METHOD AND SYSTEM FOR OPERATING A VEHICLE

Description

[0001] The present invention relates to a method for operating a vehicle. The present invention further relates to a system for operating a vehicle. The present invention further relates to a computer program product. State of the art

[0002] Technical systems that take over tasks from humans must not only perform optical, acoustic, manual, etc. skills of humans at least equivalently, but must also be able to compensate for, e.g., possible error reactions or measurement principle-specific irritations, adjustments to glare situations, shadow formations, etc. at least equivalently.

[0003] Known environmental sensing systems exhibit many technical shortcomings and limitations in accurately representing reality in digital data. They also typically have significant deficiencies regarding external environmental and infrastructure influences. Generally, sensor systems based on radar, lasers, cameras, etc., are purely technical detection systems that are adapted to typical applications, such as road space detection and object recognition, solely through empirical training, calibration, scaling, and other processes.

[0004] Microcomputer-based voting systems are known to exist, developed for specific security tasks. Such systems are known, for example, in aviation technology, where these architectures are usually implemented at the device level and utilize triple-redundant electronics.

[0005] Known safety systems are based exclusively on diagnostics and redundancies, which then enable or directly control corresponding actuators in a comparator.

[0006] WO 201023242 A1 discloses a drive-by-wire system equipped with majority decision-makers, wherein the majority decision-makers use equations to generate an output signal. The system is intended for controlling vehicle components, in particular for steering a vehicle according to the drive-by-wire principle, which transitions to a safe operating state in the event of a safety-critical fault in one of its components.

[0007] US 20150073630 A1 discloses a controller for an electric motor in an electrically powered vehicle. The controller includes, among other things, a voting control module and a bypass module. The voting control module receives an error signal from one of the other two modules. As soon as both modules send an error signal, the voting control module generates a bypass command and forwards it to the bypass module, which executes the command.

[0008] US 20050228546 A1 discloses a fault-tolerant by-wire system for vehicles which generates a clarified signal after a fault is detected, with controllers voting for a particular clarified signal.

[0009] US 2008 / 0036576 A1 discloses a method for fusing far-infrared and visible image data for obstacle detection in automotive applications.

[0010] CN 104 802 793 A describes a method for classifying the behavior of a pedestrian when crossing a roadway.

[0011] Puls Stephan et al.: "Plausibility Verification for Situation Awareness in Safe Human-Robot Cooperation" The 23rd IEEE International Symposium on Robot and Human Interactive Communication, IEEE, August 25, 2014, describes a system for plausibility checks of recognition results in human-robot collaboration (HRC). It uses a framework that recognizes human actions, objects, and their positions in the workspace and checks for inconsistencies based on predefined rules. The risk assessment for robot movement is adjusted based on the plausibility check results to enhance safety.

[0012] Ghahroudi R et al: "A Hybrid Method in Driver and Multisensor Data Fusion, Using a Fuzzy Logic Supervisor for Vehicle Intelligence", Sensor Technologies and Applications, 2007, describes a hybrid approach to data fusion that combines sensor data from the vehicle with the driver's perceptions. A fuzzy logic supervisor (FLS) acts as a control algorithm that fuses the collected data and steers the vehicle, with the driver retaining control but being assisted by the system. Disclosure of the invention

[0013] One object of the present invention is to provide an improved system for operating a vehicle.

[0014] The problem is solved according to a first aspect by a method for operating a vehicle, wherein a sensor device has at least two technologically diversified sensor devices, comprising the steps: Acquisition of environmental information using the sensor device; defined evaluation of the environmental information acquired by the technologically diversified sensor devices with regard to plausibility; and defined use of the environmental information using a result of the defined evaluation of the acquired environmental information.

[0015] In this way, a method is provided in which information from the sensor is checked for correctness and / or usability and then used, exploiting the fact that a decision-making device ("voter") operates on a logic-based rather than empirical basis. According to the invention, the voter is used at a point where it is no longer directly involved with the actual sensor data. Generally, with three paths, there are two homogeneous paths (i.e., with the same functionality or systemic equality) and one diverse path. This allows random errors to be detected effectively by comparing homogeneity, while systematic errors can be controlled or tolerated through diversity.

[0016] According to a second aspect, the task is solved with a system for operating a vehicle; comprising: at least two technologically diverse sensor devices for capturing environmental information of the vehicle; an evaluation device for the defined evaluation of the environmental information captured by the technologically diverse sensor devices with regard to plausibility; and a decision device for the defined use of the environmental information using a result of the defined evaluation of the captured environmental information.

[0017] Advantageous further developments of the process are subject to dependent claims.

[0018] An advantageous further development of the method involves using the sensor device to detect and evaluate the vehicle's driving area. This allows for the advantageous detection of objects within the vehicle's critical driving area, thereby enabling a safer driving characteristic for the vehicle.

[0019] A further advantageous enhancement of the procedure involves verifying the plausibility of an object's presence in the vehicle's vicinity. This helps to improve the detection area around the vehicle and thus enhances the vehicle's driving behavior.

[0020] A further advantageous enhancement of the procedure involves performing the defined evaluation of the technologically diverse sensor devices redundantly. This allows for a further improvement in the system's safety level.

[0021] A further advantageous development of the method involves virtually partitioning the driving space geometrically for the defined evaluation of the technologically diverse sensor devices. This allows the driving space around the vehicle to be advantageously subdivided according to suitable principles and adapted to specific requirements. This can further improve the system's operating characteristics.

[0022] A further advantageous development of the procedure provides that, in the defined evaluation of the technologically diversified

[0023] Sensor devices capture environmental information, and their plausibility is assessed using defined evaluation algorithms that are then compared against each other. This facilitates efficient verification of the data provided by the sensor devices.

[0024] Further advantageous developments of the method provide that the technologically diversified sensor devices include fuzzy logic, and / or non-deterministic systems and / or non-deterministic algorithms, and / or sporadically faulty systems. This advantageously allows for multiple variations in the design of the sensor devices.

[0025] The invention is described in detail below, including further features and advantages, with reference to several figures. These figures are primarily intended to illustrate the essential principles of the invention and are not necessarily drawn to scale.

[0026] Disclosed process features result analogously from corresponding disclosed device features and vice versa. This means, in particular, that features, technical advantages, and embodiments relating to the process result analogously from corresponding embodiments, features, and advantages relating to the system, and vice versa.

[0027] The figures show: Fig. 1 is an overview image showing a basic representation of the operation of the method according to the invention; Fig. 2 is a basic representation of an embodiment of a proposed system for operating a vehicle; Fig. 3 is a representation of the operation of an embodiment of the proposed system; and Fig. 4 is a basic representation of a proposed method for operating a vehicle. Description of embodiments

[0028] In the following, the term "automated vehicle" is used synonymously with the meanings fully automated vehicle, semi-automated vehicle, fully autonomous vehicle and semi-autonomous vehicle.

[0029] Fig. 1 Figure 1 shows an overview image of an embodiment of a proposed system 100 for operating a vehicle (not shown). To carry out the proposed method, the vehicle may have an onboard perception system, such as video and / or lidar and / or radar and / or ultrasonic sensors, for acquiring environmental information about the vehicle. Furthermore, the aforementioned onboard perception system may also be at least partially located in infrastructure in the vicinity of the vehicle.

[0030] Sensor devices S1...Sn, e.g., in the form of radar, lidar, camera, etc., are identified. The data from these sensor devices S1...Sn are transmitted to a first logic unit 20 via a first data line 10. The first logic unit 20 comprises calculation elements 21, 22, and a diagnostic element 23 for processing the transmitted data. The data from the sensor devices S1...Sn are transmitted to a second logic unit 30 via a second data line 11. The second logic unit 30 comprises calculation elements 31, 32, and a diagnostic element 33 for processing the transmitted data.

[0031] The data from the aforementioned first logic unit 20 is fed to a first diagnostic unit 40, which is functionally connected to a first comparator unit 50. The diagnostic unit 40 checks the plausibility of the data from the sensor units S1...Sn, for example. The first comparator unit 50 is functionally connected to a second comparator unit 51. The first comparator unit 50 performs functions that compare the results of the two redundant paths and thus perform a cross-comparison with the second comparator unit 51 before the input to the first decision unit 60. The first decision unit 60 then simply controls the actuators AE1...AEn accordingly.

[0032] The processing of the data from the sensor devices S1... Sn, which are read out via the second data line 11, is carried out analogously as explained above using the second logic device 30, the second diagnostic device 41 and the second comparison device 51.

[0033] It can therefore be seen that the decision units 60 and 61 are located at the end of the signal processing chain, thus performing a plausibility check, evaluation, and analysis of the sensor data. In this way, the decision units 60 and 61 in system 100 are no longer involved in processing the "actual" sensor data. As a result, the possibility of error-free sensor data is largely eliminated, allowing the vehicle's assistance systems controlled by system 100 to operate more reliably.

[0034] The selection regarding the verification of the sensor data for correctness is carried out using a logic structure with the logic devices 20,30, the diagnostic devices 40,41 and the comparison devices 50, 51.

[0035] The two technologically diversified sensor devices can also be designed as two different algorithms based on neural networks, and / or as fuzzy logic, and / or as non-deterministic systems, and / or as sporadically faulty systems.

[0036] In this way, the sensor data from sensor devices S1...Sn can be efficiently checked using System 100, thus advantageously supporting the error-free operation of the entire System 100. As a result, an automated vehicle controlled by System 100 can be operated more safely.

[0037] As a result, the system achieves 100 of Fig. 1 A redundant 2-out-of-4 voter is implemented, using defined conditions, diagnoses, integrity levels, and states as input for the voter configuration. For example, if a sensor device S1...Sn, designed as a camera, detects gray asphalt, the conclusion is drawn that there is no obstacle between the road and the vehicle. A more diverse approach, in accordance with the state of the art, would be to detect that no objects are present in the vehicle's travel path.

[0038] It can therefore be seen that in the proposed system, 100 data points from all sensors are read into redundant evaluation systems largely independently of one another. In this way, random hardware and / or systematic sensor errors can be largely ruled out, since the simultaneity of such errors can be used as a criterion for their improbability. For example, an EMC problem does not simultaneously affect two different signals with the same effect at the same time.

[0039] Sensor fusion and information acquisition, for example through evaluation algorithms (object tracking, image recognition, neural networks, models, simulations, indirect measurements, etc.), are thus performed redundantly on physically different electronic / electrical systems, whereby by comparing the results of the redundancy, random hardware errors are advantageously detected and not incorporated into the evaluation activity of system 100.

[0040] If the system has 100 safety requirements regarding availability (e.g., steering in highly automated driving), the actuators AE1...AEn should preferably be controlled via redundant decision units 60, 61, which perform a synchronization and simultaneity analysis. It is essential that the redundant pathways are not influenced up to the decision units 60, 61, so that errors along the chain of effects do not lead to so-called undesirable common-cause effects.

[0041] Fig. 2 This merely illustrates one possible technical implementation for the [unclear text]. Fig. 1 System 100 shown.

[0042] The sensor devices S1-S3 are cameras, and the sensor devices S4-S6 are lidar sensors. Thus, the sensor device S1...Sn comprises at least two technologically diverse sensor devices. The sensor devices S1...S3 transmit their data to a camera server 70 and to the first decision-making unit 60. The sensor devices S4...S6 transmit their data to building servers 80 and 81, located, for example, in a parking garage, and to the first decision-making unit 60. The building servers 80 and 81 implement the functionalities of the [missing information]. Fig. 1 The logic devices shown are 20, 30, diagnostic devices 40, 41 and comparison devices 50, 51.

[0043] When evaluating the environmental information captured by the technologically diverse sensor devices with regard to plausibility, evaluation algorithms can be defined and processed against each other, thus enabling a cross-check of the plausibility of sensor data.

[0044] The building servers 80 and 81 evaluate the data from the camera server 70 and the sensor devices S4...S6 and transmit their results to a transmitter 90. The transmitter 90 receives a release signal in the form of a valid key from the first decision unit 60, whereupon the transmitter 90 forwards the data to a control unit 91. The transmitter 90 can be functionally connected to the control unit 91, for example, via a wireless connection (e.g., radio link).

[0045] The decision unit 60 can therefore be used to selectively release or block the data streams of the transmitting unit 90. The decision unit 60 is only partially involved in processing the data information from the sensor units and, for example, has no knowledge of the image information from sensor units S1...S3.

[0046] The control unit 91 thus functions as a kind of dead man's switch, which remains active as long as a valid key is transmitted from the decision unit 60 to the transmitter unit 90. This can occur, for example, at defined time intervals (e.g., every 100 ms), whereby, in the event of failure to transmit the key, the vehicle is brought to a safe state via actuators AE1...AEn by means of the control unit 91, e.g., by braking and / or steering in a defined manner.

[0047] As a result, the system achieves 100 of Fig. 1 and Fig. 2 A conditional voter is implemented, which can be configured in a defined way, evaluate different data streams based on a wide variety of parameters and thus reliably control the actuators AE1...AEn based on different factors.

[0048] Such factors can depend on defined conditions, such as: Vehicle operating states (e.g., vehicle accelerating, braking, etc.) System states (e.g., control units are in an initialization phase, reconfiguration, defective, etc.) Traffic situations (e.g., highway driving, busy street, urban environment, etc.)

[0049] Particularly with environmental sensors, the systems can be switched to better systems or evaluation algorithms if they experience technical shortcomings. This allows for adjustments not only to the technical limitations of the sensors and evaluation algorithms, but also to potential errors caused by the environment, such as: Temperature, dirt, etc. distort the measurement results. Rain, snow, fog, etc. limit the detection capability. Electrical faults and tolerances (e.g., component noise, EMC, etc.) distort the sensor data.

[0050] The technical systems can be calibrated or configured to vary over time, so that the voter hides the results of these technical elements for the specified period.

[0051] Thus, the detection algorithms (in the case of lidar, based on a mechanical rotation of the emitter), compensation algorithms, etc., can be adapted to the different data runtimes of the systems.

[0052] In another variant, prioritized voting can be implemented, in which case a sensor device best suited to the respective situation, condition, etc., is given a higher priority, and the information with the highest priority is then considered by the voter. This allows for the effective use of fuzzy logic (e.g., neural networks) or non-deterministic measurement principles. This represents a significant advantage for the reliability of neural networks.

[0053] A key advantage of the proposed System 100 is that the safety verification no longer relies on the fault integrity of the carrier system (including sensors), but solely on its potential impact on vehicle safety. Therefore, only the diagnostics, comparators, voters, and actuator control are implemented according to safety requirements. The diverse functions are subject only to analysis for common-cause failures and are no longer necessary as an implemented safety mechanism in traffic.

[0054] This allows for dealing with unusual influences, as these are recognized as unusual (there are combinations that are not logical) and, for example, the vehicle is then downgraded accordingly (e.g., slowed down, directed to a different route, etc.).

[0055] Fig. 3 Figure 1 illustrates the functionality of the proposed method in an AVP (Automated Valet Parking) environment, where an automated vehicle 300 is guided remotely in a parking space. It is evident that the driving area in front of the vehicle 300 is divided into virtual geometric areas in the form of squares. Square 6C is indicated, which is recognized as freely accessible by the proposed system 100. As a result, the voter structure is scaled to a virtual space corresponding to a chessboard.

[0056] The advantages of the proposed method are particularly evident in automated driving functions in general road traffic, because the complexity arising from the environment, deficiencies, errors, conditions, etc., is much greater than in the AVP environment.

[0057] An extension of chessboard analysis not represented by figures Fig. 3 It can provide that height information of the area in front of the vehicle 300 is also taken into account, thereby generating further plausible data and enabling even more accurate decisions to be made using the decision-making devices that are generated taking into account the height information.

[0058] For example, the virtual area surrounding vehicle 300 can be divided into three height levels. In this way, system 100 recognizes area 6C as freely traversable, whereby in this case a lidar sensor can be positioned at each of the three different height levels on vehicle 300 and senses a traversable area in front of vehicle 300. For clarity, the individual components and elements of system 100 are shown in Fig. 3 not shown.

[0059] Fig. 4 shows a basic sequence of steps in an embodiment of the proposed method.

[0060] In step 200, environmental information is acquired using the sensor device S1...Sn.

[0061] In step 210, a defined evaluation of the environmental information recorded by the technologically diversified sensor devices is carried out with regard to plausibility.

[0062] In step 220, a defined use of the environmental information is carried out using a result of the defined evaluation of the captured environmental information.

[0063] The advantage of the proposed procedure is that it can be used for HAF Level 5 operation (Highly Automated Driving) of the vehicle, in which the driver no longer intervenes in the driving process.

[0064] Advantageously, the proposed method can be implemented as a software program using suitable program code, running on System 100 to operate a vehicle. This allows for easy adaptation of the method.

[0065] The person skilled in the art will modify and / or combine the features of the invention in a suitable manner without deviating from the core of the invention.

Claims

1. Method for operating a vehicle (300), wherein a sensor apparatus (S1... Sn) comprises at least two technologically diversified sensor devices, comprising the steps of: - capturing environmental information by means of the sensor apparatus (S1...Sn); - evaluating the environmental information captured by the technologically diversified sensor devices in a defined manner with regard to plausibility, wherein - data from the sensor devices (S1...Sn) are fed to a first logic device (20) and fed to a second logic device (30), and wherein - the data are fed from the first logic device (20) to a first diagnostic device (40) which is functionally connected to a first comparison device (50), wherein the data are checked for plausibility by means of the diagnostic device (40), and - data from the sensor devices (S1...Sn) are checked for plausibility by means of a second logic device (30), a second diagnostic device (41) and a second comparison device (51), wherein - the first comparison device (50) is functionally connected to the second comparison device (51), and wherein the first comparison device (50) carries out a cross-comparison with the second comparison device (51), - ; and - using the environmental information in a defined manner using a result of the defined evaluation of the captured environmental information, wherein a selection with regard to checking the data for correctness is carried out by means of the logic devices (20, 30), the diagnostic devices (40, 41) and the comparison devices (50, 51) such that a redundant 2-out-of-4-voter is implemented, wherein defined conditions, diagnoses, integrities and states are used as the input for the voter configuration.

2. Method according to Claim 1, wherein a driving space of the vehicle (300) is captured and evaluated by means of the sensor apparatus (S1...Sn).

3. Method according to Claim 1 or 2, wherein a plausibility check of a presence of an object in an environment of the vehicle (300) is carried out.

4. Method according to one of Claims 1 to 3, wherein the defined evaluation of the technologically diversified sensor devices is carried out redundantly.

5. Method according to Claim 4, wherein, for the defined evaluation of the technologically diversified sensor devices, the driving space is partitioned virtually in geometrical terms.

6. Method according to one of the preceding claims, wherein, during the defined evaluation of the environmental information captured by the technologically diversified sensor devices with regard to plausibility, evaluation algorithms are executed in relation to each other in a defined manner.

7. Method according to one of the preceding claims, wherein the technologically diversified sensor devices comprise fuzzy logic, and / or non-deterministic systems and / or non-deterministic algorithms, and / or sporadically faulty systems.

8. Use of a method according to one of the preceding claims during automated parking and / or in an urban environment.

9. System (100) for operating a vehicle (300), comprising: - at least two technologically diversified sensor devices for capturing environmental information relating to the vehicle (300); - an evaluation device (20, 30, 40, 50) for evaluating the environmental information captured by the technologically diversified sensor devices in a defined manner with regard to plausibility, wherein - data from the sensor devices (S1...Sn) are fed to a first logic device (20) and fed to a second logic device (30), and wherein - the data are fed from the first logic device (20) to a first diagnostic device (40) which is functionally connected to a first comparison device (50), wherein the data are checked for plausibility by means of the diagnostic device (40), and - data from the sensor devices (S1...Sn) are checked for plausibility by means of a second logic device (30), a second diagnostic device (41) and a second comparison device (51), wherein - the first comparison device (50) is functionally connected to the second comparison device (51), and wherein the first comparison device (50) carries out a cross-comparison with the second comparison device (51), - and a decision device (60, 61) for using the environmental information in a defined manner using a result of the defined evaluation of the captured environmental information, wherein a selection with regard to checking the data for correctness is carried out by means of the logic devices (20, 30), the diagnostic devices (40, 41) and the comparison devices (50, 51) such that a redundant 2-out-of-4-voter is implemented, wherein defined conditions, diagnoses, integrities and states are used as the input for the voter configuration.

10. Computer program product comprising program code means, configured to carry out the method according to one of Claims 1 to 7 when it runs on a system (100) for operating a vehicle or is stored on a computer-readable data carrier.