Arrangement for executing at least one safety-critical driving function in a vehicle

Abstract

Arrangement (10) for executing at least one safety-critical driving function (11) with an ASIL classification D in a vehicle (1) with an SAE level greater than or equal to three, with an automated function module (12), a manual actuating means (14), at least one actuator (18) and at least one evaluation and control unit (16), which is designed to receive and evaluate input signals from the automated function module (12) or from the manual actuating means (14) and, depending on the evaluation, to control the at least one actuator (18) for executing the safety-critical driving function (11), wherein the automated function module (12) has an ASIL classification D with regard to integrity and availability and is designed,To generate input signals for executing the safety-critical driving function (11) with an availability of more than 90% for the applications of the safety-critical driving function (11) and to output them to the at least one evaluation and control unit (16), wherein the manual actuating means (14) has an ASIL classification with regard to integrity and / or availability which is below the ASIL classification D of the automated function module (12), and is designed to generate the input signals for executing the safety-critical driving function (11) and to output them to the at least one evaluation and control unit (16) in the event of failure of the automated function module (12).

Description

[0001] The invention relates to an arrangement for executing at least one safety-critical driving function having an ASIL classification D in a vehicle having an SAE level greater than or equal to three.

[0002] A vehicle with SAE Level 3 can perform certain driving tasks independently and without human intervention in an "automated mode." This means that the driver does not have to constantly monitor the automated mode, and the vehicle performs functions such as activating the turn signal, changing lanes, and keeping in lane independently. The driver can attend to other things but will be prompted by the system to take over control within a pre-warning period if necessary. In a vehicle with SAE Level 4, in a "highly automated autonomous mode," the executive system can permanently take over control of the vehicle. If the executive system can no longer handle the driving tasks, the driver can be prompted to take over. In a vehicle with SAE Level 5, in a "fully automated autonomous mode," a driver is no longer required.Other than setting the destination and starting the system, no human intervention is required. The vehicle operates without a steering wheel or pedals.

[0003] The ASIL classification (ASIL: Automotive Safety Integrity Level) for electronic components in the automotive industry is specified by the International Organization for Standardization (ISO) in the ISO26262 standard. The ASIL classification is composed of "Severity S," which refers to the severity of an accident and the hazard to the user and / or the environment caused by a failure; "Exposure E," which refers to the frequency of occurrence of a specific driving situation; and "Controllability C," which refers to the controllability of the vehicle in the event of a malfunction. Severity S0 refers to no injuries; Severity S1 refers to minor to moderate injuries; Severity S2 refers to severe injuries with a high chance of survival; and Severity S3 refers to very severe injuries with a low chance of survival.The factor “Exposure E” is differentiated according to the duration of the occurrence of the driving situation and the frequency of its occurrence. An Exposure E1 refers to a rare occurrence of the driving situation, an Exposure E2 refers to an occasional occurrence of the driving situation, an Exposure E3 refers to a frequent occurrence of the driving situation, and an Exposure E4 refers to a constant occurrence of the driving situation. Here, a Controllability C0 refers to a safe control of the error situation, i.e. all drivers can control the error situation, a Controllability C1 refers to easy control, i.e. more than 99% of drivers can control the error situation, a Controllability C2 refers to normal control of the error situation, i.e. more than 90% of drivers can control the error situation, and a Controllability C3 refers to a difficult control of the error situation, i.e.less than 90% of drivers can control the driving situation.

[0004] DE 10 2021 106 575 A1 discloses a vehicle with a highly automated driving function that provides a vehicle response to an anomaly condition during autonomous driving. A computer is programmed to operate the vehicle completely or to a lesser extent independently of the intervention of a human driver. The computer can be programmed to operate a drive, a steering system, a braking system, and / or other vehicle systems at least partially based on data received from sensors. The drive, the steering system, and / or the braking system each comprise an electronic control unit that communicates with and receives inputs from the computer and / or the driver. The driver can control the drive, for example, via an accelerator pedal and / or a gearshift lever. The driver can control the steering system, for example, via a steering wheel.The driver can control the braking system using a brake pedal, for example.

[0005] DE 10 2017 213 572 A1 discloses a system for determining a takeover of a vehicle from a highly automated driving mode, i.e., a driving mode for driving according to SAE Level 3. The system comprises an operating element for highly automated driving, e.g., a button, with which a driver of the vehicle can indicate a takeover, e.g., a change to and / or termination of the highly automated driving mode. The operating element can transmit a takeover signal to a safety-relevant software component. The system can further comprise a steering wheel, which can transmit a steering torque signal and / or a hands-on-steering-wheel signal to the safety-relevant software component. The system further comprises a brake pedal and an accelerator pedal. The brake pedal can transmit a brake signal to the safety-relevant software component, and the accelerator pedal can transmit an accelerator signal to the safety-relevant component.The signals from the control element, the steering wheel, and / or the brake and accelerator pedals are unambiguous. Furthermore, the signals from the control element, the steering wheel, and / or the brake and accelerator pedals are characterized by a high degree of reliability. In other words, the signals from the control element, the steering wheel, and / or the brake and accelerator pedals can be detected by appropriate sensors with a high degree of reliability and transmitted to the safety-relevant software component. The functional safety load preferably lies on the signals from the control element, the steering wheel, and / or the brake and accelerator pedals. The safety-relevant software component is preferably a component that meets ASIL classification D.The safety-relevant software component can receive the signals from the control element, the steering wheel and / or the brake and / or accelerator pedal and link them with an OR operator to determine whether a takeover control action by the driver has occurred.

[0006] Furthermore, DE 10 2022 120 237 A1 discloses a system and a method for operating a driving function for assisted or automated maneuvering of a vehicle, wherein at least partially automated vehicle guidance based on stored trajectory data is permitted when a certain level of driver attention is reached, wherein the driver attention is determined via the actuation of a brake pedal.

[0007] Furthermore, US 2022 / 0 135 075 A1 discloses a safety architecture for autonomous machine applications that uses two or more independent safety assessments to meet a higher safety integrity level.

[0008] DE 10 2022 110 952 A1 further relates to a drive system for a vehicle, comprising an accelerator pedal with an associated accelerator pedal control unit that performs a driving task when the driver actuates the accelerator pedal. The accelerator pedal control unit, acting as a transmitter control unit, is connected to an assistance control unit, acting as a receiver control unit, which performs a driver-independent, automated driving task. Special signal processing allows the safety integrity of the accelerator pedal control unit to be reduced. At the same time, however, the accelerator pedal and the assistance control unit must meet higher safety integrity requirements in this case.

[0009] Furthermore, DE 10 2023 200 871 A1 discloses a method for providing a fallback function for a safety-relevant driving function for automated driving. A safety-critical state is detected based on monitoring a functional chain for providing the safety-relevant driving function, and a residual capability of the functional chain is determined. The fallback function is initiated based on the detection and the determined residual capability. The integrity requirements for the fallback function can be lower than for the operational function itself, since the fallback function is rarely executed and, when it is executed, only needs to be executed for a short period of time. Disclosure of the invention

[0010] The arrangement for executing at least one safety-critical driving function with an ASIL classification D in a vehicle with the features of independent patent claim 1 has the advantage that the high availability of the automated function module allows the operating time of the manual actuation device and thus also the ASIL classification of the manual actuation device to be reduced. This allows sensors for detecting the actuation and / or the degree of actuation of the manual actuation device to be reduced, thus enabling a cost-effective development process for the manual actuation device.

[0011] Embodiments of the present invention provide an arrangement for executing at least one safety-critical driving function with an ASIL classification D in a vehicle with an SAE level greater than or equal to three, which arrangement comprises an automated function module, a manual actuating means, at least one actuator and at least one evaluation and control unit which is designed to receive and evaluate input signals from the automated function module or from the manual actuating means and to control the at least one actuator depending on the evaluation for executing the safety-critical driving function.The automated functional module has an ASIL classification D with regard to integrity and availability and is designed to generate input signals for executing the safety-critical driving function with an availability of more than 90% for the applications of the safety-critical driving function and to output them to the at least one evaluation and control unit. The manual actuating means has an ASIL classification D with regard to integrity and / or availability, which is lower than the ASIL classification D of the automated functional module and is designed to generate the input signals for executing the safety-critical driving function in the event of failure of the automated functional module and to output them to the at least one evaluation and control unit.

[0012] A hazard analysis shows that an actuating device, for example, can be rated with an ASIL classification C if the automated function module is available sufficiently frequently so that the exposure E for using the manual actuating device is less than or equal to E3. With exposure E equal to E1, the manual actuating device is used less than once a year. With exposure E equal to E2, the usage time is less than 1% of the total usage time of the vehicle and the manual actuating device is used between 1 and 9 times a year. With exposure E equal to E3, the usage time is in the range between 1% and 10% of the total usage time of the vehicle and the pedal is used between 10 and 100 times a year. With exposure E equal to E4, the usage time is more than 10% of the total usage time of the vehicle and the pedal is used more than 100 times a year.

[0013] In embodiments of the arrangement according to the invention, the safety-critical driving function with ASIL classification D can correspond, for example, to a braking function and / or an acceleration function and / or a steering function. For this purpose, the manual actuation means can be, for example, a brake pedal, an accelerator pedal, or a steering wheel. Thus, it is possible, for example, to provide embodiments of the arrangement according to the invention for multiple safety-critical driving functions or only for certain selected safety-critical driving functions in the vehicle. Of course, embodiments of the arrangement according to the invention can also be used for only one safety-critical driving function in the vehicle.

[0014] In this case, the evaluation and control unit can be understood to be an electrical device, such as a control unit, in particular a brake control unit or an engine control unit or steering control unit, which processes or evaluates detected sensor signals. The evaluation and control unit can have at least one interface, which can be hardware- and / or software-based. In a hardware-based design, the interfaces can, for example, be part of a so-called system ASIC, which contains a wide variety of functions of the evaluation and control unit. However, it is also possible for the interfaces to be separate integrated circuits or to consist at least partially of discrete components. In a software-based design, the interfaces can be software modules, which are present, for example, on a microcontroller alongside other software modules.Also advantageous is a computer program product with program code stored on a machine-readable medium such as a semiconductor memory, a hard disk memory or an optical memory and used to carry out the evaluation when the program is executed by the evaluation and control unit.

[0015] The measures and further developments listed in the dependent claims enable advantageous improvements to the arrangement specified in independent patent claim 1 for carrying out at least one safety-critical driving function in a vehicle.

[0016] It is particularly advantageous that the manual actuating means can comprise at least one sensor which is designed to detect an actuation and / or a degree of actuation of the manual actuating means and to generate and output corresponding sensor signals. The at least one sensor comprises at least one sensor element which directly or indirectly detects a physical quantity or a change in a physical quantity and preferably converts it into an electrical sensor signal. Such a sensor can be designed, for example, as a force or pressure sensor, a displacement sensor, an angle sensor or the like to detect an actuation of a brake pedal or an accelerator pedal or a steering wheel and can provide corresponding actuation information. Of course, other suitable sensor technology can also be used to detect the actuation of the manual actuating means.If at least two sensors are used, they can preferably use different sensor technologies to detect the actuation of the manual actuation means and provide the corresponding actuation information, which preferably represents a corresponding degree of actuation of the manual actuation means. The use of a second sensor can, in particular, increase the integrity and reliability of the manual actuation means. However, the availability of the manual actuation means can decrease, since the actuation means can be switched off as soon as the two sensors deliver differing values, and the faulty sensor cannot be clearly identified. However, high availability of the manual actuation means with ASIL classification D is not required due to the use of the automated function module with ASIL classification D.

[0017] In an advantageous embodiment of the arrangement, the automated functional module can be coupled to an environmental sensor system and configured to evaluate information from the environmental sensor system to detect a critical driving situation. For this purpose, images from an external camera, for example, can be evaluated. To detect the vehicle's surroundings and to detect objects, obstacles, and other road users, the environmental sensor system can preferably comprise at least one external camera and / or a suitable radar system.

[0018] In a further advantageous embodiment of the arrangement, the manual actuating means can have an ASIL classification C with regard to integrity and / or availability if the expected availability of the manual actuating means is specified in the range of 1% to 10% of the applications of the safety-critical driving function and / or an expected frequency of use of the manual actuating means is specified in the range of between 10 and 100 applications per year. Alternatively, the manual actuating means can have at least an ASIL classification B with regard to integrity and / or availability if the expected availability of the manual actuating means is specified in the range of less than 1% of the applications of the safety-critical driving function and / or an expected frequency of use of the manual actuating means is specified in the range of between 1 and 10 applications per year.As a further alternative, the manual actuating means may have at least an ASIL classification A with regard to integrity and / or availability if the expected availability of the manual actuating means is specified in the range of less than 1% of the applications of the safety-critical driving function and / or an expected frequency of use of the manual actuating means is specified with one application per year.

[0019] In a further advantageous embodiment of the arrangement, the manual actuating means can be combined with a diagnostic function that can be executed continuously and / or depending on predeterminable criteria during driving and checks the current status of the manual actuating means. The predefined criteria for executing the diagnostic function can correspond to a vehicle start and / or a vehicle standstill and / or an actuation of the manual actuating means and / or a time criterion. This means that the diagnostic function can be executed every time the vehicle is started and / or every time the vehicle is standstill and / or every time the manual actuating means is actuated.

[0020] Alternatively, these criteria can be combined with each other and with the time criterion. This means, for example, that the diagnostic function can only be executed if a specified period of time has elapsed since the last diagnostic function was executed. The diagnostic function can particularly detect so-called "dormant errors". A dormant error is an error that is present but has not yet had an effect or only occurs when the device is actuated. If, for example, the actuating device is never used, then the "dormant error" cannot be detected. If the actuating device is then needed, it cannot be used because it is not functional. However, such a "dormant error" can be reliably detected in an advantageous manner using the diagnostic function.

[0021] In a further advantageous embodiment of the arrangement, the diagnostic function can be designed to output a visual and / or acoustic request to operate the manual actuation means and to evaluate the subsequent actuation of the manual actuation means. This visual and / or acoustic request to operate the manual actuation means can preferably be output when the vehicle is started. In this case, the diagnostic function can be designed to detect and evaluate the attention level of a driver of the vehicle in combination with an interior sensor system if the driver of the vehicle does not react after the visual and / or acoustic request to operate the manual actuation means. For this purpose, images from an interior camera can be evaluated, for example.

[0022] In a further advantageous embodiment of the arrangement, the diagnostic function can be designed to output a visual and / or acoustic warning message when a fault in the manual actuation means is detected. The visual and / or acoustic warning message can preferably be output via an output device present in the vehicle, such as a sound system and / or a screen.

[0023] An embodiment of the invention is shown in the drawing and is explained in more detail in the following description. Short description of the drawing Fig. 1 shows a schematic block diagram of an embodiment of an arrangement according to the invention for executing at least one safety-critical driving function with an ASIL classification D in a vehicle with an SAE level greater than or equal to three. Embodiments of the invention

[0024] As from Fig. 1, the illustrated embodiment of an arrangement 10 according to the invention for executing at least one safety-critical driving function 11 with an ASIL classification D in a vehicle 1 with an SAE level greater than or equal to three comprises an automated function module 12, a manual actuating means 14, at least one actuator 18 and at least one evaluation and control unit 16, which is designed to receive and evaluate input signals from the automated function module 12 or from the manual actuating means 14 and to control the at least one actuator 18 depending on the evaluation for executing the safety-critical driving function 11.The automated functional module 12 has an ASIL classification D with regard to integrity and availability and is designed to generate input signals for executing the safety-critical driving function 11 with an availability of more than 90% for the applications of the safety-critical driving function 11 and to output them to the at least one evaluation and control unit 16. The manual actuating means 14 has an ASIL classification with regard to integrity and / or availability, which is below the ASIL classification D of the automated functional module 12 and is designed to generate the input signals for executing the safety-critical driving function in the event of a failure of the automated functional module 12 and to output them to the at least one evaluation and control unit 16.

[0025] In the illustrated embodiment, the arrangement 10 has only one safety-critical driving function 11 with the ASIL classification D. In addition, the safety-critical driving function 11 with the ASIL classification D is a braking function, and the manual actuating means 14 is a brake pedal.

[0026] In alternative embodiments of the arrangement 10 (not shown), the safety-critical driving function 11 with ASIL classification D is an acceleration function, and the manual actuating means 14 is an accelerator pedal. In further alternative embodiments of the arrangement 10 (not shown), the safety-critical driving function 11 with ASIL classification D is a steering function, and the manual actuating means 14 is a steering wheel. Of course, the arrangement 10 can also execute multiple safety-critical driving functions 11 with ASIL classification D simultaneously.

[0027] In the illustrated embodiment of the arrangement 10, the manual actuating means 14 has an ASIL classification A with regard to integrity and / or availability, since the expected availability of the manual actuating means 14 in the illustrated embodiment is specified in the range of less than 1% of the applications of the safety-critical driving function 11 and / or an expected frequency of use of the manual actuating means 14 is specified with one application per year. This means that the manual actuating means 14 has only one sensor 14.1 for detecting an actuation and / or a degree of actuation of the manual actuating means 14 and for generating and outputting corresponding sensor signals, as can be seen from Fig. 1. This enables a particularly cost-effective design of the manual actuating means 14, since no redundant sensors 14.1 are required due to the ASIL classification A. In the illustrated embodiment, the at least one sensor 14.1 is designed as a force or pressure sensor or as a displacement sensor for detecting the actuation of the brake pedal. Analogously, the at least one sensor 14.1 in the not-illustrated embodiment is also designed as a force or pressure sensor or as a displacement sensor for detecting the actuation of the accelerator pedal. In the not-illustrated embodiment, the at least one sensor 14.1 is designed as an angle sensor for detecting the actuation of the manual actuating means 14, which is designed as a steering wheel.

[0028] In an alternative embodiment of the arrangement 10 (not shown), the manual actuating means 14 has an ASIL classification C with regard to integrity and / or availability, since the expected availability of the manual actuating means 14 is specified in the range of 1% to 10% of the applications of the safety-critical driving function 11 and / or an expected frequency of use of the manual actuating means 14 is specified in the range of between 10 and 100 applications per year. This means that the manual actuating means 14 in this embodiment has two sensors 14.1 for detecting an actuation and / or a degree of actuation of the manual actuating means 14 and for generating and outputting corresponding sensor signals.

[0029] In a further alternative embodiment of the arrangement 10 (not shown), the manual actuating means 14 has at least an ASIL classification B with regard to integrity and / or availability, since the expected availability of the manual actuating means 14 is specified in the range of less than 1% of the applications of the safety-critical driving function 11 and / or an expected frequency of use of the manual actuating means 14 is specified in the range between 1 and 10 applications per year. This means that the manual actuating means 14 in this embodiment can have one or two sensors 14.1 for detecting an actuation and / or a degree of actuation of the manual actuating means 14 and for generating and outputting corresponding sensor signals.

[0030] As from Fig. As can be further seen in Figure 1, the automated functional module 12 is coupled to an environmental sensor system 13 and is designed to evaluate information from the environmental sensor system 13 to detect a critical driving situation. To detect the vehicle's surroundings, the environmental sensor system 13 preferably comprises at least one camera (not shown in detail) and / or a suitable radar system.

[0031] As from Fig. 1, the manual actuating means 14 in the illustrated embodiment is combined with a diagnostic function 15, which can be executed continuously and / or depending on predeterminable criteria during driving and checks a current state of the manual actuating means 14. The predefined criteria for executing the diagnostic function 15 can correspond to a start of the vehicle 1 and / or a standstill of the vehicle 1 and / or an actuation of the manual actuating means 14 and / or a time criterion.

[0032] As from Fig. 1, the diagnostic function 15 is coupled to an output unit 17 and designed to output, via the output unit 17, a visual and / or acoustic request to actuate the manual actuating means 14 and to evaluate the subsequent actuation of the manual actuating means 14. In addition, the diagnostic function 15 in the illustrated embodiment is coupled to an interior sensor system 19 and designed, in combination with the interior sensor system 19, to detect and evaluate an attention level of a driver of the vehicle 1 if there is no reaction from the driver of the vehicle 1 after the visual and / or acoustic request to actuate the manual actuating means 14. To detect the driver's attention level, the interior sensor system 19 preferably comprises at least one camera (not shown in detail).In addition, the diagnostic function 15 is designed to output an optical and / or acoustic warning message via the output unit 17 when an error of the manual actuating means 14 is detected.

[0033] As from Fig. As can be further seen in Figure 1, the safety-critical driving function 11, the automated functional module 12, and the diagnostic function 15 in the illustrated embodiment are each implemented as part of the evaluation and control unit 16 and integrated therein. Of course, the automated functional module 12 and / or the diagnostic function 15 can also be implemented as part of at least one further evaluation and control unit 16 or integrated therein.

Claims

[1] Arrangement (10) for performing at least one safety-critical driving function (11) with an ASIL classification D in a vehicle (1) with an SAE level greater than or equal to three, comprising an automated function module (12), a manual actuating device (14), at least one actuator (18) and at least one evaluation and control unit (16) configured to receive and evaluate input signals from the automated function module (12) or from the manual actuating device (14) and, depending on the evaluation, to control the at least one actuator (18) to perform the safety-critical driving function (11), wherein the automated function module (12) has an ASIL classification D with respect to integrity and availability and is configuredto generate input signals for the execution of the safety-critical driving function (11) with an availability of more than 90% for the applications of the safety-critical driving function (11) and to output them to the at least one evaluation and control unit (16), wherein the manual actuating means (14) has an ASIL classification with regard to integrity and / or availability which is below the ASIL classification D of the automated function module (12), and is designed to generate the input signals for the execution of the safety-critical driving function (11) and to output them to the at least one evaluation and control unit (16) in the event of failure of the automated function module (12). [2] Arrangement (10) according to claim 1, characterized by, that the manual actuating means (14) comprises at least one sensor (14.1) which is configured to detect an actuation and / or degree of actuation of the manual actuating means (14) and to generate and output corresponding sensor signals. [3] Arrangement (10) according to claim 1 or 2, characterized by , that the automated function module (12) is coupled with an environmental sensor system (13) and is designed to evaluate information from the environmental sensor system (13) to detect a critical driving situation. [4] Arrangement (10) according to any one of claims 1 to 3, characterized by, that the manual actuation device (14) has an ASIL classification C with respect to integrity and / or availability if the expected availability of the manual actuation device (14) is specified in the range of 1 to 10% of the applications of the safety-critical driving function (11) and / or an expected frequency of use of the manual actuation device (14) is specified in the range of 10 to 100 applications per year. [5] Arrangement (10) according to any one of claims 1 to 3, characterized by, that the manual actuation device (14) has at least an ASIL classification B with respect to integrity and / or availability if the expected availability of the manual actuation device (14) is specified to be in the range of less than 1% of the applications of the safety-critical driving function (11) and / or an expected frequency of use of the manual actuation device (14) is specified to be in the range of between 1 and 10 applications per year. [6] Arrangement (10) according to any one of claims 1 to 3, characterized by , that the manual actuation device (14) has at least an ASIL classification A with respect to integrity and / or availability if the expected availability of the manual actuation device (14) is specified to be in the range of less than 1% of the applications of the safety-critical driving function (11) and / or an expected frequency of application of the manual actuation device (14) is specified with one application per year. [7] Arrangement (10) according to any one of claims 1 to 6, characterized by , that the manual actuation means (14) is combined with a diagnostic function (15) which can be executed continuously and / or depending on predefinable criteria during driving operation and checks a current state of the manual actuation means (14). [8] Arrangement (10) according to claim 7, characterized by , that the specified criteria for performing the diagnostic function (15) correspond to a start of the vehicle (1) and / or a standstill of the vehicle (1) and / or an actuation of the manual operating means (14) and / or a time criterion. [9] Arrangement (10) according to claim 7 or 8, characterized by , that the diagnostic function (15) is executed, to issue an optical and / or acoustic prompt to actuate the manual operating device (14) and to evaluate the subsequent actuation of the manual operating device (14). [10] Arrangement (10) according to claim 9, characterized by , that the diagnostic function (15) is executed, in combination with an interior sensor system (19) to detect and evaluate the attention level of a driver of the vehicle (1) if, after the visual and / or acoustic prompt to operate the manual control device (14), there is no reaction from the driver of the vehicle (1). [11] Arrangement (10) according to any one of claims 7 to 10, characterized by , that the diagnostic function (15) is executed to issue an optical and / or acoustic warning message when a fault in the manual operating device (14) is detected. [12] Arrangement (10) according to any one of claims 1 to 11, characterized by , that the safety-critical driving function (11) with ASIL classification D is a braking function and / or an acceleration function and / or a steering function. [13] Arrangement (10) according to claim 12, characterized by, that the manual operating device (14) is a brake pedal or an accelerator pedal or a steering wheel.

Images