System and method for determining a health condition, and at least partially autonomously operating device

Abstract

The invention relates to a system for determining the health status of an at least partially autonomously operating device, comprising: several components, each component comprising at least one component unit, - each component unit being designed to determine an individual unit health status, - wherein each component is designed to determine an individual component health state using the determined unit health states of all component units in the respective component; and a control device configured to determine a central health status for the at least partially autonomously operating device using all component health statuses, wherein the unit health states, the component health states and the central health state are each selectable, in particular selected, from a common group of predeterminable or predefined health states.

Description

Technical area

[0001] The present invention relates to a system and a method for determining a state of health, in particular for determining a state of health of an at least partially autonomously operating device. The present invention further relates to an at least partially autonomously operating device, such as an at least partially autonomously operating vehicle. The present invention also relates to a computer program and a machine-readable storage medium. State of the art

[0002] Fully or at least partially autonomous vehicles are becoming increasingly important. In addition to driver assistance systems such as brake assist, lane keeping, and speed assist, development is also moving toward fully autonomous vehicles. Such an autonomous vehicle can, for example, move independently in traffic, depending on the conditions, with or without user supervision.

[0003] Depending on the vehicle's equipment, current operating status, and any external conditions, different levels of automation are possible. One possible classification of automation levels is specified, for example, by the SAE J3016 standard.

[0004] For example, DE 10 2017 218 446 A1 describes a method for monitoring a motor vehicle with an automated driving function. This document proposes enabling, disabling, or influencing an automated driving function depending on a parameter. Disclosure of the invention

[0005] The present invention provides a system and a method for determining the health status of an at least partially autonomously operating device, as well as an at least partially autonomously operating device having the features of the independent patent claims. Further advantageous embodiments are the subject of the dependent patent claims. Accordingly, it is provided:

[0006] A system for determining a health state, in particular for determining or ascertaining a central health state of an at least partially autonomously operating device. The at least partially autonomously operating device can in particular be an at least partially autonomously operating vehicle. The system comprises a plurality of components, each with at least one component unit. The system further comprises a control device. The control device is designed to determine a central health state for the at least partially autonomously operating device. Each component unit is designed to determine an individual unit health state for the respective component unit. Each component is designed to determine an individual component health state.The component health status can be determined, in particular, using the determined unit health statuses of all component units for the respective component. The control device is designed to determine or ascertain the central health status using all component health statuses. In this case, the unit health statuses, the component health statuses, and the central health status can each be selected, in particular, from a common group of predeterminable or predefined health statuses. In other words, the possible health statuses for the component units, the components, and the central health status are determined based on a common group of selectable health statuses.

[0007] A health state can be understood as a state of the device and / or a component and / or a unit of a component of the device. The state can be selected from a set of at least two predefined or predefinable states. Furthermore, it is planned:

[0008] An at least partially autonomously operating device comprising a system according to the invention for determining a central health state and a control device. The control device is designed to control the at least partially autonomously operating device. In particular, the control device can control the at least partially autonomously operating device using the determined health state. Finally, it is planned:

[0009] A method for determining a health state, in particular for determining a health state of an at least partially autonomously operating device, such as an at least partially autonomously operating motor vehicle. The device comprises a plurality of components. Each component can comprise at least one component unit. The method comprises a step for determining individual unit health states for the component units of the components, in particular by means of the respective component unit. Furthermore, the method comprises a step for determining individual component health states, in particular by means of the respective component. The component health states can be determined in particular using the determined unit health states of all component units in the respective component.Finally, the method comprises a step for determining a central health state for the at least partially autonomously operating device, in particular by means of a control device. The central health state can be determined using the determined component health states of all components. The unit health states, the component health states, and the central health state are each selected from a common group of predeterminable or predetermined health states. The predeterminable or predetermined health states can represent or characterize different functionalities and / or error-free states and / or reliability and / or security. The group can, for example, include one or more of the following health states: 5: completely healthy 4: limited, but temporarily safe 3: faulty, but still fully available 2: only limited or minimal availability 1: autonomous operation no longer possible Advantages of the invention

[0010] The present invention is based on the finding that, in fully or at least partially autonomously operating devices, such as an autonomous motor vehicle, information about the components involved in the automation plays a decisive role in selecting the possible degree of automation and the resulting possible operating states. In particular, the maximum permissible degree of automation can be limited by the currently determined health status of the entire system. The health status of the entire system is generally determined from the individual health statuses of all relevant individual units, such as sensors, actuators, etc. Especially in complex technical systems and a high degree of automation, a very large number of individual units must be taken into account.In conventional systems, the individual units are typically developed and manufactured by a variety of different manufacturers. Therefore, the information provided by the individual units can be highly complex. This presents a challenge when processing and evaluating this information, and thus when determining a central health status.

[0011] It is therefore an idea of ​​the present invention to take this finding into account and to create a concept for determining a central health state which, even in complex systems such as at least partially autonomously operating devices, enables a reliable determination of a central health state for the entire system in a simple manner. For this purpose, the units are viewed in a hierarchical structure. For this purpose, the units of a common component can, for example, first be summarized. Accordingly, a common component health state can be determined for a component from the individual health states of the individual units (component units). The already summarized component health states can then be summarized in a central control device to form a central overall health state.A special feature of the inventive concept is that, at both the unit level and the component level, and for the entire system, the health states are selected from a common group of possible health states. In this way, the health states can be summarized and reported particularly easily across the entire hierarchical structure. For the corresponding implementation, the common database, i.e., the group of possible health states, only needs to be made available or communicated to all participating instances, such as component units, components, and the central control device. Each instance can then very easily determine the respective health state based on this database and forward it to the higher-level instance.

[0012] Depending on the application of the at least partially autonomously operating device, appropriate groupings can be selected for the individual instances such as units, components, and central control units. For example, in an autonomous motor vehicle, individual units or component units can be considered to be sensors, actuators, or control elements that are associated with a corresponding component such as a brake assist system, steering assist system, cruise control assist system, or similar. In such a case, all information can be consolidated in the central control unit. The central control unit can then determine the maximum permissible level of automation by evaluating the relevant information on the health status.Based on this maximum permissible level of automation, requirements for a desired operating mode can then be selected, such as fully autonomous driving or user monitoring, automated driving with user monitoring, or partially automated operation. Depending on the application, however, any other approaches are also possible.

[0013] According to one embodiment, the control device is designed to determine an operating mode for the at least partially autonomously operating device. In particular, the control device can determine the operating mode using the determined central health state. Especially in the context of autonomously operating systems, the reliability of the components involved must be permanently guaranteed during autonomous operation. If this reliability is not present or is limited, some functionalities may be limited or not activated at all. For example, for a highly automated operating mode, it may be required that all systems be available with a maximum health state. For alternative operating modes, for example operation with only partial automation, restrictions in the health state may also be acceptable if necessary.

[0014] According to one embodiment, the control device is designed to receive a request for a desired operating state. In this case, the control device can also be designed to only enable the desired operating state if the determined health state meets the requirements for the desired operating state. For example, a maximum permissible operating state, such as the degree of automation, can be limited by the available overall health state. However, this does not necessarily mean that the device must also be operated in this maximum available operating state. In principle, operating states with lower requirements can also be selected by a user or an automatic control system. These can then be enabled according to the determined central health state.However, if an operating mode is desired whose requirements exceed the determined central health status, such an operating mode will not be enabled. In this case, for example, the maximum available operating mode can be enabled according to the central health status.

[0015] According to one embodiment, the control device is designed to determine a maximum permissible level of automation. The maximum permissible level of automation can be determined, for example, for autonomous vehicles according to SAE J3016. For example, the level of automation according to SAE can range from level zero (fully manual operation) to level five (fully automated without a driver). The maximum permissible level of automation can be determined, in particular, using the determined central health status.

[0016] According to one embodiment, the predefinable health states comprise several gradations. In principle, these gradations can be specified in any way. For example, the gradation can be in the form of a numerical value. However, a specification in other ways, for example in the form of labels, designations, or the like, is also possible. For example, the gradations can include specifications such as fully healthy, limited but temporarily safe, faulty but available, minimally available, and unavailable. However, it is understood that other suitable graduated specifications are also possible depending on the application. With such a gradation, each component can select, at the component level, the health state that corresponds to the lowest or minimum unit health state of the units for such a component as its component health state.Likewise, the control device can select the health state that corresponds to the health state with the lowest or least component health state among all component health states as the central health state. Thus, the central overall health state corresponds to the health state of the component unit with the lowest health state. In other words, the central health state is determined as a minimum across a plurality of component health states. A lower or lesser health state can be understood as a health state with lower functionality and / or lower safety and / or lower reliability. By specifying a clearly defined group of health states, the selection or determination of the overall health state can be made particularly simple.

[0017] According to one embodiment, the component units in the components are designed to determine the respective unit health status using an error classification, in particular an error classification from monitoring the respective component unit. The error classification can be carried out continuously, regularly, in particular periodically, or in any other suitable manner. Accordingly, a change in a health status in a component unit can trigger a new determination of the component health status and the central health status. Alternatively, a regular, continuous, or periodic determination of the component health status and the central health status is also possible here.

[0018] According to one embodiment, the component units comprise sensors, actuators, and / or control units, in particular elements required for the at least partially autonomous operation of the device. In this way, data on the health status and thus the availability of the individual component units, i.e., assemblies or the like, in the at least partially autonomously operating device are recorded, evaluated, and used to determine and enable the operating modes in the device.

[0019] Also advantageous is a computer program product or computer program with program code that can be stored on a machine-readable carrier or storage medium such as a semiconductor memory, a hard disk memory, or an optical memory and is used to carry out, implement, and / or control the steps of the method according to one of the embodiments described above, in particular when the program product or program is executed on a computer or device. Preferably, the computer program comprises instructions that cause the device described above and below and / or the assistance system described above and below to carry out the above and below method.

[0020] The above embodiments and further developments can be combined with one another as desired, where appropriate. Further embodiments, further developments, and implementations of the invention also include combinations of features of the invention not explicitly mentioned above or described below with respect to the exemplary embodiments. In particular, those skilled in the art will also add individual aspects as improvements or additions to the respective basic forms of the invention. Short description of the drawings

[0021] Further features and advantages of the invention are explained below with reference to the figures. These show: Fig. 1: a schematic representation of an at least partially autonomously operating vehicle according to an embodiment; Fig. 2: a system for determining the state of health according to an embodiment; and Fig. 3: a flowchart underlying a method for determining a health state according to an embodiment. Description of embodiments

[0022] Fig. 1 shows a schematic representation of a vehicle 12, in particular an at least partially autonomously operating vehicle 12 according to one embodiment. For the fully or at least partially autonomous operation of this vehicle 12, a control device 11 can be provided in the vehicle 12. This control device 11 can, for example, automate one or more functionalities of the vehicle 12. For example, braking functions, in particular an emergency braking assistant, steering functions, such as a steering assistant, a lane keeping assistant or the like, as well as cruise control functions, for example an adaptive cruise control or the like, can be implemented. In addition, any other functionalities for a partially or fully automated operation of the vehicle 12 can also be implemented by the control device 11.Depending on the design, this may also include completely independent navigation to a destination with or without driver assistance.

[0023] For example, different levels of automation can be selected to automate the vehicle 12. One possible classification of the levels of automation is specified, for example, by the SAE J3016 standard. A distinction is made between Level 0: manual operation without assistance, Level 1: assisted mode, in which one or more assistance systems such as adaptive cruise control support the driver, Level 2: partially automated, assisted mode, in which functions such as automatic parking, lane keeping, longitudinal guidance, acceleration and braking are taken over by assistance systems, Level 3: automated mode, in which the driver does not have to constantly monitor the system, but must confirm some functions such as lane changes or similar, Level 4: fully automated autonomous mode in which no driver is required, but limited to specified conditions (Operational Design Domain, ODD) - for example, restriction to specific areas (e.g. only highways or private property) and / or only under specific environmental conditions (e.g. weather), and Level 5: fully automated autonomous mode in which no driver is required, without restriction of the conditions (ODD).

[0024] However, depending on the degree of automation and the associated framework conditions (ODD), requirements regarding safety and thus also reliability as well as the health status of the units involved must be met. Therefore, precise knowledge of the health status of the individual units and the resulting overall health status of the vehicle 12 is required. For this purpose, a system 10 for determining the health status can be implemented. This system 10 is explained in more detail below.

[0025] Fig. Figure 2 shows a schematic representation of a system 10 for determining a health status of an at least partially autonomously operating device, such as a fully or partially autonomous vehicle 12. The system may comprise multiple components 2-i. Each component 2-i may be assigned one or more units or component units 3-i. Furthermore, a (central) control device 1 is provided, which determines an overall health status from the information on the health statuses of the component units 3-i and the components 2-i, which will be explained in more detail below.

[0026] The component units 3-i can be any units that may be relevant for the at least partially autonomous operation of the vehicle 12. This may include, for example, sensors, actuators, and control components. For example, sensors for a steering angle, wheel movements, etc. can be provided. Likewise, actuators for a steering movement, a braking operation, or the like can be provided. An individual health state can be determined for each of these component units 3-i. This can, in particular, be a health state related to the relevance for the autonomous operation of the vehicle 12. The health state can, in particular, be selected from a predefined group of possible health states.In this case, the determination of the health states in the component units 3-i as well as the determination of the health states by the components 2-i and the control device 1, which will be explained below, are each based on an identical group of possible health states.

[0027] The health states can be classified in any suitable manner, in particular in a hierarchical manner. For this purpose, health states can be specified, for example, by a value corresponding to the health state, a label, or in any other suitable manner. In particular, the health state can be specified with respect to the functionalities for the at least partially autonomous operation of the vehicle 12. For example, the following can be provided as a possible group of potential health states: 5: completely healthy 4: limited, but temporarily safe 3: faulty, but still fully available 2: only limited or minimal availability 1: autonomous operation no longer possible

[0028] It is understood, however, that this grouping is only exemplary and does not represent a limitation of the present invention.

[0029] Depending on the component unit 3-i, all potential health states of the given group may be possible in such a component unit 3-i. However, it is also possible that, due to the specific characteristics of a component unit 3-i, one or more potential health states cannot be classified. However, even in such a case, only the specification of one health state from the underlying group of possible health states is possible.

[0030] The group of potential health states preferably corresponds to a (hierarchical) gradation of health states with respect to the autonomous functionalities. The health states can be determined through continuous, cyclical, in particular periodic, or any other monitoring within the component units 3-i. The component units 3-i then initially report the determined health state to the components 2-i. For this purpose, the components 2-i can be communicatively coupled to the component units 3-i in any desired manner. For example, a bus connection or similar is possible for this purpose. The components 2-i can also be communicatively coupled to the control device 1 in order to transmit the health states determined by the components 2-i to the control device 1.

[0031] To determine a component health state, each component 2-i evaluates the unit health states of the component units 3-i assigned to component 2-i and determines the component health state based on these values. In the case of a (hierarchical) gradation for the specification of health states from the group of potential health states, component 2-i can select the health state that corresponds to the lowest or least significant health state of the component units 3-i assigned to component 2-i.

[0032] Analogously, the control device 1 can also select the lowest health state from the component health states to determine the central health state for the vehicle 12.

[0033] The uniform specification of the health states for all component units 3-i, all components 2-i and the central control device 1 enables a particularly simple, efficient and reliable determination of the overall health state for the vehicle 12. All that is required for implementation is that all elements involved, such as control device 1, components 2-i and component units 3-i, determine their health state based on a uniform group of possible health states. This group of possible health states can, for example, be stored locally in each component unit 3-i, each component 2-i and the control device 1. In principle, however, it is also possible to communicate the possible health states via the communicative connections between the individual elements. For example, during commissioning orInitialization of a component unit 3-i or a component 2-i, a data set with the specification of the possible group of predeterminable or predetermined health states is transmitted and stored.

[0034] Based on the overall health status of the vehicle 12 determined by the central control device 1, a suitable operating mode for the vehicle 12 can then be selected. For example, the degree of automation of the vehicle 12 can be restricted depending on the determined overall health status. If, for example, the degree of automation is to be changed due to a manual request from a user or an automated request, the control device 11 of the vehicle 12 can compare the requested degree of automation with the currently determined health status of the overall system. If the determined overall health status of the vehicle 12 fulfills the conditions for the requested operating mode and, if applicable, the other requirements for this level of automation are also met, the requested operating mode can be set.However, if the determined central health status does not meet the requirements for the desired level of automation, the request can be rejected or the maximum possible level of automation can be set as the operating mode according to the determined health status.

[0035] Likewise, it is possible, for example, to (immediately) adjust and, in particular, reduce the level of automation of the vehicle 12 if the overall health status decreases.

[0036] Fig.3 shows a flowchart that may underlie a method for determining a state of health according to one embodiment. The method may in principle comprise any steps that may be required for implementation in accordance with the system described above. Likewise, the system described above, as well as an at least partially autonomously operating device comprising such a system, may comprise any elements that may be required for implementation of the method described below. The method may in particular be used for an at least partially autonomously operating device such as an autonomous vehicle 12. In particular, component units 3-i, components 2-i, and control device 1 may be provided in accordance with the concept described above.

[0037] In a step S1, individual unit health states are determined for each component unit 3-i. In step S2, individual component health states are determined using the determined unit health states of all component units in a respective component 2-i.

[0038] Finally, in step S3, a central health state is determined or ascertained for the at least partially autonomously operating device. The central health state is determined in particular using the ascertained component health states of all components 2-i. Here, too, it is provided to ascertain the health states in the unit components 3-i, the components 2-i, and the control device 1 based on a common group of possible health states. In this hierarchical approach, each node thus preferably determines its health state as the minimum health state of all subordinate nodes or leaves.

[0039] In summary, the present invention relates to determining the health state of an at least partially autonomously operating device, such as an autonomous vehicle. For this purpose, a hierarchical approach for determining the health state is provided, in which the health state can be selected from a group of possible health states. All nodes or leaves in the hierarchy use the same group of possible health states. Preferably, a higher-level node determines its health state as the minimum health state of all subnodes connected to this node. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2017 218 446 A1

[0004]

Claims

[1] System (10) for determining a central health status of an at least partially autonomously operating device (12), comprising: several components (2-i), each component (2-i) comprising at least one component unit (3-i), - wherein each component unit (3-i) is designed to determine an individual unit health status, - wherein each component (2-i) is designed to determine an individual component health state using the determined unit health states of all component units (3-i) in the respective component (2-i); and a control device (1) designed to determine a central health status for the at least partially autonomously operating device (12) using all component health statuses, wherein the unit health states, the component health states and the central health state are each selectable, in particular selected, from a common group of predeterminable or predefined health states. [2] System (10) according to claim 1, wherein the control device (1) is designed to determine an operating mode for the at least partially autonomously operating device (12) using the determined central health state. [3] System (10) according to claim 1 or 2, wherein the control device (1) is designed to receive a request for a desired operating state and to release the desired operating state only if the determined state of health corresponds to the requirements for the desired operating state. [4] System (10) according to one of claims 1 to 3, wherein the control device (1) is designed to determine a maximum permissible degree of automation, in particular a degree of automation according to SAE J3016, for the at least partially autonomously operating device (12) using the determined central health state. [5] System (10) according to one of claims 1 to 4, wherein the predeterminable health states comprise several gradations, wherein the components (2-i) are each designed to select as the component health state the lowest unit health state from the unit health states of all component units (3-i) of the respective component (2-i), and wherein the control device (1) is designed to select the lowest component health state from the component health states of all components (2-i) as the central health state. [6] System (10) according to one of claims 1 to 5, wherein the component units (3-i) in the components are designed to determine the respective unit health status using a fault classification from a monitoring of the respective component unit (3-i). [7] System (10) according to one of claims 1 to 6, wherein the component units (3-i) comprise sensors, actuators and / or control units of the at least partially autonomously operating device (12). [8] At least partially autonomously operating device (12), with a system (10) for determining a central health condition according to one of claims 1 to 7; and a control device (11) which is designed to control the at least partially autonomously operating device (12) using the determined central health state. [9] At least partially autonomously operating device (12) according to claim 8, wherein the at least partially autonomously operating device (12) comprises or is designed as an at least partially autonomously operating vehicle, in particular a motor vehicle. [10] Method for determining a central health state of an at least partially autonomously operating device (12), wherein the device comprises a plurality of components (2-i) each having at least one component unit (3-i), and wherein the method comprises: Determining (S1) individual unit health states for the component units (3-i) of the components (2-i); Determining (S2) individual component health states using the determined unit health states of all component units (3-i) in the respective component (2-i): and Determining (S3) a central health status for the at least partially autonomously operating device (12) using the determined component health statuses of all components (2-i), wherein the unit health states, the component health states and the central health state are each selectable, in particular selected, from a common group of predeterminable or predefined health states. [11] Computer program comprising instructions which cause the system (10) according to any one of claims 1 to 7 and / or the at least partially autonomously operating device (12) to carry out the method according to claim 10. [12] A machine-readable storage medium on which the computer program according to claim 11 is stored.

Images