Safety control device in an autonomous vehicle

Abstract

The present invention relates to a safety control device for manual control intervention by an operator or safety driver in an autonomous vehicle or a vehicle with an assistance system. The safety control device comprises a control unit and a joystick operable by the safety driver, from which a steering intervention signal and a longitudinal dynamics intervention signal can be transmitted to the control unit, wherein the steering intervention signal overrides an autonomous steering signal and the longitudinal dynamics intervention signal overrides an autonomous longitudinal dynamics signal. A safety control element (03) is arranged on the joystick, wherein the safety control element (03) generates a release signal and / or a longitudinal dynamics signal depending on its actuation by the safety driver.In a first actuation area of ​​the safety control element (03), the enable signal is generated to allow the control unit to process the steering intervention signal. The steering intervention signal is not considered by the control unit if no enable signal is generated. In a second actuation area of ​​the safety control element (03), the enable signal and the longitudinal dynamics signal are also generated to allow the control unit to process the longitudinal dynamics intervention signal in order to maintain or reduce the vehicle's speed. The invention further relates to the use of a joystick, operated by a safety driver and equipped with at least one safety control element (03). The invention also relates to a vehicle with a safety control device.

Description

[0001] The present invention relates to a safety control device in an autonomous vehicle or a vehicle with a driver assistance system. The invention further relates to the use of a joystick, equipped with at least one button and operable by a safety driver or user, in an autonomous vehicle or a vehicle with a driver assistance system. The invention further relates to an autonomous vehicle with a safety control device.

[0002] Such a safety control device can be used, for example, during a test phase of an autonomous vehicle in public traffic. In this context, the term "safety driver" is established for a user riding in the vehicle whose task is to take over driving in the event of a malfunction of the automation function. Another application for the safety control device is series production in vehicles with driver assistance systems, where the user temporarily acts as a safety driver. Hereafter, the term "safety driver" will be used abstractly, even if this person is riding along as a regular user in production vehicles.

[0003] It is known that joysticks are used as a control element in agricultural machinery or self-propelled work machines, which the user employs during operation, particularly for steering. Joysticks are also integrated into vehicles such as cars or trucks for people with physical disabilities, enabling a person to control the vehicle using a joystick, which serves as a permanent control element. In these applications, the joystick is permanently active and directly affects the vehicle's functions. Assistance systems that allow the driver to relinquish control, even temporarily, are deactivated. It is not intended that a driver or safety driver suddenly take over control of the vehicle using a joystick.It is also known that the vehicles mentioned have one or two joysticks for lateral control, i.e. for steering, and / or for longitudinal control, i.e. for acceleration or braking.

[0004] Joysticks (also called sidesticks) can have various designs, which may include the following features: - 1-axis or 2-axis deflection possible; Force- or displacement-based sensors are used; - Feedback is provided by specifying the position using the installed actuators; - Feedback is provided by force application, which can be passive (e.g. spring, damper) or active (actuators with or without gear ratio, variable brake, magnetic); - Design as a finger or hand joystick.

[0005] For a joystick with two axes of deflection, a right / left movement of the joystick can be defined for lateral control, i.e., steering the vehicle, and a forward / backward movement of the joystick can be defined for longitudinal control, i.e., accelerating or braking the vehicle. A two-axis joystick is unsuitable for safety applications because, in the event of a sudden operator takeover from autonomous driving mode in a critical driving situation, the targeted controllability of steering or braking intervention is insufficient.

[0006] For automated vehicles, also known as autonomous vehicles, a safety driver is present, particularly during test drives, to intervene in hazardous situations. Intervention in the generally autonomous control system is currently typically achieved via an input device, such as an emergency stop button, which initiates braking when activated. Intervention in the vehicle's steering function is not intended. If a steering function is to be integrated, functional safety requirements must be met, and an additional input device is necessary. This input device could be a steering wheel, where the steering wheel angle correlates with the wheel steering angle. While a steering wheel is intuitive for a safety driver to operate, as it closely resembles the conventional steering of a non-autonomous vehicle, it has the following disadvantages: Intervention by a safety driver in rotating components can be dangerous.The system must detect the intervention of the safety driver and immediately deactivate automation functions. Deactivation of the autonomous control system by accidental manual intervention must be prevented. This can be achieved, for example, through capacitive hands-on detection. At least during the testing phase of automated vehicles, an input device in the vehicle and the presence of a safety driver are required. This necessitates a permissible operating concept for the safety driver's workstation. The same applies to a vehicle with an assistance system in which an operator or safety driver is present.

[0007] GB 2 580 861 A discloses a system for reducing risks when transferring safety-critical driving decisions from the artificial intelligence of an autonomous vehicle to a human driver. The system comprises at least a display screen, a camera that captures image data of the road ahead, a computer keyboard, and a steering wheel or other steering device, such as a joystick or touchscreen. A driver, who is passive under normal operating conditions, receives information via the display screen. In a hazardous situation involving the autonomously controlled vehicle, a real-time image of the road ahead is displayed on the screen, and the human driver takes over control of the vehicle.

[0008] German patent DE 10 2020 116 487 A1 describes a steer-by-wire steering system for a vehicle, in particular for an all-wheel-drive vehicle. The steering system includes a joystick through which a steering torque can be transmitted to a wheel-selective drive of the vehicle. Torque distribution via the wheel-selective drive is achieved by rotating the joystick around its vertical axis. Driver input by rotating the joystick generates a signal that is detected by a control unit, which determines a target torque for the wheel-selective drive depending on the current driving situation.

[0009] US Patent 11,106,200 B2 discloses a method and a device that improve the operational reliability of a vehicle remote control system. The method involves receiving a control output from the controller of an autonomous vehicle. Furthermore, the method determines, based on this control output, whether the first switch of the controller is activated. It also determines whether a second or subsequent switches are activated. A vehicle control command for controlling the autonomous vehicle is then executed or ignored depending on the switch positions. Thus, the autonomous vehicle can be manually controlled based on the switch positions and activation status.

[0010] DE 10 2021 117 307 A1 describes a method for a steer-by-wire system that enables the adjustment of the steering wheel angle when the vehicle control transitions from automated to manual driving. During automated driving, the steering wheel is passive, i.e., it does not rotate and may be folded in and inaccessible. In a normal takeover situation, the steering wheel angle is first synchronized with the wheel steering angle, and then the transition to manual driving occurs. In an unusual takeover situation, e.g., if the driver's hands are on the steering wheel or if steering wheel synchronization fails, the transition to manual driving occurs without synchronization. Hands-on detection is used to recognize this situation. In this context, the transition from automated to manual driving is requested in advance.The hands-on detection system is used to identify an unusual takeover situation caused by the intervention of the safety driver during the situation.

[0011] DE 10 2016 204 343 A1 describes the location of a pressure sensor in a steering wheel rim. The sensor signal is used to detect a driver's intervention in the steering wheel and thereby initiate the deactivation of an assistance system.

[0012] German patent application DE 10 2024 120 299.8, which was not yet published on the filing date, describes a safety steering device for use in an autonomous vehicle or a vehicle with an assistance system. The safety steering device comprises a control unit and a joystick, operated by the safety driver, as an input device. A steering signal can be transmitted from the joystick to the control unit. Furthermore, the joystick has a safety control element. When activated by the safety driver, this element generates a release signal to enable the control unit to process the steering intervention signal. If no release signal is generated, the steering intervention signal is not processed by the control unit.

[0013] Safety drivers or operators, also generally referred to as drivers, of an autonomous vehicle or a vehicle with a driver assistance system (hereinafter referred to as "vehicle") must be able to brake the vehicle to a complete stop, if necessary, in a hazardous situation. To achieve a safe state or bring the vehicle to a standstill, an autonomous vehicle will initiate emergency braking. Emergency braking can also be initiated by a safety driver or operator. In both cases, emergency braking results in the strongest possible, i.e., abrupt, full braking, bringing the vehicle to a complete stop. Particularly when there are occupants in the autonomous vehicle, for example, in a shuttle vehicle with a safety driver, a balance must be struck between full braking and safe braking—that is, between protecting objects, pedestrians, etc., in front of the vehicle on the one hand, and the potential danger to the occupants posed by the safety driver on the other.A sudden stop can also endanger following traffic.

[0014] One object of the present invention, starting from the prior art, is to provide a safety control device in an autonomous vehicle or a vehicle with a driver assistance system that allows for lateral and longitudinal control of the vehicle. A further object is to provide an autonomous vehicle with a safety control device for manual intervention by a user or safety driver. Finally, an object is to describe a novel use of a joystick for safety control in the lateral and longitudinal control of an autonomous vehicle. In particular, the invention is intended to also be effective in critical driving situations, e.g.,In the event of an impending collision, the safety driver should be able to immediately intervene in the steering and speed, as well as switch to manual driving, without requiring any synchronization time for adjusting a steering wheel or using other controls, such as foot pedals.

[0015] The aforementioned problem is solved by a safety control device according to the attached claim 1, a use of a joystick according to claim 9, and by an autonomous vehicle with a safety control device according to the dependent claim 10.

[0016] The safety control device according to the invention is integrated into a (partially) autonomous vehicle or a vehicle with an assistance system. It allows for manual intervention by a safety driver or an operator, both of whom can also be referred to as drivers. A safety driver is defined as someone who is passively present in the vehicle during normal, i.e., autonomous, driving operation and only intervenes in the vehicle's control when necessary for safety reasons or to manually correct the autonomous control. Hereinafter, the term "safety driver" is to be understood as synonymous with the terms "operator" and "driver." The safety control device comprises a control unit. The control unit, parts thereof, or a higher-level control unit provides, in autonomous or semi-autonomous driving mode, a control signal.In automated driving mode, the system provides an autonomous steering signal and an autonomous longitudinal dynamics signal, which can be, in particular, a speed signal, an acceleration signal, or a control signal for influencing a drive or braking force. Specifically, the steering signal is to be delivered to the steering system of the steered axle or the individual wheel steering of the autonomous vehicle. The longitudinal dynamics signal is to be delivered to one or more motors and / or brake units of the autonomous vehicle. Furthermore, the safety control device includes a joystick, operable by the safety driver, as an input device.Signals, in particular a steering intervention signal and a longitudinal dynamics intervention signal, can be transmitted from the joystick to the control unit, wherein the steering intervention signal overrides the autonomous steering signal to give priority to manual control, and wherein the longitudinal dynamics intervention signal overrides the autonomous longitudinal dynamics signal to give priority to manual control of the vehicle speed. Preferably, the vehicle speed should be individually reduced by manual control of the vehicle speed.

[0017] A joystick has the advantage of being a space-saving input device. It is also advantageous because it is flexible and can be removed or easily stowed away after test drives or when the autonomous vehicle is operating fully automatically, thus preventing unauthorized access by passengers. Furthermore, a joystick has the advantage of being intuitive to use.

[0018] Furthermore, the safety control device includes a safety control element located on the joystick. When the safety driver activates the safety control element, it generates a release signal to enable the transmission of the steering intervention signal and / or the speed intervention to the control unit, or the processing of the steering intervention signal and / or the longitudinal dynamics intervention signal by the control unit. The steering intervention signal is not effectively transmitted to the control unit, nor is it considered relevant by the control unit, if no release signal is generated, i.e., if the safety control element is not actuated by the safety driver. To generate the respective signals, the defined actuation path of the safety control element is divided into at least two actuation ranges, which are activated by the safety driver's action.Activation occurs via the force applied by the safety driver's hand to the joystick and, in particular, the safety control element. In a first actuation range, the enable signal is generated to allow the control unit to process the steering intervention signal. This first actuation range is preferably continuously variable and offers low resistance, requiring only minimal force from the safety driver. When the safety control element is in the first actuation range and an enable signal is generated, the safety driver can steer the vehicle (lateral control).As long as the safety control element is in the first operating range, either no intervention in the longitudinal guidance is possible, or a neutral dynamics signal is generated, which overrides the autonomous longitudinal dynamics signal and, for example, leads to an automatic, moderate deceleration of the vehicle speed. In a second operating range of the safety control element, the enable signal is generated, as well as the longitudinal dynamics intervention signal, allowing the safety driver to control and maintain or reduce the vehicle's speed (longitudinal guidance). Thus, the safety control device with the safety control element on the joystick advantageously allows the safety driver to control the vehicle in both lateral and longitudinal directions only after activating the single safety control element, thereby preventing accidental intervention.Furthermore, it ensures operational safety in the event of sudden intervention, especially in dangerous situations.

[0019] A further advantage is that the joystick allows the safety driver to control both the lateral and longitudinal aspects of the vehicle without the need for any additional controls. This combined intervention in steering and braking is performed with just one hand, eliminating the need to simultaneously grasp two different controls. The design according to the invention advantageously separates the two functions, namely lateral and longitudinal control, while allowing them to be performed with one hand. The joystick has only one degree of freedom, whereby the movement of the entire hand to the right or left allows for the precise setting of an angle, guided by the single degree of freedom of the joystick deflection. Furthermore, the movement of the fingers or...Closing the hand with a specific operating force leads to the deceleration of the vehicle, thus initiating a controlled reduction in speed or an emergency braking maneuver.

[0020] For the vehicle's safety driver to intervene, an input from an automation function, such as the Self-Driving System (SDS), must be overridden by the safety driver's input at the control unit. First, the automation function, i.e., the autonomous steering signal, is overridden by activating the safety element in the first operating range and generating the release signal, thus enabling the steering intervention signal. The same applies to the autonomous longitudinal dynamics signal, which is enabled by activating the safety element in the second operating range and simultaneously generating the release signal, thus enabling the longitudinal dynamics intervention signal and overriding the automation function.This allows a safety driver to advantageously take over the control of the autonomous vehicle, especially the steering and speed control, in hazardous situations.

[0021] In the simplest case, the vehicle continues to process the speed signal from the SDS when the safety element is activated in the first operating range. However, in many practical situations, when manually intervening in the autonomous lateral control, the longitudinal control of the SDS should also be deactivated, especially if it can be assumed that the vehicle's automation function has misinterpreted or failed to interpret relevant environmental objects. Therefore, in all cases, the release signal is generated in both the first and second operating ranges when the safety element is activated. In the first operating range, the steering angle is also specified by the steering input signal (from the joystick). In a preferred embodiment, the autonomous longitudinal dynamics signal is overwritten by a neutral dynamics signal as soon as the safety element is activated in the first operating range.This neutral dynamics signal can, for example, maintain the current speed or the current deceleration. Likewise, the neutral dynamics signal can lead to a moderate deceleration of the vehicle (similar to what you experience when you don't press the accelerator pedal but also don't brake in manual mode).

[0022] The safety control device has the further advantage of preventing unintentional operation of the joystick by mere touch, and thus a hazard caused by unintentional deactivation of the automation function. This is because the activation of the safety control element by the safety driver, and thus the generation of the enable signal for transmitting the steering intervention signal and / or the longitudinal dynamics intervention signal, is what deactivates the automation function. For example, the safety driver can, anticipating a driving situation in which manual intervention appears necessary, already take hold of the joystick to be prepared to assume manual control, i.e., steering and / or speed control, but only activate it when the hazardous situation actually occurs by activating the safety control element located on the joystick.Thus, the safety control device according to the invention represents an intuitively operable and safe input device.

[0023] Preferably, the safety control element is a button located on the joystick, which is operated by the safety driver. Particularly preferably, the button is located on a front side of the joystick that is accessible to the safety driver with several fingers when the joystick is held in their hand for operation.

[0024] A sensor is preferably arranged on the safety control element to detect actuation and thus activation of the safety control element. The sensor can be, for example, a displacement, force, or angle sensor, or a capacitive or inductive sensor that detects the displacement, force, or angle of rotation by which the safety control element is deflected. Alternatively, the sensor is a switch that measures the current state (activated / deactivated) and changes the signal at certain deflection positions of the safety control element. In another embodiment, the force with which the safety control element presses against a spring or an end stop is measured.

[0025] This makes it possible, for example, to generate the release signal when there is a particularly strong or powerful deflection of the joystick, without the safety driver having to press a separate button.

[0026] The sensor located on the safety control element allows the actuation path to be divided into several sections. Actuation in a first section generates a release signal and a steering intervention signal through rotation or tilting of the joystick. This enables the control unit to process the steering intervention signal, allowing a safety driver to steer the vehicle. The safety driver applies a small force to the safety control element, particularly in the form of a push button, whereby a first section of the actuation path is traversed by the safety control element or a defined force is applied to the safety control element. In addition to the release signal and the steering intervention signal, a preferred embodiment may define that the vehicle speed is maintained or that the vehicle coasts.When the release signal is triggered, a neutral signal is generated, which overrides or superimposes the autonomous longitudinal dynamics signal. If a second range of motion is traversed by the safety control element, or if a greater deflection is applied to the safety control element (detected by the sensor), the release signal remains active, and the autonomous steering signal continues to be overridden by the steering intervention signal. Furthermore, in the second range of motion, the longitudinal dynamics intervention signal is generated and its processing by the control unit is enabled, allowing the safety driver to manually determine the vehicle's speed, preferably to maintain or reduce it. In the second range of motion, the safety driver must overcome a noticeably higher resistance at the safety control element.For example, the increased resistance can be achieved by a second spring arranged on the safety control element, which preferably becomes active after the first actuation range has been traversed. The length traversed through the second actuation range, or the increasing actuation force, determines the intensity of the desired vehicle speed reduction or deceleration.

[0027] Vehicle deceleration can be achieved through recuperation torque from an electric drive system and / or braking force from the braking system. The desired deceleration or negative acceleration of the vehicle can be controlled via the vehicle dynamics control system by specifying the recuperation torques and / or braking forces. Preferably, the control system can be continuously variable, with the desired deceleration determined from a characteristic curve based on the measured distance or force. Alternatively, the safety control element can have defined detents that are passed through when activated. This allows for predefined stages to be set instead of continuously variable deceleration. Possible stage settings include, for example: coasting, medium service braking, maximum service braking, and full braking. In one embodiment, an additional stage can be provided that activates hill start assist when the vehicle is stationary.

[0028] A preferred embodiment of the joystick provides for the addition of a second control element. This second control element allows the safety driver to restart or accelerate the vehicle, either immediately or after prior braking. The second control element generates a positive acceleration signal, enabling the control unit to process an acceleration intervention signal, thus allowing the safety driver to set a desired acceleration or target speed. Preferably, the second control element is positioned on the joystick so that it is touched by the safety driver's thumb when the joystick is grasped. In particular, the additional control element can be located on a joystick surface opposite the joystick's mounting surface.The actuation path of the additional control element is preferably detected by means of an additional sensor arranged on the additional control element and converted into a speed or acceleration command. If the command is a longitudinal dynamics intervention signal, the additional control element must therefore be held at a constant point to maintain a constant speed. If the command is an acceleration signal, the vehicle maintains a constant speed when the additional control element is released. The additional control element can be another push button. The second control element can also be used for direct acceleration, i.e., without prior braking.

[0029] In one embodiment, the safety control device includes a third control element for enabling automated driving. This requires input from the safety driver confirming that the vehicle can start the automated driving function. This is only possible if the system signals its readiness, for example, via a display or a status LED. The safety driver can grant this authorization using the third control element. Preferably, the third control element is located on the joystick. Alternatively, the authorization for automated driving can be integrated into the second control element, for example, by providing a second degree of freedom for the second control element (horizontal movement) when it is in its neutral position.

[0030] Preferably, the activation of the enable signal for releasing the intervention signals occurs only after a predetermined delay time. The activation time is, for example, one second, particularly preferably less than one second; in particular, the activation time is 0.5 s.

[0031] In the control unit, the joystick angle input is only used to override the automatic steering signal, and the longitudinal dynamics intervention signal is only used to override the automatic longitudinal dynamics signal, if the activation of the safety control element detects a request for manual intervention. If the safety control element is activated for longer than a predetermined time (<1 s, preferably approximately 0.5 s), then, according to a preferred embodiment, the manual input on the joystick continues to be used; that is, the respective signal overrides the corresponding autonomous signal, even if the safety control element is no longer pressed, until the safety driver manually reactivates the autonomous driving mode. If the safety control element is activated for a shorter time than the predetermined time, the system switches back to autonomous driving mode after deactivation.

[0032] The safety control element preferably extends over a section of the joystick's grip surface. Preferably, the grip surface is located in an area of ​​the joystick where at least one finger of the safety driver rests. Particularly preferably, the grip surface is located in an area of ​​the joystick where at least three fingers of the safety driver rest. Alternatively, and more preferably, the safety control element extends over the entire length of the joystick's grip surface.

[0033] Preferably, the joystick comprises a base and a handle arranged thereon, wherein the safety control element is arranged on the handle, in particular on a surface of the handle.

[0034] The safety control element is preferably rotatably mounted on the joystick at its upper end. Alternatively, the safety control element is rotatably mounted on the joystick at its lower end. The axis of rotation of the safety control element, about which it can be tilted for actuation, is located in the area of ​​its rotatable mounting.

[0035] Alternatively, the safety control element can be moved linearly for actuation, using, for example, a spring to return the safety control element to a zero position.

[0036] Preferably, the sensors used in the safety control element and their connection to the control unit are designed redundantly, ensuring system fail-safe operation. Alternative fail-safe measures are conceivable. The control unit can be referred to as a steering control unit or vehicle control unit.

[0037] The invention also relates to the use of a joystick, equipped with at least one button and operable by the safety driver, in an autonomous vehicle or a vehicle with an assistance system, comprising the control unit, which preferably provides an autonomous control signal in an autonomous driving mode, which may be, inter alia, a steering signal and / or a longitudinal dynamics signal. The button arranged on the joystick is used as a safety control element, wherein, when activated by the safety driver, the safety control element generates a release signal to enable the transmission of a steering intervention signal supplied by the joystick to the control unit, wherein the steering intervention signal overrides the autonomous steering signal, and wherein the steering intervention signal is not transmitted to or processed by the control unit if no release signal is generated.The steering intervention signal is transmitted to the control unit in the first actuation range of the safety control element. If a higher force than required to traverse the first actuation range is applied to the safety control element, or if the safety driver moves the safety control element further, shifting it into a second actuation range, an autonomous longitudinal dynamics signal is overridden by a longitudinal dynamics intervention signal, which is transmitted to the control unit. The first and second actuation ranges of the safety control element are definable and can, for example, be detected as displacement or force by a sensor mounted on the safety control element.

[0038] The invention further relates to an autonomous vehicle and a vehicle with an assistance system with a safety control device for manual intervention by a safety driver who monitors the autonomous driving operation, wherein the safety control device corresponds to the safety control device described above and one or more of the described embodiments apply.

[0039] The autonomous vehicle or the vehicle with an assistance system and a safety control device can be a shuttle for autonomous passenger transport.

[0040] Further advantages, details and modifications of the invention will become apparent from the following description of a preferred embodiment, with reference to the drawing.

[0041] The single figure shows a perspective view of a joystick according to the invention which is part of a safety control device and / or is intended for use by a safety driver in an autonomous vehicle or a vehicle with an assistance system.

[0042] The joystick comprises a base 01 and a handle 02 movably mounted thereon. The handle 02 of the joystick can be tilted at least laterally to the right and left, starting from its attachment point on the base 01. In modified embodiments, the handle 02 can also be tilted to a forward and a backward position. Alternatively, the handle 02 of the joystick can be rotated about its attachment point on the base 01.

[0043] A safety control element 03, in particular a push button, is arranged on one side of the handle 02, preferably on the front side (in the direction of travel of the vehicle). The push button 03 is located in the area of ​​a gripping surface of the safety driver on the handle 02 of the joystick, where the safety driver's fingers preferably rest during its use. The push button 03 extends over the entire length of the gripping surface, which lies along a longitudinal extension of the handle 02, so that the push button 03 can be actuated across the entire width of the safety driver's hand. When the safety driver activates the push button 03 arranged on the handle 02, a signal is generated. The activation of the push button 03 is preferably detected by a sensor arranged on the push button 03 (not shown).The force acting on button 03 or the distance traveled by button 03 is determined by the sensor, whereby the signal is divided into at least two actuation ranges. In a first actuation range, a release signal and a steering intervention signal are generated, the release signal serving to enable the transmission of the steering intervention signal supplied by the joystick, which is generated by the lateral deflection of the joystick into at least one of its lateral positions, to a control unit of the safety control device, whereby the steering intervention signal overrides the autonomous steering signal. If no release signal is generated, the steering intervention signal is not transmitted to the control unit or processed by it. In a second actuation range of button 03, which adjoins the first actuation range, in addition to the release signal, and if applicable,In addition to the steering intervention signal, a longitudinal dynamics intervention signal is also generated, which is transmitted to the control unit and overrides an autonomous longitudinal dynamics signal.

[0044] The steering intervention signal is determined, for example, from an input angle measured by sensors (not shown). A sensor (not shown) is preferably integrated into button 03 to generate the enable signal. Thus, the steering intervention signal is only transmitted to the control unit when button 03 is pressed and the joystick handle 02 is simultaneously tilted or rotated. In this case, the control unit overrides an autonomous steering signal with the steering intervention signal. This can be described as an override function. If the joystick handle 02 is accidentally tilted or rotated without the safety driver pressing button 03, the autonomous steering signal is not overridden, and no unintentional intervention in vehicle control occurs. Therefore, this joystick advantageously contributes to vehicle safety by preventing incorrect operation.This guarantees, on the one hand, an immediate response from the vehicle to any intended intervention, and on the other hand, prevents operator error, as the automated driving function remains active even without activating the safety control. Similarly, even a very brief activation can be classified as an operator error, and after a short interruption, the autonomous driving mode is resumed without any significant deviation from the intended driving path occurring in the meantime.

[0045] These advantages also apply to the longitudinal dynamics intervention signal. Only when button 03 is pressed, thus moving it into the second actuation range, is the longitudinal dynamics intervention signal transmitted to and processed by the control unit. Dividing the actuation range of button 03 into two actuation ranges offers the advantage of maintaining operational safety while simultaneously enabling targeted control of driving and braking in critical driving situations through the combined solution of lateral and longitudinal guidance by a single hand of the safety driver. Furthermore, the option remains to activate a neutral dynamics signal when the enable signal is present and the safety control element remains in the first actuation range. This neutral dynamics signal overrides the autonomous longitudinal dynamics signal and, for example, moderately decelerates the vehicle or allows it to coast to a stop.A second control element, requiring the other hand for operation, is not necessary, although permissible. Similarly, foot pedals for acceleration and braking functions are not required, although they could be optionally provided. The design of button 03 allows the safety driver to initiate a defined vehicle deceleration depending on the situation.

[0046] The figure further shows a second key element 04, or a second button, arranged on the handle 02 of the joystick. The second key element 04 is attached to the handle 02 at the opposite end of the base 01. The second key element 04 serves to issue an acceleration command or a starting command, which, when activated, is detected by another sensor arranged on the second key element 04 and transmitted to the control unit. The position of the second key element 04 is chosen so that the safety driver can operate it with their thumb. Reference symbol list 01 foot 02 Handle 03 Button / Safety control element 04 second button QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] GB 2 580 861 A

[0007] DE 10 2020 116 487 A1

[0008] US 11 106 200 B2

[0009] DE 10 2021 117 307 A1

[0010] DE 10 2016 204 343 A1

[0011] DE 10 2024 120 299.8

[0012]

Claims

Safety control device for manual control intervention by a safety driver in an autonomous vehicle or a vehicle with an assistance system, comprising a control unit and a joystick operable by the safety driver, from which a steering intervention signal and a longitudinal dynamics intervention signal can be transmitted to the control unit, wherein the steering intervention signal overrides an autonomous steering signal and the longitudinal dynamics intervention signal overrides an autonomous longitudinal dynamics signal, characterized in that a safety control element (03) is arranged on the joystick, wherein the safety control element (03) generates a release signal and / or the longitudinal dynamics intervention signal depending on the actuation by the safety driver, wherein in a first actuation area of ​​the safety control element (03) the release signal is generated to enable the processing of the steering intervention signal by the control unit.wherein the steering intervention signal is not taken into account by the control unit if no release signal is generated, and wherein in a second actuation area of ​​the safety control element (03) the release signal and the longitudinal dynamics intervention signal continue to be generated in order to enable the processing of the longitudinal dynamics intervention signal by the control unit in order to manually maintain or reduce the speed of the vehicle. Safety control device according to claim 1, characterized in that, when generating the release signal at the control unit, it activates a neutral dynamics signal which overrides the autonomous longitudinal dynamics signal in order to automatically maintain or reduce the speed of the vehicle as long as the safety control element (03) is in the first actuation range. Safety control device according to claim 1 or 2, characterized in that the safety control element is a button (03) to be actuated by the safety driver. Safety control device according to one of claims 1 to 3, characterized in that the safety control element (03) comprises a sensor which detects a deflection and / or actuation of the safety control element (03), wherein the sensor is in particular a force sensor or a displacement sensor. Safety control device according to one of claims 1 to 4, characterized in that the safety control element (03) extends over a section or over the entire length of the grip surface (02) of the joystick. Safety control device according to one of claims 1 to 5, characterized in that the actuation of the safety control element (03) in the first actuation area and / or in the second actuation area is detected steplessly or via tactilely detectable detents. Safety control device according to one of claims 1 to 6, characterized in that maximum braking effect of the autonomous vehicle or the vehicle with assistance system is generated when the safety control element (03) is actuated to the maximum extent. Safety control device according to one of claims 1 to 7, characterized in that a further button (04) is provided on the joystick, which serves for acceleration control for starting or accelerating the autonomous vehicle or the vehicle with assistance system by the safety driver. Use of a joystick, equipped with at least one button and operable by a safety driver, in an autonomous vehicle or a vehicle with an assistance system, comprising a control unit, characterized in that the button arranged on the joystick is configured as a safety control element (03), wherein the safety control element (03), when activated by the safety driver, generates a release signal to enable the transmission of a steering intervention signal and / or longitudinal dynamics intervention signal supplied by the joystick to the control unit, wherein the steering intervention signal overrides the autonomous steering signal, wherein the longitudinal dynamics intervention signal overrides the autonomous longitudinal dynamics signal, wherein the steering intervention signal and / or the longitudinal dynamics intervention signal are not transmitted to or processed by the control unit if no release signal is generated. Autonomous vehicle or vehicle with assistance system with a safety control device for manual intervention by a safety driver or operator, characterized in that the safety control device is designed according to one of claims 1 to 8.

Images