METHOD AND DEVICE FOR CONTENT-SAFETY OF OBJECT DATA FOR COLLECTIVE PERCEPTION

Description

Technical field

[0001] The present invention relates to a method and device for the content-related safeguarding of object data for collective perception. Technical background

[0002] With regard to the distribution of object data acquired by sensors for the description of detected objects via vehicle-to-X communication, also known as collective perception, the current safeguarding efforts primarily focus on the quality of the individual data.

[0003] DE 10 2018 120 655 A1 relates to the authentication of vehicle-to-vehicle communication. Sensor data is received from a first vehicle, and secondary sensor data from a second vehicle. Based on the sensor data and the secondary sensor data, an authentication is extracted, which includes the proximity of the second vehicle to the first vehicle or a shared object. It is determined whether the authentication meets a trust threshold set by the first vehicle. A control unit is housed in one of the vehicles and can perform autonomous navigation and collision avoidance. The control unit includes a V2V module and a location verification module. The location verification module verifies the location of the other vehicle by exchanging images or other sensor data, object maps, and / or speed maps. The authentication uses any type of sensor data.Both vehicles include a camera snapshot and an environmental map. Each vehicle verifies whether the extracted information matches its own.

[0004] The republished German Patent Application DE 10 2020 212 565 A1 relates to the validation of environmental information. Environmental information about a vehicle's surroundings is received from another vehicle. This environmental information is validated to generate reliability information. The environmental information includes measurement data of the environment and / or interpreted measurement data. The measurement data may include sensor data. The interpreted measurement data contains further processed or interpreted information about objects or situations in the environment. The interpreted measurement data includes CAM, CPM, DENM, or SPaT messages.

[0005] WO 2014 / 033 172 A1 concerns a method for performing a safety function of a vehicle, in which data required for performing the safety function is transmitted to a control unit of the vehicle via a communication system. Based on the transmitted data, the control unit generates control signals and transmits them to a functional unit of the vehicle. The functional unit then performs the safety function based on these control signals, with diagnostic tests being carried out repeatedly at intervals. These diagnostic tests check whether one or more of the electrical, electronic, and / or programmable systems used to perform the method contain a fault that could impair the execution of the safety function.The communication system also transmits metadata to the control unit, including information about the systems used to execute the procedure. Using this information, the control unit determines a reliability score for the data. This score depends on the probability of errors or malfunctions occurring that could impair the safety function, and on the probability that such errors or malfunctions will be detected in time by diagnostic tests and / or by the vehicle's driver before they compromise the safety function. Based on this reliability score, the control unit further verifies whether the transmitted data is sufficiently reliable for the safety function to function.However, it is generally assumed that a data collector must ensure the accuracy of the data.

[0006] The disadvantage of this is that safety-critical traffic situations can be triggered if the integrity of the data is not guaranteed, for example due to intentional manipulation.

[0007] The object of the invention can be seen as improving functional safety in collective perception using vehicle-to-X communication.

[0008] This task is accomplished by the subject matter of the independent claims. Advantageous embodiments can, for example, be derived from the dependent claims. The content of the claims is incorporated into the description by express reference.

[0009] The underlying concept is that a first road user verifies object data describing an object detected by a second road user's sensor and / or an infrastructure device using additional sources. The object data is transmitted by the second road user and / or the infrastructure device, particularly via vehicle-to-X communication, and received by the first road user. This verification process ensures the accuracy of data for collective perception and / or guarantees functional safety when using object data obtained via vehicle-to-X communication to describe objects detected by at least one sensor of a second road user and / or at least one sensor of an infrastructure device.An object can, in particular, represent a road user or other obstacle. The sensor information acquired by the sensors can also be provided by a device for acquiring an environmental model of the first road user.

[0010] The object's state can include, for example, its position, speed, direction of travel, and trajectory. The trajectory encompasses, in particular, a previous movement, a current movement, and / or a predicted movement of the object. A plausibility check can therefore also include a historical, present, and / or predicted trajectory of the object. This enables the continuous tracking and plausibility verification of a given object.

[0011] Information concerning the object's condition can be provided by the second road user and / or the infrastructure facility, at least according to further training. Alternatively or additionally, the condition can be recorded using sensor information acquired by the first road user. This allows for a plausibility check of the object's condition based on sensor information from the first road user.

[0012] A road user is, for example, a vehicle, a pedestrian, a cyclist, or any other entity participating in traffic. A vehicle can be a motor vehicle, in particular a passenger car, a truck, a motorcycle, an electric vehicle or a hybrid vehicle, a watercraft, or an aircraft.

[0013] According to at least one embodiment, the plausibility check is performed by comparing the state of an object described by the object data with the map information, and / or the plausibility check is performed by comparing the state of an object described by the object data with sensor information acquired by sensors of the first road user. The plausibility check can also verify the probability of the object's state. For example, it may be considered improbable or implausible within the scope of the plausibility check if the position of a traffic object classified as a vehicle is inside a building or if the position of a traffic object classified as a truck is on a narrow footpath. The scope of the plausibility check may depend, in particular, on the available computing resources of the electronic control unit.

[0014] In addition to the plausibility check regarding the detected object, this makes it possible to identify and, if necessary, correct errors in the determined position and orientation of the second road user, which result from an inaccurate position and orientation detection by the second road user who detected the object in question.

[0015] In accordance with further training, the plausibility check of the state of an object described by the object data, using sensor information acquired by the sensors of the first road user, involves an assignment check, whereby the object described by the object data is to be assigned to an object described by the sensor information. The assignment is made, in particular, when object identity is recognized. For example, the comparison is carried out using a (auto-)correlation method or another matching procedure.

[0016] In accordance with the advanced training, the map information is received at least partially by an infrastructure facility and / or the second road user and / or another road user via vehicle-to-X communication. Alternatively or additionally, the map information is stored at least partially in a data storage device encompassed by the first road user.

[0017] The received object data can already include classification information for classifying the detected object. The classification can identify the object, for example, as a vehicle, pedestrian, or obstacle, with the classification being carried out primarily by the detection device of the second road user or infrastructure facility. For example, if a vehicle detects a pedestrian using sensors, it is classified as a pedestrian, and the object data relating to the pedestrian, along with the classification information, is transmitted via vehicle-to-X communication for reception by the first road user.

[0018] In accordance with further training, the plausibility check of the object's state, as described by the object data, is performed using classification information to describe a classification type of the object. The classification information is comprised in particular of the received object data and / or determined by the first road user, for example, using the first road user's sensors, and / or comprised of further received vehicle-to-X information. Examples of object classification types are vehicle, pedestrian, cyclist, fixed obstacle, and / or more detailed distinctions.

[0019] In accordance with further training, the received object data is encompassed by a collective perception message (CPM), specifically as per ETSI TS 103 324. The CPM can therefore be used for functions with an ASIL (Automotive Safety Integrity Level) rating higher than QM.

[0020] Furthermore, it may be provided that the first road user receives information from the second road user and / or the infrastructure facility to determine at least one detection range of the second road user's and / or infrastructure facility's sensors that detect the object. For example, if an object is not detectable, even though it should actually be detectable within the detection range of the second road user's and / or infrastructure facility's sensors according to a motion prediction, it is, according to at least one embodiment, either searched for in the wider surrounding area and / or the motion prediction for the object is corrected.

[0021] An object is classified as not plausible, in particular, if, taking into account the prediction accuracy of the object's movement, the object is located outside the detection range of the sensors.

[0022] In accordance with further training, combinations of condition and classified object that are not possible or whose probability of occurrence, particularly when considering other factors, lies at or below a threshold, are classified as implausible during the plausibility check. Examples include: a motorcycle with ESC intervention, a pedestrian with ABS intervention, and a bicycle with airbag deployment.

[0023] According to further training, the comparison uses a positioning variance and / or an orientation variance in the detection accuracy by the second road user and / or a positioning variance and / or an orientation variance of the second road user itself as a termination criterion. According to at least one embodiment, the object data includes confidence information to describe the accuracy of the object data detection. The positioning variance and / or the orientation variance can accordingly be included in the received object data and / or are determined during detection by the sensors of the first road user.

[0024] It is advisable to minimize or optimize the number of objects in a merged environment model used for reconciliation so that the creation of new objects through merging does not degrade the reconciliation, for example, the (auto-)correlation. This prevents reconciliation errors, particularly those arising from positional discrepancies between positional information exchanged via V2X and objects in the environment model, and the potential for duplicate recording of the same object.

[0025] As part of ongoing training, object data that cannot be verified or is classified as implausible, and / or object data that cannot be verified, will be discarded and / or corrected. If the plausibility check reveals that only the object classification is incorrect, the classification can be corrected. For example, pedestrians are typically unable to move at a speed of 50 km / h, and trucks cannot make changes of direction as quickly as pedestrians, so the classification can be corrected based on the available condition information.

[0026] According to the invention, information concerning the second road user and / or the infrastructure facility is recorded, wherein the reception of this information takes place via a further communication channel that is different from the communication channel of the received object data. Mobile communication is one example of a suitable further communication channel.

[0027] In accordance with further training, an identifier for identifying a sender of the received object data is recorded as information concerning the second road user and / or the infrastructure facility, whereby the reception of the identifier took place on the further communication path.

[0028] According to at least one embodiment, the receipt of information concerning the second road user and / or the infrastructure facility is preceded by the first road user sending at least one request for the provision of information concerning the second road user and / or the infrastructure facility.

[0029] As part of the advanced training, the identifier is at least partially designed to be variable, such that it can be assigned changed information after a certain period of time. Specifically, the identifier is a V2X pseudonym for anonymizing data communication in vehicle-to-X communication, which is changed after a defined time, e.g., 10 minutes. Alternatively or additionally, the identifier is at least partially designed to be unchanging, e.g., sensor setup and / or position. This makes it more difficult for an unauthorized third party to send messages containing misinformation.

[0030] One advantage of this is that the received object data, or the content of a received V2X message, can be attributed to the actual sender with a higher degree of probability. This would allow for higher confidence values ​​to be assigned to the received object data to describe the trustworthiness of the information, as it would make it easier to detect manipulations of object data by a sender other than the actual original creator of the object data.

[0031] In accordance with further training, the subsequent communication path also includes a separate information source from the second road user and / or the infrastructure facility, which determines information concerning the second road user and / or the infrastructure facility and / or the identifier of the second road user and / or the infrastructure facility and provides it to the first road user.

[0032] For example, the assignment of the actual sender when receiving information via another communication channel can be configured such that the first road user queries nearby infrastructure-based V2X transmitters via mobile network and / or receives a list of transaction numbers (TANs) that are subsequently used by the respective transmitters in the vicinity, e.g., within a range of 200 m, and / or the list is temporarily stored by the vehicle and all future received V2X messages must contain this TAN. If a TAN is used multiple times, it can be intercepted and copied. Therefore, using a TAN only once is advisable.

[0033] The V2X message can, for example, initially be stored in a validation queue, or it can be processed but with the understanding that it will be discarded later. This can overcome problems resulting from transmission latency during querying.

[0034] According to claim 10, the disclosure describes an electronic control device for being carried by a first road user, comprising a computing device for acquiring object data received by means of vehicle-to-X communication for describing an object detected by at least one acquiring device of a second road user and / or at least one acquiring device of an infrastructure facility, and for checking the plausibility of a state of the object described by the received object data using map information and / or sensor information, wherein the sensor information is determined using sensors of the first road user, wherein information relating to the second road user and / or the infrastructure facility is acquired, wherein the reception of this information takes place via a further communication path.which differs from the communication path of the received object data.

[0035] Depending on the road user, carrying the device can take place, particularly in the case of a vehicle, by mounting it in the first road user, or, for example, in the case of a pedestrian, by carrying it along.

[0036] According to a further unclaimed aspect of the invention, the device is configured to carry out a method according to at least one of the described embodiments.

[0037] A computing device can be any device designed to process at least one of the aforementioned signals. In particular, the computing device can be a processor, such as an ASIC, an FPGA, a digital signal processor, a central processing unit (CPU), a multi-purpose processor (MPP), or similar.

[0038] In a further development of the specified device, the device includes a memory. The specified method is stored in the memory in the form of a computer program, and the computing unit is provided for executing the method when the computer program is loaded from the memory into the computing unit.

[0039] According to a further unclaimed aspect of the invention, a computer program comprises program code means to perform all the steps of one of the specified methods when the computer program is executed on a computer or one of the specified devices.

[0040] According to a further unclaimed aspect of the invention, a computer program product includes program code stored on a computer-readable data carrier which, when executed on a data processing device, performs one of the specified methods. Description of the characters

[0041] Some particularly advantageous embodiments of the invention are specified in the dependent claims. Further preferred embodiments will also become apparent from the following description of exemplary embodiments with reference to figures.

[0042] The schematic representation shows: Fig. 1 shows an embodiment of the method according to the disclosure, and Fig. 2 shows an embodiment of the electronic control device according to the disclosure. Detailed description of the figures

[0043] The Fig. 1 Figure 100, presented as a flowchart, illustrates an exemplary method for the content-related validation of data for collective perception and execution by an electronic control device of a first road user, according to an embodiment of the disclosure. In step 120, object data received via vehicle-to-X communication is acquired to describe an object detected by at least one detection device of a second road user and / or at least one detection device of an infrastructure facility. In step 140, the plausibility of the state of the object described by the received object data is checked using map information and / or sensor information, the sensor information being obtained using sensors of the first road user.

[0044] The Fig. 2Figure 1 shows a schematic representation of an embodiment of the electronic control device 200 for use by a first road user 280, comprising a computing unit 210 for recording object data received by means of vehicle-to-X communication for the description of an object detected by at least one detection device of a second road user and / or at least one detection device of an infrastructure facility, and for checking the plausibility of a state of the object described by the received object data using map information and / or sensor information, wherein the sensor information is determined using at least one sensor 230 of the first road user 280.According to further development, the map information can be stored in a data storage device 240 encompassed by the first road user 280 and / or by the electronic control device 200, whereby it may be provided that the computing device 210 can access the map information via a communication means 260. The electronic control device 200 or the computing device 210 can be configured via a communication interface 250, for example a data bus interface, to receive sensor information from the sensor 230. According to at least one exemplary embodiment, the electronic control device 200 comprises an antenna 220 for vehicle-to-X communication, which is connected to the computing device for transmitting received and / or transmitted vehicle-to-X messages. The description of further components, for example relating to vehicle-to-X communication, such as receivers, compensators, etc., is omitted., which are commonly used in wireless transmission technology, have been omitted for the sake of clarity.

[0045] It should be noted that vehicle-to-X communication generally refers to direct communication between vehicles and / or between vehicles and infrastructure. For example, this can include vehicle-to-vehicle communication or vehicle-to-infrastructure communication. If this application refers to communication between vehicles, this can, in principle, take place, for example, within the framework of vehicle-to-vehicle communication, which typically occurs without mediation by a mobile network or similar external infrastructure and is therefore to be distinguished from other solutions that, for example, rely on a mobile network. Vehicle-to-X communication can, for example, be implemented using the IEEE 802.11p or IEEE 1609.4 standards. Vehicle-to-X communication can also be referred to as C2X or V2X communication.The sub-areas can be described as C2C.

[0046] These can be referred to as (Car-to-Car), V2V (Vehicle-to-Vehicle), or C2I (Car-to-Infrastructure), V2I (Vehicle-to-Infrastructure). However, the invention does not explicitly exclude vehicle-to-X communication mediated, for example, via a mobile network.

Claims

1. A method (100) for securing the content of object data for collective perception and execution by an electronic control device of a first road user, comprising the steps of: - detecting (120) object data received by means of vehicle-to-X communication for describing an object detected by at least one detection device of a second road user and / or at least one detection device of an infrastructure device, and - checking (140) a plausibility of a state of the object described by the received object data using map information and / or sensor information, wherein the sensor information is determined using sensors of the first road user, wherein information relating to the second road user and / or the infrastructure device is detected, characterized in that this information is received via a further communication path which is different from the communication path of the received object data.

2. The method according to claim 1, wherein the state of the object is its position and / or speed and / or direction of travel and / or trajectory, wherein the trajectory describes a time-preceding course of movement and / or a current course of movement and / or a predicted course of movement of the object.

3. The method according to at least one of the preceding claims, wherein the received object data is comprised by a collective perception message.

4. The method according to at least one of the preceding claims, wherein the object data comprises classification information for describing a classification type of the detected object, and the plausibility check of the state of the object described by the object data is performed by using the classification information for describing a classification type of the object.

5. The method according to claim 4, wherein non-possible combinations of the state of the object and the classification of the object in the plausibility check which are equal to or below a limit value and / or in their probability of occurrence are classified as non-plausible.

6. The method according to at least one of the preceding claims, wherein the plausibility check is carried out on the basis of a comparison of the state of the object described by the received object data and the map information and / or on the basis of a comparison of the state of the object described by the received object data with the sensor information detected by means of the sensors of the first road user.

7. The method according to the preceding claim, wherein a positioning variance and / or an orientation variance of the detection accuracy of the object by the second road user and / or a positioning variance and / or an orientation variance of the second road user as such is used as the termination criterion of the comparison.

8. The method according to at least one of the preceding claims, wherein an object arranged as implausible and / or implausible object data are discarded and / or corrected.

9. The method according to claim 1, wherein at least one identifier for identifying a transmitter of the received object data is detected as information relating to the second road user and / or the infrastructure device, wherein the identifier is received on the further communication path.

10. An electronic control device (200) for being carried by a first road user (280), comprising a computing device (210) for detecting object data received by means of vehicle-to-X communication for describing an object detected by at least one detection device of a second road user and / or at least one detection device of an infrastructure device, wherein the computing device (210) is further configured for checking the plausibility of a state of the object described by the received object data using map information and / or sensor information, wherein the sensor information is determined using at least one sensor (230) of the first road user (280), wherein information relating to the second road user and / or the infrastructure device is detected, characterized in that the reception of this information is effected on a further communication path which is different from the communication path of the received object data.

11. A use of the electronic control device (200) according to claim 10 in a vehicle (280).