Method for operating an autonomously driving vehicle and autonomously driving vehicle

Abstract

The present invention relates to a method for operating an autonomously driving vehicle (1). According to the method, an error reporting system (3) of the autonomously driving vehicle (1) detects a possible failure of all redundancy paths of a steering system (2) of the autonomously driving vehicle (1) and transmits this to a control device (4) of the autonomously driving vehicle (1). The control device (4) performs a plausibility check of the detected failure and causes the journey to be continued if the detected failure does not apply to at least one of the redundancy paths. The invention further relates to an autonomously driving vehicle (1).

Description

[0001] The present invention relates to a method for operating an autonomously driving vehicle. Furthermore, the invention relates to an autonomously driving vehicle.

[0002] Autonomously driving vehicles are known in which a control device can take over control of the autonomous vehicle's driver. An autonomous vehicle places special demands on a steering system for steering the vehicle, as the need for driver intervention must be avoided wherever possible. Accordingly, the steering system must have a particularly low failure probability to ensure safe operation of the steering system in all driving situations. This is usually achieved through redundancies consisting of at least two redundancy paths, so that if one redundancy path fails, the other redundancy path can transfer the autonomous vehicle to a safe state.

[0003] Document DE 10 2019 202 627 B3 discloses a method for operating a steering control device, in which a primary computing device is replaced by a secondary computing device in the event of a faulty operating state. To improve control by the secondary computing device, the secondary computing device simulates or replicates these control commands during normal operation, in which the primary computing device controls the steering. This is intended to ensure the most seamless control transition possible. The documents DE 10 2023 201 213 A1, DE 10 2022 211 124 A1, DE 10 2022 209 357 A1, EP 3 470 301 B1, DE 10 2021 204 239 A1 and DE 10 2021 129 193 A1 disclose further methods for operating steering systems.

[0004] Document WO 2022 / 112397 A1 discloses a method for improving the performance of an autonomously driving vehicle. A driver monitoring module monitors and records the driving behavior of a driver of the autonomously driving vehicle depending on different driving situations. Based on this data, an analysis module then determines whether control data from a control device of the autonomously driving vehicle correspond to this driving behavior.

[0005] To inform the autonomous vehicle about the failure of a redundancy path, and thus, in most cases, about limited steering performance, the steering system uses an error reporting system. Detected errors are forwarded separately for each redundancy path to the necessary control devices in the autonomous vehicle.

[0006] Since many steering functions are derived from manually controlled vehicles, the problem arises of a falsely reported failure of at least one steering side. In manually controlled vehicles, such an error message would result in a display in the instrument cluster, although the driver would still be able to steer the vehicle.

[0007] In an autonomously driving vehicle, the error reporting system is designed such that a failure of a redundancy path reported by the error reporting system is interpreted as an actual failure of the respective redundancy path. Therefore, a control device of the autonomously driving vehicle, in order to avert dangers to occupants or uninvolved third parties, transfers the autonomously driving vehicle to a safe state if a failure of only one of the redundancy paths is reported. This can be achieved, for example, by directly driving onto a shoulder or the edge of the road. This behavior does not yet constitute a hazard.

[0008] Known methods for operating an autonomous vehicle have the disadvantage that if a failure of all redundancy paths is detected, a particularly critical operating situation usually arises, even if at least one redundancy path continues to function flawlessly. In this case, the autonomous vehicle must assume that both redundancy paths have actually failed or are no longer available for the actual task of steering due to errors. Depending on the current driving situation of the autonomous vehicle, a controlled and immediate transition to a safe state may therefore no longer be possible. In the worst case, the autonomous vehicle will decide to execute an immediate emergency stop, for example, with a frozen steering angle.Such a maneuver can pose a significant risk to the safety of the occupants of the autonomous vehicle and of uninvolved third parties.

[0009] It is therefore an object of the present invention to eliminate or at least partially eliminate the disadvantages described above in a method for operating an autonomously driving vehicle and in an autonomously driving vehicle. In particular, it is an object of the present invention to provide a method for operating an autonomously driving vehicle and an autonomously driving vehicle that, in a simple and cost-effective manner, avoid an emergency braking maneuver that is potentially dangerous for other road users and / or at least ensure that the autonomously driving vehicle can continue driving temporarily, for example to drive to a workshop or at least to transfer the autonomously driving vehicle to a safe state, such as by deliberately driving to a safe parking position.

[0010] The above object is achieved by the patent claims. Accordingly, the object is achieved by a method for operating an autonomously driving vehicle having the features of independent claim 1 and by an autonomously driving vehicle having the features of independent claim 8. Further features and details of the invention emerge from the subclaims, the description, and the drawings. Features and details described in connection with the method according to the invention naturally also apply in connection with the autonomously driving vehicle according to the invention, and vice versa, so that with regard to the disclosure of the individual aspects of the invention, reference is always made to each other.

[0011] According to a first aspect of the invention, the object is achieved by a method for operating an autonomously driving vehicle. The method comprises: - Detecting a possible failure of all redundancy paths of a steering system of the autonomously driving vehicle by an error reporting system of the autonomously driving vehicle, - Reporting the detected failure by the error reporting system to a control device of the autonomous vehicle, - performing a plausibility check action to verify the detected failure by the control device, and - Continuing the autonomously driving vehicle in emergency mode if the plausibility check action reveals that the detected failure does not apply to at least one of the redundancy paths. As a plausibility check action, the control device outputs a control pulse to one or more of the redundancy paths for operating a steering actuator of the steering system and compares this with a response of the steering actuator. The control pulse is designed in such a way that it does not cause the autonomously driving vehicle to change direction.

[0012] The autonomously driving vehicle has the steering system for changing a direction of travel. In order to comply with strict legal regulations and to have a low probability of failure, the steering system has at least two redundancy paths via which a steering actuator of the steering system can be operated to adjust a steering angle. It can be provided that each redundancy path has its own steering actuator or that both redundancy paths are designed to control a common steering actuator. Furthermore, it can be provided according to the invention that each redundancy path is designed to control its own steering actuator and, if necessary, to control the steering actuator of the other redundancy path. It can be provided according to the invention that each redundancy path has its own power supply or that the redundancy paths have a common power supply.The redundancy paths preferably each comprise a steering control device and a signal line for transmitting control commands from the steering control device to the steering actuator. The steering control devices are preferably interconnected via a bus, so that only one of the steering control devices takes over steering at a time, while the other steering control device remains in a passive state, thus avoiding steering conflicts.

[0013] First, the error reporting system of the autonomously driving vehicle detects the potential failure of all redundancy paths of the steering system. This occurs, for example, while the autonomously driving vehicle is moving. According to the invention, this can also occur while the vehicle is stationary, for example, at a traffic light or when starting the autonomously driving vehicle. To perform the detection, the error reporting system preferably has one or more sensors designed for this purpose, a measuring electronics system, or the like.

[0014] The detected failure of the redundancy paths is transmitted by the error reporting system to the control device of the autonomously driving vehicle. The control device can, for example, be designed to autonomously control the steering system, a drive system, and a braking system of the autonomously driving vehicle. In a conventional autonomously driving vehicle, the control device would immediately cause the autonomously driving vehicle to perform an emergency stop, preventing it from continuing its journey.

[0015] To prevent such a driving maneuver, the control device performs a plausibility check to verify the detected failure. Within the scope of the invention, a plausibility check is understood to be a measure of the control device by which it is intended to determine, using means other than those of the error reporting system, whether the respective redundancy path has actually failed or whether it is a false alarm, for example, due to particularly sensitive sensors and the strict triggering criteria of the error reporting system.

[0016] If the plausibility check reveals that the detected failure does not apply to at least one of the redundancy paths, the control device continues the autonomous vehicle's journey in emergency mode. Within the scope of the invention, emergency mode is preferably understood to mean a driving operation of the autonomous vehicle in which one or more driving functions are no longer available or at least restricted, with direct shutdown of the vehicle preferably being avoided.

[0017] A method according to the invention for operating an autonomously driving vehicle has the advantage over conventional methods that, using simple means and in a cost-effective manner, continued driving is still possible even if a failure of all redundancy paths is reported, provided that at least the report of the failure of one of the redundancy paths is based on a reporting error and not an actual failure of the redundancy path. The autonomously driving vehicle can thus safely drive to a workshop in emergency mode and does not have to be parked on the spot, as is usual with conventional autonomously driving vehicles. This results in significant advantages for occupants of the autonomously driving vehicle, such as less loss of time and the avoidance of an on-site repair service or towing service.Furthermore, the method according to the invention makes it possible to avoid potentially critical driving maneuvers to stop the autonomously driving vehicle as quickly as possible, so that the risk of endangering the occupants of the autonomously driving vehicle and other road users is advantageously reduced.

[0018] According to a preferred further development of the invention, a method can be provided in which the control device compares, as a plausibility check action, a regulated rack position of a rack of the steering system with trajectory planning data from a trajectory planning device of the autonomously driving vehicle. During normal operation of the autonomously driving vehicle, i.e. during operation in which the steering system is functioning properly, the trajectory planning data are directly related to the rack position of the rack. In other words, the trajectory planning data determine the temporal sequence of the rack position as a function of a vehicle speed of the autonomously driving vehicle. If the control device determines, as part of the plausibility check action, that the current rack position orIf the progression of the rack positions corresponds to the specification of the trajectory planning data, it can be concluded that at least one redundancy path has not failed and is therefore still functioning. This allows it to be determined that the detected failure is not true. Such a plausibility check can, for example, take between 0.5 and 1.5 seconds. This has the advantage of providing a particularly reliable plausibility check using simple means and in a cost-effective manner. This ensures a particularly high level of operational reliability of the autonomous vehicle.

[0019] It is preferred according to the invention that the control device compares a desired trajectory of the autonomously driving vehicle with an actual trajectory of the autonomously driving vehicle as a plausibility check action. The desired trajectory can be determined, for example, by the trajectory planning device of the autonomously driving vehicle, for example based on route data, traffic data, roadway data, or the like. The actual trajectory can be detected, for example, using sensor data of the autonomously driving vehicle, such as radar data, lidar data, GPS data, or the like. If the control device determines, as part of the plausibility check action, that the actual trajectory corresponds to the desired trajectory, it can be concluded that at least one redundancy path has not failed and is therefore still functioning. In this way, it can be determined that the detected failure is not applicable.Such a plausibility check can take, for example, between 0.5 and 1.5 seconds. This has the advantage of providing a particularly reliable plausibility check using simple and cost-effective means. This ensures a particularly high level of operational reliability for the autonomous vehicle.

[0020] According to the invention, the control device outputs a control pulse to one or more of the redundancy paths for operating a steering actuator of the steering system as a plausibility check action and compares this with a response of the steering actuator. A control pulse is understood in particular to be a short control command for the steering actuator which, during normal operation of the steering system, causes a measurable response of the steering actuator. Preferably, the control pulse is initially output to only one of the redundancy paths, and the response of the steering actuator is compared with the control pulse. Particularly in the event that there is no response from the steering actuator, the control pulse is subsequently output to another redundancy path, and the response of the steering actuator is compared with the control pulse. By responding to the control pulse at different times to the redundancy paths, it is thus easy to determine which redundancy path is functioning and which is not.The control pulse preferably has a length of less than 1 second. More preferably, the control pulse has a length of approximately 0.1 seconds or less than 0.1 seconds. This has the advantage of providing a particularly reliable plausibility check using simple means and in a cost-effective manner. This ensures particularly high operational reliability of the autonomously driving vehicle.

[0021] According to the invention, the control pulse is designed in such a way that it does not cause any change in direction of the autonomously driving vehicle. A perceptible change in direction, within the scope of the invention, is understood to mean a change in direction that is perceptible to an average occupant of the autonomously driving vehicle. The control pulse preferably has a duration and / or amplitude such that it only causes a measurable reaction of the steering actuator, which is, however, so small that it does not cause any perceptible change in direction of the autonomously driving vehicle. Alternatively, the control pulse can also address the steering actuator in different directions one after the other, so that the control pulses overall cancel each other out or at least only weaken each other. Due to the inertia of the autonomously driving vehicle, no change in direction occurs.This has the advantage of providing a particularly reliable plausibility check using simple and cost-effective means. This ensures a particularly high level of operational reliability for the autonomous vehicle.

[0022] Preferably, the control device outputs a control command for steering the autonomously driving vehicle to one or more of the redundancy paths for operating a steering actuator of the steering system as a plausibility check action and compares this with data from a traction control system of the autonomously driving vehicle. The control command thus differs from the control impulse in that it can cause a noticeable change in direction of the autonomously driving vehicle. This change in direction can be determined by the traction control system of the autonomously driving vehicle, for example, through measurements by sensors of the traction control system designed for this purpose, in particular by measuring lateral accelerations or the like.If the control device determines during the plausibility check that the traction control system data corresponds to a plausible response of the autonomous vehicle to the control command, it can be concluded that at least one redundancy path has not failed and is therefore still functioning. This allows it to be determined that the detected failure is not true. This has the advantage of providing a particularly reliable plausibility check using simple means and in a cost-effective manner. This ensures a particularly high level of operational reliability of the autonomous vehicle.

[0023] According to a preferred embodiment of the invention, the journey continues in emergency mode while suppressing emergency braking. In other words, a braking system of the autonomously driving vehicle is operated in emergency mode in such a way that the implementation of the maximum possible braking torque is avoided wherever possible. This means that emergency mode should not necessarily lead to emergency braking. Emergency braking due to a traffic situation, for example, due to the incorrect behavior of a vehicle ahead, can still be possible according to the invention. This has the advantage that a particularly high level of operational reliability of the autonomously driving vehicle can be ensured using simple means and in a cost-effective manner.

[0024] Particularly preferably, the journey is continued at a reduced driving speed and / or a permitted maximum speed that is limited compared to the normal operating state of the autonomously driving vehicle. In other words, the autonomously driving vehicle preferably travels slower in emergency operation than in normal operation in the same traffic situation. Additionally or alternatively, the autonomously driving vehicle is preferably operated such that the predefined maximum speed, which is lower than a potential maximum speed of the autonomously driving vehicle in normal operation, is not exceeded. The predefined maximum speed can, for example, be 50% or less of the potential maximum speed. For example, the predefined maximum speed can be 50 km / h or 30 km / h.The predefined maximum speed can also depend on the degree of plausibility of the detected failure. The more unlikely the actual failure of the steering system, the higher the predefined maximum speed can be selected. This has the advantage of ensuring a particularly high level of operational reliability of the autonomous vehicle using simple and cost-effective means.

[0025] According to the invention, it is preferred that the journey is continued with a limited steering angle range and / or a limited steering speed compared to the normal operating state of the autonomously driving vehicle. A limited steering angle range means that the maximum adjustable steering angle in emergency operation is smaller than the maximum adjustable steering angle in normal operation. A limited steering speed means that the maximum achievable angular speed of the steering in emergency operation is smaller than the maximum achievable angular speed of the steering in normal operation. Thus, the mechanical stress on the steering system in emergency operation is reduced compared to normal operation, so that the risk of total failure of the steering system is reduced. This has the advantage that a particularly high level of operational reliability of the autonomously driving vehicle can be ensured using simple means and in a cost-effective manner.

[0026] According to a second aspect of the invention, the object is achieved by an autonomously driving vehicle. The autonomously driving vehicle has a steering system, an error reporting system, a control device, a drive system, and a braking system. According to the invention, the autonomously driving vehicle is designed to carry out a method according to the invention.

[0027] The drive system is designed to drive the autonomously driving vehicle. The drive system preferably has an electric motor and a traction battery for driving the autonomously driving vehicle. The braking system is designed to brake the autonomously driving vehicle. The braking system is preferably designed for recuperation. The steering system is designed to steer the autonomously driving vehicle. For this purpose, the steering system has at least two redundancy paths so that, in the event of a redundancy path failure, steering of the autonomously driving vehicle is still possible. The error reporting system is designed to detect a possible failure of a redundancy path as well as all redundancy paths of the steering system of the autonomously driving vehicle. Furthermore, the steering system is designed to report the detected failure to the control device.

[0028] The control device is configured to operate the steering system. Preferably, the control device is also configured to control the drive system and / or the braking system. The control device is also configured to receive the message of the detected failure from the error reporting system. Furthermore, the control device is configured to perform the plausibility check action to verify the detected failure. Finally, the control device is configured to initiate or perform a continuation of the autonomously driving vehicle's journey in emergency mode if the plausibility check action reveals that the detected failure does not apply to at least one of the redundancy paths.

[0029] The autonomously driving vehicle according to the invention provides all of the advantages already described for a method for operating an autonomously driving vehicle according to the first aspect of the invention. Accordingly, the autonomously driving vehicle according to the invention has the advantage over conventional autonomously driving vehicles that continued driving is possible using simple means and in a cost-effective manner even if a failure of all redundancy paths is reported, provided that at least the report of the failure of one of the redundancy paths is based on a reporting error and not on an actual failure of the redundancy path. The autonomously driving vehicle can thus safely drive to a workshop in emergency mode and does not have to be parked on the spot, as is usual with conventional autonomously driving vehicles.This results in significant advantages for occupants of the autonomously driving vehicle, such as reduced time loss and the avoidance of on-site repair or towing services. Furthermore, the autonomously driving vehicle according to the invention can avoid potentially critical driving maneuvers required to stop the autonomously driving vehicle as quickly as possible, thus advantageously reducing the risk of endangering the occupants of the autonomously driving vehicle and other road users.

[0030] An autonomously driving vehicle according to the invention and a method for operating an autonomously driving vehicle according to the invention are explained in more detail below with reference to the drawings. They show schematically: Fig. 1 shows a side view of a preferred embodiment of an autonomously driving vehicle according to the invention, and Fig. 2 shows a flow chart of a preferred embodiment of a method according to the invention.

[0031] Elements with the same function and mode of action are listed in the Fig. 1 and Fig. 2 are each provided with the same reference numerals.

[0032] In Fig. Figure 1 schematically shows a side view of a preferred embodiment of an autonomously driving vehicle 1 according to the invention. The autonomously driving vehicle 1 has a steering system 2, an error reporting system 3, a control device 4, a drive system 4 with an electric motor 7 and a traction battery 8, and a braking system 6. The control device 4 is preferably designed to control the steering system 2, the drive system 5, and the braking system 6.

[0033] Fig.Figure 2 schematically shows a preferred embodiment of a method according to the invention in a flowchart. In a first method action 100, the error reporting system 3 of the autonomously driving vehicle 1 detects a possible failure of all redundancy paths of the steering system 2 of the autonomously driving vehicle 1. In a second method action 200, the error reporting system 3 reports the detected failure of all redundancy paths of the steering system 2 to the control device 4 of the autonomously driving vehicle 1.

[0034] In a third procedural action 300, the control device 4 performs a plausibility check to verify the detected failure of all redundancy paths of the steering system 2. In a fourth procedural action 300, the control device 4 continues the journey of the autonomously driving vehicle 1 in emergency mode if the plausibility check shows that the detected failure does not apply to at least one of the redundancy paths. List of reference symbols 1 autonomous vehicle 2 Steering system 3 Error reporting system 4 Control device 5 Drive system 6 Braking system 7 Electric motor 8 Traction battery 100 first procedural action 200 second procedural action 300 third procedural action 400 fourth procedural action

Claims

[1] Method for operating an autonomously driving vehicle (1), comprising: - detecting a possible failure of all redundancy paths of a steering system (2) of the autonomously driving vehicle (1) by an error reporting system (3) of the autonomously driving vehicle (1), - Reporting the detected failure by the error reporting system (3) to a control device (4) of the autonomously driving vehicle (1), - performing a plausibility check action to verify the detected failure by the control device (4), and - Continuing the journey of the autonomously driving vehicle (1) by the control device (4) in an emergency mode if the plausibility check action shows that the detected failure does not apply to at least one of the redundancy paths, wherein the control device (4) outputs a control pulse to one or more of the redundancy paths for operating a steering actuator of the steering system (2) as a plausibility check action and compares it with a reaction of the steering actuator, and wherein the control pulse is designed such that no change in direction of the autonomously driving vehicle (1) can be effected as a result. [2] Method according to claim 1, characterized by that the control device (4) compares, as a plausibility check action, a regulated rack position of a rack of the steering system (2) with trajectory planning data of a trajectory planning device of the autonomously driving vehicle (1). [3] Method according to claim 1 or 2, characterized bythat the control device (4) compares a desired trajectory of the autonomously driving vehicle (1) with an actual trajectory of the autonomously driving vehicle (1) as a plausibility check action. [4] Method according to one of the preceding claims, characterized by that the control device (4) outputs, as a plausibility check action, a control command for steering the autonomously driving vehicle (1) to one or more of the redundancy paths for operating a steering actuator of the steering system (2) and compares it with data from a traction control system of the autonomously driving vehicle (1). [5] Method according to one of the preceding claims, characterized by that the journey continues in emergency mode while suppressing emergency braking. [6] Method according to one of the preceding claims, characterized bythat the journey is continued at a reduced driving speed and / or a permitted maximum speed that is limited compared to a normal operating state of the autonomously driving vehicle (1). [7] Method according to one of the preceding claims, characterized by that the journey is continued with a limited steering angle range and / or a limited steering speed compared to a normal operating state of the autonomously driving vehicle (1). [8] Autonomously driving vehicle (1), comprising a steering system (2), an error reporting system (3), a control device (4), a drive system (5) and a braking system (6), characterized by that the autonomously driving vehicle (1) is designed to carry out a method according to one of the preceding claims.

Images