METHOD FOR OPERATING A VEHICLE SET UP FOR AUTOMATED DRIVING OPERATION

Description

[0001] The invention relates to a method for operating a vehicle configured for automated driving according to the preamble of patent claim 1.

[0002] DE 10 2015 003 124 A1 describes a method for operating a vehicle in automated driving mode. During normal operation of automated driving mode, an emergency operation target trajectory is continuously determined and stored, which is to serve as the basis for automated trajectory control of the vehicle after the occurrence of at least one error event. Upon detection of the occurrence of at least one error event, an emergency operation mode is activated, in which automated trajectory control of the vehicle is initiated and carried out according to the emergency operation target trajectory stored before the occurrence of the at least one predetermined error event for a predetermined period of time and / or until the vehicle comes to a standstill, if and as long as no driver of the vehicle takes over control of the vehicle.

[0003] Furthermore, DE 10 2017 011 808 A1 discloses a method for controlling the movement of a vehicle in automated driving mode and a device for carrying out the method. The method provides that the automated driving mode can be switched from a regular operating mode, in which the vehicle is automatically guided to a predetermined target position, to an emergency operating mode, in which the vehicle is automatically guided to an emergency stop position. Control in regular operating mode is carried out by means of a main control unit, and in emergency operating mode by means of a secondary control unit. The automated driving mode is switched from regular operating mode to emergency operating mode if a functional impairment of the main control unit is detected in regular operating mode.Control in regular operating mode is carried out based on a regular target trajectory leading to the target position, which is continuously determined by the main control unit in regular operating mode. Control in emergency operating mode is carried out based on an emergency operating target trajectory leading to the emergency stop position, which is stored in the secondary control unit and was determined by the main control unit in regular operating mode before the operating mode was switched to emergency operating mode and was fed to the secondary control unit for storage. In regular operating mode, in addition to the emergency operating target trajectory, a lane profile of a lane traveled by the vehicle, associated with the emergency operating target trajectory, is also determined and fed to the secondary control unit for storage. Furthermore, it is intended that the emergency operating target trajectory and the associated lane profile are determined in a vehicle-fixed coordinate system of the main control unit.In emergency operation mode, the lane path of the lane traveled by the vehicle is determined in a vehicle-fixed coordinate system of the secondary control unit, and in emergency operation mode, a deviation between the coordinate systems of the main control unit and the secondary control unit is compensated based on the lane path stored in the secondary control unit and the lane path determined by the secondary control unit.

[0004] WO 2020 / 075 477 A1 discloses a vehicle control system for a vehicle comprising two control units in which functions for automated driving are implemented. The first control unit plans a target trajectory for the vehicle, and the second control unit plans an emergency operation target trajectory (backup trajectory), according to which the vehicle is to be stopped in the vehicle's lane in the event of a failure of the first control unit.

[0005] From US 2017 / 248 951 A1 a method for controlling a vehicle is known, in which it is provided that signals representing aspects of the vehicle and the vehicle environment are received from a plurality of sources, that a confidence factor is determined for at least one of the signals and that, depending on the confidence factor, the control of the vehicle is switched between different stages of autonomous operation.

[0006] The invention is based on the object of specifying a method for operating a vehicle in automated driving mode.

[0007] The object is achieved according to the invention by a method which has the features specified in claim 1.

[0008] Advantageous embodiments of the invention are the subject of the subclaims.

[0009] A method for operating a vehicle configured for automated driving provides that, in a regular operating mode of automated driving, the vehicle is automatically guided to a target position by means of a main control unit, and in an emergency operating mode, is automatically transferred to a safe stopping position by means of a secondary control unit. According to the invention, the main control unit continuously checks the functional readiness of the secondary control unit, and depending on the checked functional readiness, a decision is made as to whether approval for automated driving of the vehicle should be granted or withdrawn. Automated driving is activated only when approval has been granted and deactivated when approval is withdrawn.

[0010] By applying this method, a maximum availability of a fallback path function of the vehicle, i.e., availability of the emergency operation mode, can be achieved with comparatively little technical effort. Thus, the availability of automated driving is not restricted or is only imperceptibly restricted.

[0011] Dead reckoning data and camera track data are required for the fallback path function, so that no redundant sensors, especially environmental sensors, are needed for the emergency operation mode and the regular operation mode.

[0012] This procedure allows a desired quality or availability of automated driving to be set. The regular operating mode of automated driving can therefore only be activated if the fallback path function, i.e., the emergency operating mode for transferring the vehicle to a safe stop position, is available.

[0013] In one embodiment of the method, in order to check the functional readiness of the secondary control unit, it is checked whether data used by the secondary control unit to locate the vehicle when driving the vehicle meet specified quality requirements.

[0014] The quality requirements relate in particular to lane detection, i.e., the detection of the lane markings of a vehicle's lane, so that the vehicle can be transferred to the safe stop function. If the data does not meet the specified quality requirements, the vehicle is decelerated more strongly than usual when transferring to the safe stop position, so that the vehicle is brought to a standstill relatively quickly. This largely prevents the vehicle from posing a danger to other road users in the vehicle's vicinity.

[0015] In a further development, the main control unit checks dead reckoning data and acquired camera lane data for compliance with the specified quality requirements. Based on the camera lane data, a match between a detected lane and an actual lane is determined, and a corresponding probability is determined, making it possible to move the vehicle to a safe stopping position. When determining the probability of the match, factors such as the uniqueness of lane features in the image, a detection history, and / or a match with a result of an independent lane detection algorithm can be taken into account.

[0016] The coupled navigation data is data that is available, for example, from a so-called coupled navigation system. Using statistical methods, position data from a satellite-based positioning unit is combined with inertial sensor data from the vehicle, such as accelerations, rotation rates (e.g., about a longitudinal, transverse, and / or vertical axis of the vehicle), and other driving state data such as wheel rotation information and wheel angles (i.e., the steering angle of a front axle and, if applicable, a rear axle), in order to achieve maximum accuracy and reliability in localizing the vehicle.

[0017] In a further embodiment of the process, a decision is made regarding the granting or revocation of the approval depending on whether the specified quality requirements are met. In particular, the availability of the fallback path function is determined based on the camera track data and the dead reckoning data, and a decision is made as to whether automated driving of the vehicle in regular operating mode is possible.

[0018] According to the invention, the approval or withdrawal of approval for automated driving is decided based on decision criteria that are specified as a function of a speed limit in relation to the current driving speed of the vehicle. At a comparatively low vehicle speed, i.e., when the speed limit is exceeded, approval for automated driving is granted if the dead reckoning data or the camera track data are available and meet the specified quality requirements. This means that automated driving is approved when the speed limit is exceeded if the dead reckoning data or the camera track data meet the specified quality requirements.

[0019] In a possible further development, automated driving operation will be enabled when the speed limit is exceeded if both the dead reckoning data and the camera track data meet the specified quality requirements.

[0020] Embodiments of the invention are explained in more detail below with reference to a drawing.

[0021] The following shows: Fig. 1 schematically shows a sequence of a method for deciding whether to activate an automated driving mode.

[0022] The single figure shows a sequence of a method for deciding whether to activate automated driving in a vehicle not shown in detail.

[0023] A vehicle-based assistance system for automated driving, especially for highly automated driving, is connected to a variety of information sources in order to control the vehicle relatively safely in its lane.

[0024] These information sources include sensors, such as cameras, stereo cameras, lidar-based sensors, radar-based sensors, ultrasound-based sensors, long-range radar sensors, multi-mode radar sensors, surround view systems, digital maps, inertial sensors, driving state sensors, satellite-based positioning units and rear view cameras.

[0025] The assistance system comprises a main control unit and a secondary control unit. The main control unit continuously determines a target trajectory along which the vehicle is guided to a target position in a regular operating mode of automated driving. In addition, the main control unit continuously determines an emergency operation target trajectory along which the vehicle is brought to a safe stopping position in an emergency operating mode of automated driving. The emergency operation target trajectory is determined during the regular operating mode and stored in a secondary control unit, which is also referred to as a backup control unit. The vehicle is guided to the target position by trajectory control via the main control unit, and the vehicle is guided to the safe stopping position by trajectory control via the secondary control unit.

[0026] The main control unit sends a driving command to the secondary control unit, so that if the main control unit fails, the secondary control unit assumes a driving task for the vehicle and controls it according to the driving command, i.e., according to the emergency operation target trajectory. The secondary control unit can be a control unit of a vehicle's driving dynamics control system.

[0027] To execute the driving instructions, the secondary control unit only has access to a camera with lane detection and sensor data for dead reckoning, particularly dead reckoning data. The following describes a method for achieving a relatively high-availability fallback path function, i.e., emergency operating mode, with relatively high quality using camera lane data and dead reckoning data.

[0028] In the event that the fallback path function is only available when camera track data and dead reckoning data are available, the availability of automated driving would be relatively severely restricted and would be continuously deactivated, as there may be continuous interruptions in the acquisition of camera track data and dead reckoning data.

[0029] The fallback path function represents a fallback solution in automated driving mode. For this reason, it is only possible to activate the vehicle's automated driving mode if the fallback path function, i.e., the emergency operating mode, is ready and available. The readiness of the fallback path function is signaled to the main control unit by enabling automated driving mode.

[0030] If operating conditions change, the fallback path function can revoke the authorization for automated driving. The availability of the fallback path function is assessed in the main control unit, even though the fallback path function is implemented in the secondary control unit. The assessment by the main control unit is possible because signals for assessing the functionality of the secondary control unit and other required components are also available to the main control unit.

[0031] The fallback path function uses dead reckoning data or camera track data to locate the vehicle. If the vehicle's emergency mode is activated and neither dead reckoning data nor camera track data are available to the secondary control unit, the vehicle is decelerated relatively sharply to bring it to a standstill as quickly as possible, especially to a safe stop position.

[0032] The vehicle's camera, particularly a stereo multi-purpose camera, continuously records the distances between the vehicle's centerline and left and right lane markings that define the vehicle's lane. Furthermore, information such as a detected lane structure is determined based on the recorded camera lane data. The lane structure describes a detected structure, such as lane markings in the vehicle's own lane, the adjacent lane, a road edge, or a raised road boundary, such as a guardrail. This lane structure is coded as a fictitious lane and provided to the secondary control unit.

[0033] In addition, the camera provides quality signals, a width of the detected lane and a detection status, particularly with respect to a detected lane or a temporally extrapolated lane, using its camera lane data.

[0034] The vehicle can be guided in automated driving mode, particularly in emergency mode, based on a detected lane marking or, ideally, on lane markings detected on both sides.

[0035] Lane detection requires that corresponding structural features are present and can be identified in the detected environmental conditions using the captured camera image data. In addition to missing lane markings on a roadway, glare and / or obstructed visibility, such as fog, and / or contamination of a camera window can impair the capture of camera lane data.

[0036] Quality requirements are specified for the camera lane data, with a quality requirement representing the probability that the captured camera lane data matches a real lane. Characteristics such as the uniqueness of lane features in captured image data, a detection history, or a match with a result from another independent lane detection algorithm can be used to determine the probability.

[0037] One signal related to the quality requirements is a variance of the currently displayed lateral distance from the vehicle's centerline to the lane marking in square meters. Another signal specifies a variance of the currently displayed yaw angle of the vehicle, i.e., the tangent of the vehicle's longitudinal axis to the lane marking, in degrees squared. The signals are determined individually for each lane marking on the left and right sides. The variances are typically derived from the results of a Kalman filter.

[0038] The dead reckoning data is data obtained, for example, from a coupled navigation system. Using statistical methods, such as a Kalman filter, position data (e.g., longitude, latitude, v-North, v-East) from a satellite-based positioning unit are combined with inertial sensor data and other driving state data to achieve maximum vehicle localization accuracy.

[0039] Inertial sensor data includes acceleration and rotation rates, for example, about a longitudinal, transverse, and / or vertical axis of the vehicle. Further driving state data includes wheel rotation information and wheel angles, particularly with regard to the steering angle of a front and, if applicable, a rear axle.

[0040] The dead reckoning data to be made available for vehicle control in the activated emergency operating mode in order to use them for trajectory control, i.e. for driving instructions, can be, for example, a vehicle's longitudinal and lateral speed or a vehicle movement in a northerly and easterly direction, absolute or relative locations or angles and speed.

[0041] Dead reckoning data is most accurate when a sufficient number of satellites, especially 10 or more, are detected and correction data are available. If a sufficient number of satellites are detectable for position determination, this is referred to as normal mode operation; otherwise, it is referred to as bridging mode.

[0042] If the conditions for normal mode operation are not met, the signals degrade over time, becoming increasingly stronger the fewer satellites are available. Due to physical conditions, minor deviations may occur during the integration of the dead reckoning data, and thus also in emergency mode, which over time lead to an increasing deviation from the vehicle's target position, especially in its lane.

[0043] Based on the parameters of the camera and the satellite-based positioning unit, in particular the camera track data and the dead reckoning data, the availability and unavailability of the fallback path function is decided in the main control unit as the fallback path function readiness determination module.

[0044] If the vehicle is traveling at a current speed below a specified speed limit, approval for automated driving is granted if the available camera track data or the available dead reckoning data meet specified quality requirements. By selecting a specific parameter, approval can also be granted only if the camera track data or the dead reckoning data are available. Above the speed limit, the camera track data and the dead reckoning data must meet the specified quality requirements.

[0045] Since a situation for activating the fallback path function occurs comparatively rarely and is based on empirical values ​​regarding the detection performance of a camera for lane recognition as well as the accuracy and availability of dead reckoning data, particularly in bridging mode, the criteria can be individually parameterized for components from vehicle suppliers.

[0046] The speed limit parameter is defined or specified in such a way that the quality of the coupling of the sensor data maintains a specified accuracy. This specified accuracy must be maintained for a defined period of time, which in turn essentially results in a dependency on the driving speed, stopping distance, deceleration, and normal mode or bridging mode.

[0047] The speed limit of 40 km / h is selected when, for example, a desired lateral accuracy of 0.2 meters with a sigma is maintained for all scenarios such as lane-centered driving, evasive maneuvering, cornering, and / or comparatively high deceleration, and for 20 seconds in bridging mode, for example, without satellite reception. These parameters can ideally be set in the main control unit as so-called SCN parameters.

[0048] Individual lane parameters can also be omitted or, depending on the camera solution, parameters can be added.

[0049] If camera track data and dead reckoning data are available when the fallback path function is active, trajectory control is based on the camera track data. If no camera track data is available, trajectory control is performed based on the dead reckoning data.

[0050] With regard to the camera track data, the absolute accuracy of a result essentially does not change over time, i.e. there is no drift, and the lanes also provide orientation for people regarding vehicle positioning.

[0051] In a fault-free system for automated driving, the sensors are available as information sources. A power supply, particularly via a so-called backup electrical system, and a bus network of the sensors are designed in such a way that even in the event of a main electrical system failure, these components remain available for the fallback path function, particularly for the secondary control unit. The main control unit is connected to the main electrical system along with other vehicle sensors.

[0052] Conversely, in the event of a failure of the backup vehicle electrical system, the main control unit can fulfill the driving instructions without camera track data and dead reckoning data until the driver takes over the driving task, since a sufficient number of sensors, in particular environmental sensors, are available in the vehicle.

[0053] In one embodiment of the method, when the emergency operating mode is activated without camera track data and dead reckoning data, the vehicle is decelerated more strongly, and the most recently detected wheel angle of the vehicle's steering system is retained. Thus, a compromise is reached with regard to a future driving course based on the current situation, and driver intervention detection based on a steering torque applied by a driver is retained.

[0054] As described above, the fallback path function can be implemented in the secondary control unit, which can be a control unit of a vehicle's driving dynamics control system or another control unit. The driving dynamics control system is particularly suitable as a secondary control unit because such a solution is cost-effective, no additional components are required, and a braking function is already implemented in the control unit.

[0055] In one embodiment of the fallback path function readiness determination module, automated driving, in particular the regular operating mode, can be deactivated for a route section based on information from a digital map, provided the digital map indicates that lane markings are missing on both sides of the lane or on only one side. Furthermore, the digital map provides information on the distance the vehicle must travel until lane detection is possible again, so that this information can be taken into account by the fallback path function readiness determination module. Since such information is available in the main control unit, allocating the fallback path readiness determination to the main control unit is sensible.The camera's lane detection capability can also be trained and learned by any vehicle equipped with a camera, and this information can be made available to a service provided by a computer unit linked to the vehicle. This allows the digital map to be continuously updated.

[0056] The Figure 1 The procedure shown applies both to the approval of automated driving and to the withdrawal of this approval, although the parameters of the conditions differ. The parameters are fixed values.

[0057] The procedure begins with Start S and provides that the release is granted depending on the vehicle's speed. If the current speed is below the speed limit, the availability of the camera track data and the dead reckoning data is determined differently than if the current speed exceeds the speed limit. The availability of the camera track data meets specified quality requirements, particularly the properties of the detected signals.

[0058] If the current driving speed falls below the speed limit, a first process step (V1) checks whether the camera track data meets specified quality requirements. Furthermore, a second process step (V2) checks whether the dead reckoning data meets the specified quality requirements.

[0059] If it is determined in a third process step V3 that either the recorded camera track data or the dead reckoning data meet the quality requirements, in a fourth process step V4 the release for automated driving of the vehicle for a driving speed below the specified limit speed is granted, since the fallback path function for automated driving is available at a current driving speed below the limit speed.

[0060] Since lane markings can often be obscured by other vehicles in traffic jams, it is also possible to query only the availability of the dead reckoning data, taking quality requirements into account. This can be configured using a parameter.

[0061] If the vehicle is traveling at a current speed above the speed limit of, for example, 40 km / h, a fifth process step (V5) determines whether camera track data is available and meets the specified quality requirements. The speed limit can be 40 km / h, although the speed limit can deviate significantly upwards or downwards depending on the accuracy of the dead reckoning data.

[0062] In a subsequent sixth process step V6, it is checked whether dead reckoning data are available and meet the specified quality requirements.

[0063] Subsequently, in a seventh method step V7, it is determined whether both the camera track data and the dead reckoning data meet the specified quality requirements, so that the method jumps to the fourth method step V4 and the automated driving operation is released for a driving speed exceeding the specified limit speed.

[0064] In an eighth process step V8, the approval for automated driving of the vehicle is then granted or withdrawn because the conditions of the fallback path function are met or not met.

[0065] An analogous procedure is followed for the withdrawal of approval for automated driving.

[0066] The procedure therefore provides that automated driving operation is enabled or terminated depending on the current driving speed of the vehicle.

[0067] Specifically, when the current driving speed exceeds the specified speed limit, the left and right lane markings are detected independently, allowing the left and right lane marking conditions to be checked individually. The conditions are checked against the camera lane data.

[0068] Partial approval for a lane marking occurs when certain specified parameters, in particular the quality signals mentioned above, are met. Approval is granted when the quality signals are met with regard to their conditions, for example, even for only one side.

[0069] Certain quality signals represent a measure of certain properties of the camera lane data. In particular, as described above, structural features are determined. Structural features represent a structure that has been detected, such as the lane marking of the vehicle's own lane on a specified side or derived from the other side or the adjacent lane, or a road edge or a raised road boundary, such as a guardrail. For example, the right lane marking can be derived from the left lane marking.

[0070] The value of the variable increases with the distance between the lane marking and the vehicle, thus decreasing the quality of the information. If the lane marking of the vehicle's own lane is signaled as recognized on the corresponding side, permission for automated driving can be granted. Permission is revoked, for example, if only the adjacent lane or a higher lane boundary is detected.

[0071] A quality signal represents the status of lane detection and distinguishes between no detection, a current detection (i.e., detection of the vehicle's lane), and a prediction (i.e., a result of a last lane detection). If the value of this variable indicates detection, automated driving can be enabled. The enable is revoked if no lane is detected.

[0072] Another quality signal represents the width of the detected lane and thus of the detected lane markings, and indicates the distance in front of the vehicle up to which the lane markings were detected. The larger this value, the better the detection and thus the reliability and accuracy of the result. If the width is more than 50 meters, for example, the authorization for automated driving can be granted. Authorization is revoked, and a takeover request is issued accordingly if the value is less than 10 meters.

[0073] In particular, the release is withdrawn if one of the quality signals for one or both lane markings delimiting the vehicle's lane is not met for a specified period of time, for example 7 seconds, or a specified distance of, for example, 200 meters.

[0074] A delay in revoking the authorization due to the specified time period, e.g., 7 seconds, or the specified distance as a route-related delay is due to the fact that the camera track data and / or the dead reckoning data are usually recorded again after a relatively short interruption. The termination of automated driving mode until the driver takes over the driving task may take longer under certain circumstances.

[0075] The conditions for enabling or withdrawing the enablement for the automated driving operation of the vehicle with regard to the dead reckoning data when the current driving speed of the vehicle exceeds the specified speed limit are essentially the same as the conditions mentioned above when the speed limit is exceeded.

[0076] In particular, the release is granted when the own lane is detected by the lane marking on the corresponding side.

[0077] All values ​​of the variables and parameters mentioned are examples and can be adapted to existing sensors.

[0078] With regard to the dead reckoning data, clearance is granted when a quality signal indicates a specified state, in particular the aforementioned normal mode. This state is present when a sufficient number of satellites, in particular more than 10 satellites, are detected and correction data are available. If fewer satellites are detected, this state is referred to as bridging mode, as described above.

[0079] The release is revoked if the normal mode status is not displayed for an extended period of time, e.g., 15 seconds. A parameter value for this period can be derived, for example, based on the coupling accuracy after 3 seconds of bridging mode and then based on the result of a controlled active fallback path function. Using this parameter value, the required coupling accuracy in the longitudinal and transverse directions should just be achieved.

[0080] If the vehicle is traveling at a current speed that is below the specified speed limit, the same conditions apply as when the speed limit is exceeded, with only the time parameters being different.

[0081] If errors occur with regard to the camera track data and / or the dead reckoning data, the release will be withdrawn or no longer granted.

Claims

1. Method for operating a vehicle designed for automated driving operation, the vehicle, in a regular operating mode of the automated driving operation, being guided in an automated manner to a target position by means of a main control unit and, in an emergency operating mode of the automated driving operation, transferred in an automated manner to a safe stopping position by means of a secondary control unit, - the main control unit being used to continuously verify the functional readiness of the secondary control unit, - a decision being made, depending on the verified functional readiness, as to whether approval for automated driving operation should be granted or withdrawn, characterized in that the decision is based on decision criteria which are specified depending on a limit speed in relation to a current driving speed of the vehicle, and - the automated driving operation being activated only when approval is granted, and deactivated when approval is withdrawn.

2. Method according to claim 1, characterized in that in order to verify the functional readiness of the secondary control unit, it is verified whether data used by the secondary control unit to localize the vehicle when guiding the vehicle meet specified quality requirements.

3. Method according to claim 2, characterized in that dead-reckoning data and determined camera track data are verified in relation to the specified quality requirements by means of the main control unit.

4. Method according to claim 2 or claim 3, characterized in that the decision as to whether to grant approval or withdraw approval is made depending on whether the specified quality requirements are met.

5. Method according to claim 3 or claim 4, characterized in that the regular operating mode is enabled in the case of the limit speed not being met if the dead-reckoning data or the camera track data meet the specified quality requirements.

6. Method according to any of claims 3 to 5, characterized in that the regular operating mode is enabled in the case of the speed limit being exceeded if both the dead-reckoning data and the camera track data meet the specified quality requirements.