Arrangement for executing at least one safety-critical driving function in a vehicle

Abstract

The invention relates to an arrangement (10) for executing at least one safety-critical driving function (11) with an ASIL classification D in a vehicle (1), comprising a manual actuating means (14), an automated assistance module (12), at least one actuator (18) and an evaluation and control unit (16) which receives and evaluates input signals from the manual actuating means (14) or from the automated assistance module (12) and, depending on the evaluation, controls the at least one actuator (18) for executing the safety-critical driving function (11), wherein, during normal operation of the vehicle (1), the manual actuating means (14) generates the input signals and outputs them to the evaluation and control unit (16),wherein, in the event of a failure of the manual actuating means (14) and / or in the event of a critical driving situation detected by the automated assistance module (12) and a lack of actuation of the manual actuating means (14), the automated assistance module (12) generates the input signals and outputs them to the evaluation and control unit (16) in such a way that serious injuries with a greater severity than Severity S2 caused by an accident are prevented, wherein an ASIL classification of the manual actuating means (14) is predetermined depending on a predetermined ASIL classification of the automated assistance module (12).

Description

[0001] The invention relates to an arrangement for executing at least one safety-critical driving function, which has an ASIL classification D, in a vehicle.

[0002] The ASIL classification (ASIL: Automotive Safety Integrity Level) for electronic components in the automotive industry is specified by the International Organization for Standardization (ISO) in the ISO26262 standard. The ASIL classification is composed of "Severity S," which refers to the severity of an accident and the hazard to the user and / or the environment caused by a failure; "Exposure E," which refers to the frequency of occurrence of a specific driving situation; and "Controllability C," which refers to the controllability of the vehicle in the event of a malfunction. Severity S0 refers to no injuries; Severity S1 refers to minor to moderate injuries; Severity S2 refers to severe injuries with a high chance of survival; and Severity S3 refers to very severe injuries with a low chance of survival.The factor “Exposure E” is differentiated according to the duration of the occurrence of the driving situation and the frequency of its occurrence. An Exposure E1 refers to a rare occurrence of the driving situation, an Exposure E2 refers to an occasional occurrence of the driving situation, an Exposure E3 refers to a frequent occurrence of the driving situation, and an Exposure E4 refers to a constant occurrence of the driving situation. Here, a Controllability C0 refers to a safe control of the error situation, i.e. all drivers can control the error situation, a Controllability C1 refers to easy control, i.e. more than 99% of drivers can control the error situation, a Controllability C2 refers to normal control of the error situation, i.e. more than 90% of drivers can control the error situation, and a Controllability C3 refers to a difficult control of the error situation, i.e.less than 90% of drivers can control the driving situation.

[0003] DE 10 2021 106 567 A1 discloses a vehicle with a highly automated driving function that provides a vehicle response to an anomaly condition during autonomous driving. A computer is programmed to operate the vehicle completely or to a lesser extent independently of the intervention of a human driver. The computer can be programmed to operate a drive, a steering system, a braking system, and / or other vehicle systems at least partially based on data received from sensors. The drive, the steering system, and / or the braking system each comprise an electronic control unit that communicates with and receives inputs from the computer and / or the driver. The driver can control the drive, for example, via an accelerator pedal and / or a gearshift lever. The driver can control the steering system, for example, via a steering wheel.The driver can control the braking system using a brake pedal, for example.

[0004] DE 10 2017 213 572 A1 discloses a system for determining a takeover of a vehicle from a highly automated driving mode, i.e., a driving mode for driving according to SAE Level 3. The system comprises an operating element for highly automated driving, e.g., a button, with which a driver of the vehicle can indicate a takeover, e.g., a change to and / or termination of the highly automated driving mode. The operating element can transmit a takeover signal to a safety-relevant software component. The system can further comprise a steering wheel, which can transmit a steering torque signal and / or a hands-on-steering-wheel signal to the safety-relevant software component. The system further comprises a brake pedal and an accelerator pedal. The brake pedal can transmit a brake signal to the safety-relevant software component, and the accelerator pedal can transmit an accelerator signal to the safety-relevant component.The signals from the control element, the steering wheel, and / or the brake and accelerator pedals are unambiguous. Furthermore, the signals from the control element, the steering wheel, and / or the brake and accelerator pedals are characterized by a high degree of reliability. In other words, the signals from the control element, the steering wheel, and / or the brake and accelerator pedals can be detected by appropriate sensors with a high degree of reliability and transmitted to the safety-relevant software component. The functional safety load preferably lies on the signals from the control element, the steering wheel, and / or the brake and accelerator pedals. The safety-relevant software component is preferably a component that meets ASIL classification D.The safety-relevant software component can receive the signals from the control element, the steering wheel and / or the brake and / or accelerator pedal and link them with an OR operator to determine whether a takeover control action by the driver has occurred. Disclosure of the invention

[0005] The arrangement for executing at least one safety-critical driving function with an ASIL classification D in a vehicle with the features of independent patent claim 1 has the advantage that the safety load of the at least one safety-critical driving function with the ASIL classification D can be distributed between a manual actuation means and an automated assistance module. Since the automated assistance module is designed to prevent serious injuries caused by accidents with an injury severity greater than severity S2, it is possible to reduce an ASIL classification of the brake pedal to an ASIL classification that is lower than the ASIL classification D of the at least one safety-critical driving function.This reduces the number of sensors used to detect the actuation and / or degree of actuation of the manual actuation device, resulting in a more cost-effective development process for the manual actuation device. These savings are achievable because accidents resulting in serious injuries with a severity level of S3 can be prevented by the automated assistance module, so that any injuries that occur are at most S2 or lower.

[0006] Embodiments of the present invention provide an arrangement for executing at least one safety-critical driving function with an ASIL classification D in a vehicle, which arrangement comprises a manual actuating means, an automated assistance module, at least one actuator, and at least one evaluation and control unit, which is designed to receive and evaluate input signals from the manual actuating means or from the automated assistance module and, depending on the evaluation, to control the at least one actuator for executing the safety-critical driving function. During normal operation of the vehicle, the manual actuating means generates the input signals for executing the safety-critical driving function and outputs them to the at least one evaluation and control unit.In the event of a failure of the manual actuation device and / or a critical driving situation detected by the automated assistance module and a lack of actuation of the manual actuation device, the automated assistance module is designed to generate the input signals for executing the safety-critical driving function and output them to at least one evaluation and control unit in such a way that serious injuries greater than severity S2 caused by an accident are prevented. An ASIL classification of the manual actuation device is specified depending on a predefined ASIL classification of the automated assistance module.

[0007] A hazard analysis shows that decomposition of the ASIL classification is permitted because the manual actuation device and the automated assistance module can represent at least one safety-critical driving function with an ASIL classification of D and are sufficiently independent of each other. For example, the manual actuation device can be rated with an ASIL classification of C, assuming that injuries caused by an accident with a severity greater than S2 can be prevented by the automated assistance module. Furthermore, the hazard analysis also shows that a failure of the automated assistance module itself is not critical because the manual actuation device maintains full functionality.

[0008] In embodiments of the arrangement according to the invention, the safety-critical driving function with ASIL classification D can, for example, correspond to a braking function and / or a steering function. For this purpose, the manual actuation means can be, for example, a brake pedal or a steering wheel. Thus, it is possible, for example, to provide embodiments of the arrangement according to the invention for multiple safety-critical driving functions or only for certain selected safety-critical driving functions in the vehicle. Of course, embodiments of the arrangement according to the invention can also be used for only one safety-critical driving function in the vehicle.

[0009] In this case, the evaluation and control unit can be understood to be an electrical device, such as a control unit, in particular a brake control unit or steering control unit, which processes or evaluates detected sensor signals. The evaluation and control unit can have at least one interface, which can be hardware- and / or software-based. In a hardware-based design, the interfaces can, for example, be part of a so-called system ASIC, which contains a wide variety of functions of the evaluation and control unit. However, it is also possible for the interfaces to be separate integrated circuits or to consist at least partially of discrete components. In a software-based design, the interfaces can be software modules, which are present, for example, on a microcontroller alongside other software modules.Also advantageous is a computer program product with program code stored on a machine-readable medium such as a semiconductor memory, a hard disk memory or an optical memory and used to carry out the evaluation when the program is executed by the evaluation and control unit.

[0010] The measures and further developments listed in the dependent claims enable advantageous improvements to the arrangement specified in independent patent claim 1 for carrying out at least one safety-critical driving function with an ASIL classification D in a vehicle.

[0011] It is particularly advantageous that the manual actuating means can comprise at least one sensor which is designed to detect an actuation and / or a degree of actuation of the manual actuating means and to generate and output corresponding sensor signals. The at least one sensor comprises at least one sensor element which directly or indirectly detects a physical quantity or a change in a physical quantity and preferably converts it into an electrical sensor signal. Such a sensor can be designed, for example, as a force or pressure sensor, a displacement sensor, an angle sensor or the like to detect an actuation of a brake pedal or a steering wheel and can provide corresponding actuation information. Of course, other suitable sensor technology can also be used to detect the actuation of the manual actuating means.If at least two sensors are used, they can preferably use different sensor technologies to detect the actuation of the manual actuation device and provide the corresponding actuation information, which preferably represents a corresponding degree of actuation of the manual actuation device. The use of a second sensor can, in particular, increase the integrity and reliability of the manual actuation device. If the two sensors deliver differing values ​​and the faulty sensor can be clearly identified, the value of the other sensor can be used. However, if the error cannot be clearly assigned to a sensor, the manual actuation device has failed, and the driver's command can no longer be detected.In this case, the automated assistance module is used, which can prevent injuries caused by an accident with an injury severity greater than Severity S2.

[0012] In an advantageous embodiment of the arrangement, the automated assistance module can be coupled to an environmental sensor system and configured to evaluate information from the environmental sensor system to detect a critical driving situation. For this purpose, images from an external camera, for example, can be evaluated. To detect the vehicle's surroundings and to detect objects, obstacles, and other road users, the environmental sensor system can preferably comprise at least one external camera and / or a suitable radar system.

[0013] In a further advantageous embodiment of the arrangement, the automated assistance module can be designed, in combination with an interior sensor system, to detect and evaluate the attention level of a vehicle driver. For this purpose, images from an interior camera can be evaluated, for example. If the manual actuation device is not activated due to a critical driving situation detected by the automated assistance module, it can be checked, for example, whether the driver has fallen asleep.

[0014] In a further advantageous embodiment of the arrangement, the manual actuating means can have an ASIL classification C if the automated assistance module has an ASIL classification A. By increasing the ASIL classification of the automated assistance module, the ASIL classification of the manual actuating means can be further reduced. Therefore, the manual actuating means can alternatively have at least an ASIL classification B if the automated assistance module has an ASIL classification B. As a further alternative, the manual actuating means can have at least an ASIL classification A if the automated assistance module has an ASIL classification C. Furthermore, the manual actuating means can have undergone at least one quality management process without an ASIL classification if the automated assistance module has an ASIL classification D.By increasing the expected failure probability or reducing the expected availability of the manual actuation device, the corresponding development processes can be further simplified. In particular, simpler diagnostic processes can be used, such as a simple valid range check, which can also reduce the costs for a control unit or for at least one evaluation and control unit.

[0015] In a further advantageous embodiment of the arrangement, the manual actuation means can be combined with a diagnostic function that can be executed continuously during driving and checks the current status of the manual actuation means. This allows for early detection of a faulty manual actuation means.

[0016] In a further advantageous embodiment of the arrangement, the diagnostic function can be designed to output a visual and / or acoustic warning message if a faulty manual actuation device is diagnosed. The visual and / or acoustic warning message can preferably be output via an output device present in the vehicle, such as a sound system and / or a screen.

[0017] In a further advantageous embodiment of the arrangement, the diagnostic function can be designed to reduce an activation threshold of the automated assistance module if a degradation of the manual actuation means or of the input signals generated by the manual actuation means is diagnosed. The degradation can, for example, relate to an intermittent error and / or increased latency and / or loss of redundancy and / or unstable input signals of the at least one sensor.

[0018] An embodiment of the invention is shown in the drawing and is explained in more detail in the following description. Short description of the drawing Fig. 1 shows a schematic block diagram of an embodiment of an arrangement according to the invention for executing at least one safety-critical driving function with an ASIL classification D in a vehicle. Embodiments of the invention

[0019] As from Fig. 1, the illustrated embodiment of an arrangement 10 according to the invention for executing at least one safety-critical driving function 11 with an ASIL classification D in a vehicle 1 comprises a manual actuating means 14, an automated assistance module 12, at least one actuator 18 and at least one evaluation and control unit 16, which is designed to receive and evaluate input signals from the manual actuating means 14 or from the automated assistance module 12 and, depending on the evaluation, to control the at least one actuator 18 for executing the safety-critical driving function 11. During normal operation of the vehicle 1, the manual actuating means 14 generates the input signals for executing the safety-critical driving function 11 and outputs them to the at least one evaluation and control unit 16.In the event of a failure of the manual actuating means 14 and / or a critical driving situation detected by the automated assistance module 12 and a lack of actuation of the manual actuating means 14, the automated assistance module 12 is designed to generate the input signals for executing the safety-critical driving function 11 and output them to the at least one evaluation and control unit 16 in such a way that serious injuries with a severity greater than S2 caused by an accident are prevented. An ASIL classification of the manual actuating means 14 is specified depending on a predefined ASIL classification of the automated assistance module 12.

[0020] In the illustrated embodiment, the arrangement 10 has only one safety-critical driving function 11 with ASIL classification D, which corresponds to a braking function. The manual actuation means 14 is a brake pedal, and the automated assistance module 12 is designed to perform an emergency braking function in the illustrated embodiment.

[0021] In alternative embodiments of the arrangement 10 (not shown), the safety-critical driving function 11 with the ASIL classification D is a steering function. Here, the manual actuating means 14 is a steering wheel, and the automated assistance module 12 is configured to perform a lane-keeping function. Of course, the arrangement 10 can also simultaneously perform several safety-critical driving functions 11 with the ASIL classification D. Furthermore, the arrangement 10 can also be used for other safety-critical driving functions 11 with the ASIL classification D in the vehicle 1.

[0022] In the illustrated embodiment of the arrangement 10, the manual actuation means 14 comprises two redundant sensors 14.1, each of which is designed to detect an actuation and / or a degree of actuation of the manual actuation means 14 and to generate and output corresponding sensor signals. Furthermore, the manual actuation means 12 has an ASIL classification of C, since the automated assistance module 12 has an ASIL classification of A. The ASIL classification of C of the manual actuation means 14 enables a cost-effective design of the manual actuation means 14 despite the two redundant sensors 14.1, since more cost-effective development processes are possible for the arrangement 10.

[0023] In the illustrated embodiment, the two redundant sensors 14.1 are designed as force or pressure sensors or as displacement sensors to detect the actuation of the brake pedal. In the embodiment not shown, the two sensors 14.1 are designed as angle sensors to detect the actuation of the manual actuation means 14, which is designed as a steering wheel.

[0024] In an alternative embodiment of the arrangement 10 (not shown), the manual actuating means 14 has at least an ASIL classification B, since the automated assistance module 12 has an ASIL classification B. This means that the manual actuating means 14 in this embodiment can have one or two sensors 14.1 for detecting an actuation and / or a degree of actuation of the manual actuating means 14 and for generating and outputting corresponding sensor signals.

[0025] In a further alternative embodiment of the arrangement 10 (not shown), the manual actuating means 14 has at least an ASIL classification A, since the automated assistance module 12 has an ASIL classification C. This means that the manual actuating means 14 has only one sensor 14.1 for detecting an actuation and / or a degree of actuation of the manual actuating means 14 and for generating and outputting corresponding sensor signals. This enables a particularly cost-effective design of the manual actuating means 14, since no redundant sensors 14.1 are required due to the ASIL classification A. In a further embodiment of the arrangement 10 (not shown), the automated assistance module 12 has an ASIL classification D, so that the manual actuating means 14 has undergone at least one quality management process without an ASIL classification.

[0026] As from Fig. 1, the automated assistance module 12 is coupled to an environmental sensor system 13 and designed to evaluate information from the environmental sensor system 13 to detect a critical driving situation. To detect the vehicle's surroundings, the environmental sensor system 13 preferably comprises at least one camera (not shown in detail) and / or a suitable radar system. In addition, the automated assistance module 12 in the illustrated embodiment is coupled to an interior sensor system 19 and designed, in combination with the interior sensor system 19, to detect and evaluate an attention level of a driver of the vehicle 1 if, when a critical driving situation is detected, the driver of the vehicle 1 does not actuate the manual actuating means 14. To detect the driver's attention level, the interior sensor system 19 preferably comprises at least one camera (not shown in detail).

[0027] As from Fig.As can be further seen in Figure 1, the manual actuating means 14 in the illustrated embodiment is combined with a diagnostic function 15, which can be executed continuously during driving and checks the current status of the manual actuating means 14. The diagnostic function 15 is configured to output a visual and / or acoustic warning message via an output unit 17 if a faulty manual actuating means 14 is diagnosed.

[0028] Furthermore, in the illustrated embodiment, the diagnostic function 15 is designed to reduce an activation threshold of the automated assistance module 12 if a degradation of the manual actuation means 14 or in the input signals generated by the manual actuation means 14 is diagnosed. The degradation relates, for example, to an intermittent error and / or increased latency and / or loss of redundancy and / or unstable input signals of the at least one sensor 14.1. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2021 106 567 A1

[0003] DE 10 2017 213 572 A1

[0004]

Claims

[1] Arrangement (10) for executing at least one safety-critical driving function (11) with an ASIL classification D in a vehicle (1), with a manual actuating means (14), an automated assistance module (12), at least one actuator (18) and at least one evaluation and control unit (16), which is designed to receive and evaluate input signals from the manual actuating means (14) or from the automated assistance module (12) and, depending on the evaluation, to control the at least one actuator (18) for executing the safety-critical driving function (11), wherein during normal operation of the vehicle (1), the manual actuating means (14) generates the input signals for executing the safety-critical driving function (11) and outputs them to the at least one evaluation and control unit (16), wherein the automated assistance module (12) is designed,in the event of a failure of the manual actuating means (14) and / or in the event of a critical driving situation detected by the automated assistance module (12) and a lack of actuation of the manual actuating means (14), to generate the input signals for executing the safety-critical driving function (11) and to output them to the at least one evaluation and control unit (16) in such a way that serious injuries with a greater severity than Severity S2 caused by an accident are prevented, wherein an ASIL classification of the manual actuating means (14) is predetermined depending on a predetermined ASIL classification of the automated assistance module (12). [2] Arrangement (10) according to claim 1, characterized bythat the manual actuating means (14) comprises at least one sensor (14.1) which is designed to detect an actuation and / or a degree of actuation of the manual actuating means (14) and to generate and output corresponding sensor signals. [3] Arrangement (10) according to claim 1 or 2, characterized by that the automated assistance module (12) is coupled to an environmental sensor system (13) and is designed to evaluate information from the environmental sensor system (13) to detect a critical driving situation. [4] Arrangement (10) according to one of claims 1 to 3, characterized by that the automated assistance module (12) is designed, in combination with an interior sensor system (19), to detect and evaluate an attention level of a driver of the vehicle (1). [5] Arrangement (10) according to one of claims 1 to 4, characterized bythat the manual actuating means (14) has an ASIL classification C when the automated assistance module (12) has an ASIL classification A. [6] Arrangement (10) according to one of claims 1 to 4, characterized by that the manual actuating means (14) has at least an ASIL classification B if the automated assistance module (12) has an ASIL classification B. [7] Arrangement (10) according to one of claims 1 to 4, characterized by that the manual actuating means (14) has at least an ASIL classification A when the automated assistance module (12) has an ASIL classification C. [8] Arrangement (10) according to one of claims 1 to 4, characterized by that the manual actuating means (14) has undergone at least one quality management process without ASIL classification if the automated assistance module (12) has an ASIL classification D. [9] Arrangement (10) according to one of claims 1 to 8, characterized by that the manual actuating means (14) is combined with a diagnostic function (15) which can be carried out continuously during driving operation and checks a current state of the manual actuating means (14). [10] Arrangement (10) according to claim 9, characterized by that the diagnostic function (15) is designed to issue a visual and / or acoustic warning message when a faulty manual actuating means (14) is diagnosed. [11] Arrangement (10) according to claim 9 or 10, characterized by that the diagnostic function (15) is designed to reduce an activation threshold of the automated assistance module (12) when a degradation of the manual actuating means (14) or in the input signals generated by the manual actuating means (14) is diagnosed. [12] Arrangement (10) according to claim 11, characterized bythat the degradation relates to an intermittent error and / or an increased latency and / or a loss of redundancy and / or unstable input signals of the at least one sensor (14.1). [13] Arrangement (10) according to one of claims 1 to 12, characterized by that the safety-critical driving function (11) with an ASIL classification D is a braking function and / or a steering function. [14] Arrangement (10) according to claim 13, characterized by that the manual actuating means (14) is a brake pedal and the automated assistance module (12) is designed to perform an emergency braking function. [15] Arrangement (10) according to claim 13 or 14, characterized by that the manual actuating means (14) is a steering wheel and the automated assistance module (12) is designed to perform a lane keeping function.

Images