people, bicycles, animals) - Actions of other road users (e.g. braking, merging, erratic behavior) - Traffic situations (e.g. traffic jams, traffic density) - Technical limitations of the vehicle (e.g., failure / limitation of (backup) actuators such as brakes, steering, drive; failure / limitation / contamination of environmental sensors, e.g., radar, cameras, ultrasonic sensors, lidar; failure / limitation of reference sensors, e.g., acceleration sensors, yaw rate sensors, wheel speed sensors; changes in tire pressure; failure / limitation of windshield wipers) - Leaving the vehicle from a spatial area intended for the operation of the automated function QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2016 225 181 A1

[0007]

Claims

[1] Method (100) for improving the safety of a driver assistance system (60) of a vehicle (70), comprising the following steps: - detecting (102) a dangerous situation (20) of the vehicle (70) on the basis of at least one situation-dependent driving parameter (22); - Providing (104) a defined basic action path (30) which has at least one first action section (32), wherein within the first action section (32) at least one first vehicle-side action (40) is triggered as a function of the detected dangerous situation (20), which is suitable for bringing the vehicle (70) into a safe state; - evaluating (108) the detected dangerous situation (20) for the vehicle (70); - adapting (110) the basic action path (30) depending on the assessment of the detected dangerous situation (20) for the vehicle (70). [2] Method (100) according to claim 1, wherein the at least first vehicle-side action (40) consists of at least one of the following actions for warning at least one person in the vehicle (70): visual warning, haptic warning, acoustic warning, olfactory warning, an automated intervention in a vehicle's behavior (70). [3] Method (100) according to one of the preceding claims, wherein the adaptation (110) of the basic action path (30) provides for adapting a degree of execution of the at least first vehicle-side action (40). [4] Method (100) according to one of the preceding claims, wherein the adaptation (110) of the basic action path (30) takes place when a detected time period for an occurrence of the detected dangerous situation (20) is less than a time period for passing through the entire basic action path (30). [5] Method (100) according to one of the preceding claims, wherein the basic action path (30) has at least one second action section (34) which follows the first action section (32), wherein within the at least second action section (34) at least one second vehicle-side action (43) is triggered as a function of the detected dangerous situation (20). [6] Method (100) according to claim 5, wherein an adaptation (110) of the basic action path (30) provides that the action sections (32, 34) and / or the vehicle-side actions (40, 43) overlap in time. [7] Method (100) according to one of the preceding claims 5 to 6, wherein the vehicle-side actions (40, 43) extend over the respective action sections (32, 34). [8] Method (100) according to claim 5, wherein the respective action sections (32, 34) differ with respect to a reaction of the driver assistance system (60) in the case of a reaction of a driver in the vehicle (70) to the at least one vehicle-side action (40, 43). [9] Method (100) according to one of claims 5 to 8, wherein during the adaptation (110) of the basic action path (30), a targeted exclusion of the execution of individual action sections (32, 34) takes place if this is necessary to achieve a defined safety state of the vehicle (70). [10] Method (100) according to one of the preceding claims 5 to 9, wherein the adaptation (110) of the basic action path (30) provides for skipping individual vehicle-side actions (40, 43). [11] Method (100) according to one of the preceding claims, wherein the at least one situation-dependent driving parameter (22) maps at least one of the following dangerous situations for the vehicle (70) which require an adaptation of the basic action path (30): malfunction of the driver assistance system (60) of the vehicle (70), detection of a traffic situation for the vehicle (70) which can no longer be safely controlled by the driver assistance system (60) of the vehicle (70). [12] Method (100) according to one of the preceding claims, wherein the vehicle (70) is an at least partially autonomously driving vehicle. [13] A computer program comprising machine-readable instructions which, when executed on one or more computers and / or compute instances, cause the computer or computers or compute instances to carry out the method according to any one of claims 1 to 12. [14] Machine-readable data carrier and / or download product with the computer program according to claim 13. [15] One or more computers and / or compute instances with the computer program according to claim 13 and / or with the machine-readable data carrier and / or download product according to claim 14.

Images