METHOD FOR OPERATING A VEHICLE, COMPUTER PROGRAM PRODUCT AND VEHICLE

Description

[0001] The invention relates to a method for operating a vehicle with at least one driving parameter, a computer program product, and a vehicle.

[0002] It is known from the prior art to provide one or more fallback levels in a vehicle for a partial failure of a vehicle system, e.g., in the form of a steering or braking system. For example, it is known from document DE 11 2017 005 108 T5 to provide an emergency operation for a vehicle when an initial fault is detected. In this case, the driver is instructed by a warning to drive the vehicle to a safe location and stop.

[0003] With redundant design of safety-relevant vehicle systems, the impact on the vehicle's system performance upon the occurrence of a first fault is generally less critical, meaning that such a vehicle remains controllable even in driving situations with high performance demands. However, if a second fault occurs following the first, continued operation after the second fault is often not intended, so a more significant reduction in vehicle performance is possible. Due to the complexity of vehicle systems, the remaining vehicle performance after a second fault is typically difficult for the driver to assess.It is therefore desirable to avoid the driver overestimating the vehicle in the event of the first fault and continuing to operate it with a high vehicle system performance that exceeds the available vehicle system performance of the next fallback level in the event of a second fault.

[0004] DE 10 2007 002 748 A1 discloses a method and a device for operating a motor vehicle.

[0005] DE 10 2011 121 260 A1 discloses a method for assisting a driver of a motor vehicle in the event of a loss of attention using an error counter.

[0006] DE 10 2013 001 019 A1 discloses a method for triggering a warning signal in the event of misconduct during the operation of a motor vehicle.

[0007] DE 10 2010 062 484 A1 discloses a method and device for initiating an emergency running mode of a motor vehicle.

[0008] It is an object of the present invention to at least partially overcome the aforementioned disadvantages known from the prior art. In particular, it is an object of the present invention to assist a driver of a vehicle in operating the vehicle safely in the event of a malfunction.

[0009] The foregoing problem is solved by a method with the features of claim 1, a computer program product with the features of claim 8, and a vehicle with the features of claim 9. Further features and details of the invention will become apparent from the respective dependent claims, the description, and the drawings. Features and details described in connection with the method according to the invention naturally also apply in connection with the computer program product and / or the vehicle according to the invention, and vice versa, so that the disclosure of the individual aspects of the invention always makes, or can make, reciprocal references.

[0010] According to a first aspect of the invention, a method for operating a vehicle is provided. The vehicle has a vehicle system, particularly a safety-relevant one, for performing a driving function in normal operation. Furthermore, depending on a first malfunction of the vehicle system, the vehicle system can be operated in a first emergency mode to at least partially or completely maintain the driving function. The method comprises, in particular in the form of process steps: Detecting the occurrence of the first fault in the vehicle system, in particular by a control unit of the vehicle, initiating the first emergency operation depending on the first fault, in particular by the control unit, predicting a restriction of at least one driving parameter of the vehicle for a second fault in the vehicle system following the first fault, i.e. in particular in the event of the occurrence of the second fault, issuing at least one driver warning during the first emergency operation depending on the restriction, in particular by the control unit.

[0011] The vehicle is preferably a motor vehicle, particularly an electric vehicle, and / or an aircraft. The vehicle system may preferably include a steering system, particularly a steer-by-wire system, and / or a braking system, particularly a brake-by-wire system. The driving function may, for example, include steering the vehicle and / or braking the vehicle.

[0012] The first and / or second fault can involve a software and / or hardware error in the vehicle system or a vehicle component affecting the vehicle system. The first fault in the vehicle system can, for example, involve at least a partial or complete failure of a system component of the vehicle system and / or a communication path between the control unit and the system component. However, it is also conceivable that the control unit itself has a fault that leads to the fault in the vehicle system. Maintaining the driving function can be achieved through redundant provision of the driving function by the vehicle system. For example, the system component and / or the communication path can be designed redundantly to at least partially maintain the driving function. Furthermore, it can be provided that the driving function is already limited in the first emergency mode.

[0013] Upon detection of the first fault, it is possible to determine, in particular, whether the first fault has occurred and / or in what form. The initiation of the first emergency operation can preferably be carried out automatically, either actively or passively, for example, by relying on the redundant system component and / or the redundant communication path to maintain the driving function. It may be provided that a warning message, separate from the driver notification, is issued to the driver regarding the initiation of the first emergency operation. Furthermore, it is conceivable that the driving function and / or the driving parameters are restricted, particularly electronically, to limit the vehicle performance available to the driver.

[0014] Predetermining the second fault can preferably be carried out depending on the first fault and / or by the control unit. The second fault can, in particular, follow the first fault. For example, the first and second faults can occur simultaneously when the second fault occurs. The restriction of the driving parameter can result from the second fault and / or be automatically predetermined in a second emergency mode of the vehicle system due to the second fault.

[0015] The driving parameter can, in particular, comprise a performance parameter of the vehicle and / or the vehicle system, for example, in the form of speed, acceleration, and / or braking performance, and / or a driving characteristic of the vehicle and / or the driving function, e.g., in the form of a steering angle. In particular, the driving parameter can be assigned to the driving function of the vehicle system or to another driving function of the vehicle. The restriction preferably refers to at least a partial reduction and / or a reduced or non-existent availability of the driving parameter compared to normal operation. In normal operation, and preferably in the first emergency operation, of the vehicle system, the driving parameter can be set as intended, preferably without restriction. The restriction of the driving parameter in the second fault condition can include a limit value for the driving parameter.In particular, the second fault can be detected, and the vehicle system can be operated in a second emergency mode with the restricted driving parameter, depending on the second fault. For example, a stop of the vehicle can be electronically enforced in the second emergency mode. When predicting the restriction, it is advantageous to predict the achievable, especially maximum, performance of the vehicle in the second emergency mode, particularly with regard to the driving parameter, in order to determine the limit value of the driving parameter. Furthermore, a safety factor can be taken into account.

[0016] The driver warning can include information about the limitation. For example, the driver warning can be issued in the form of a signal that conveys the information. Within the scope of the invention, it has been recognized that some drivers do not fully recognize the significance of the first disturbance and do not adapt their driving style appropriately to the situation. By issuing the driver warning in this method, the driver can be informed about the limitation, i.e., for example, about the vehicle performance resulting from the limitation that is expected when the second disturbance occurs. Preferably, the limitation can be communicated to the driver qualitatively and / or quantitatively via the driver warning. In particular, the driver is thus alerted to a predicted reduction in their ability to control the vehicle, enabling them to adapt their driving style appropriately to the situation.

[0017] Furthermore, a method according to the invention provides that the method comprises, in the form of process steps: Recording the driver's driving behavior during the initial emergency operation, in particular by the control unit and / or vehicle sensors; evaluating the driving behavior depending on the restriction, in particular by the control unit. The driver warning is issued based on the assessment of driving behavior. The driver's driving behavior can be determined, in particular, by observing the driver's steering and / or operating behavior of the vehicle. Specifically, the driving parameter and / or its progression can be recorded during the assessment of driving behavior. Furthermore, to assess driving behavior, the driving parameter can advantageously be evaluated, especially for the current driving situation of the vehicle and / or over a predetermined period. For this purpose, reference requirements for driving behavior can be determined based on the predetermined constraints of the driving parameter, according to which the recorded driving behavior is classified as critical and / or non-critical. Furthermore, the recording and evaluation of driving behavior can be performed continuously.The driver warning can preferably be issued at a point in time when the driving parameter exceeds the predetermined limitation for the second fault in the first emergency mode. This allows the driver to be alerted that the current driving behavior exceeds the vehicle's capabilities in the event of the second fault.

[0018] Furthermore, in a method according to the invention, it is conceivable that the recording of driving behavior, particularly continuously, takes place over a grace period, especially before the evaluation of the driving behavior and / or the output of the driver warning is performed. The grace period can be fixed or dynamically defined during the method, particularly during the recording of driving behavior. It can be provided that the output of the driver warning occurs immediately and completely after the grace period, or that the output of the driver warning initially has a progressive output curve in which the intensity of the driver warning increases over time. This progressive curve prevents the driver from being suddenly surprised by the driver warning.Recording data over a grace period ensures that the data set for evaluation is sufficiently large and / or that the driving behavior is intentional. For example, the period can be 5 minutes or longer. This allows, for instance, the exclusion of situations where a temporarily high power output detected during the recording and evaluation of driving behavior is not solely due to a specific driving situation.

[0019] Within the scope of the invention, it is further conceivable that the driver information is output haptically, in particular by controlling a vehicle component to produce a vibration. The haptic output of the driver information can be achieved, for example, via the vehicle's steering system, in particular through feedback in the steering wheel, a vibration in the steering wheel, a change in the counterforce, and / or a delayed or non-linear response to the steering input. Furthermore, it is conceivable that a haptic output of the driver information can be achieved, for example, via a drivetrain and / or a braking system of the vehicle, in particular through pulsating wheel pressures and / or a pulsating drive control to induce vibrations in the vehicle when the braking system is applied, and / or a change in the pedal travel of a pedal used to control the drivetrain or the braking system.The haptic output allows the driver to receive the instruction regardless of background noise and / or the amount of information in their field of vision. This can simplify the driver's understanding of the instruction.

[0020] Preferably, in a method according to the invention, the driver information can be output in the form of an optical and / or acoustic message. This optical and / or acoustic message can preferably include a warning message depending on the restriction of the driving parameter. The optical message can be output via a display device in the vehicle, for example, a screen and / or a head-up display. The optical output can, for example, provide the driver information in addition to a warning message to initiate the first emergency operation. Furthermore, the driver information can replace the warning message when the driver information is output, so that the driver can easily recognize the increased relevance of their driving behavior. The acoustic message can be output, for example, via a loudspeaker in the vehicle and / or by technical vibrations, such as those generated by the vehicle's suspension.The warning can be triggered by the activation of valve circuits and / or an electric motor hum. For example, the acoustic output of the driver warning may interrupt in-vehicle entertainment such as music or a radio broadcast. The acoustic and / or visual information can be a familiar way for the driver to receive the warning message, thus avoiding driver confusion. Furthermore, the acoustic and / or visual information can include, in particular, quantitative information about the limitation in the form of readable and / or audible voice information. This allows an experienced driver, in particular, to better assess the limitation.

[0021] Furthermore, in a method according to the invention, it can advantageously be provided that several driver instructions, in particular with different output types and / or depending on the assessment of driving behavior, are output sequentially and / or with a time interval between them. For example, to implement a progressive output sequence, the driver instructions can be output one after the other. The driver instructions can, for instance, have a predefined sequence. In particular, it can be provided that first an optical and / or acoustic message is output, followed by a haptic output of a driver instruction. In particular, the haptic output can only occur if the driver's driving behavior continues to be assessed as critical after the optical and / or acoustic message. This allows the driver to be more clearly alerted to the predetermined restriction.

[0022] Furthermore, in a method according to the invention, it is conceivable that the vehicle's surroundings are detected during the initial emergency operation, and that these surroundings are taken into account when predicting the limitations and / or evaluating driving behavior. Detection of the vehicle's surroundings can be carried out by sensors on the vehicle, particularly predictive ones. For example, current and / or predicted weather conditions, road conditions, and / or navigation data can be detected during the detection of the vehicle's surroundings. Additionally or alternatively, the method can be provided for the detection of the vehicle's condition during the initial emergency operation, and this condition can be taken into account when predicting the limitations and / or evaluating driving behavior. The vehicle condition can, for example, include the condition of the vehicle tires and / or the wear state of the vehicle system.By taking into account the vehicle's surroundings and / or condition, the accuracy in predicting the limitation and / or in assessing driving behavior, especially in relation to the current driving situation, can be improved.

[0023] Furthermore, in a method according to the invention, it is conceivable that, in addition to issuing the driver instruction, a vehicle reaction is executed to restrict driving behavior depending on the predetermined restriction of the driver instruction, the vehicle state, the vehicle environment, and / or the evaluation of the driving behavior. For example, the vehicle reaction can limit the vehicle's speed and / or acceleration, particularly electronically, to a reduced maximum value. The vehicle system or another vehicle system can be controlled to execute the vehicle reaction. In particular, driving behavior can be restricted by limiting the driving function and / or another driving function of the vehicle.By restricting driving behavior, the driver can be actively prevented from operating the vehicle in initial emergency mode for extended periods and / or under adverse driving conditions with high power demand. By restricting driving behavior based on the assessment of that behavior, the driver's actions can be specifically penalized. By restricting driving behavior based on the predetermined restriction of the driver instruction, the vehicle's condition, and / or the vehicle's surroundings, the vehicle's response can be dynamic and / or situationally appropriate.

[0024] According to a further aspect of the invention, a computer program product is provided. The computer program product comprises instructions which, when executed by a control unit, cause the control unit to execute a method according to the invention.

[0025] Thus, a computer program product according to the invention offers the same advantages as those already described in detail with reference to a method according to the invention. The method can, in particular, be a computer-implemented method. The computer program product can be implemented as computer-readable instruction code. Furthermore, the computer program product can be stored on a computer-readable storage medium such as a data disk, a removable drive, volatile or non-volatile memory, or an embedded memory / processor. Furthermore, the computer program product can be made available or provided in a network, such as the Internet, from which it can be downloaded or executed online by a user as needed. The computer program product can be implemented using software as well as one or more special electronic circuits, i.e.,It can be implemented in hardware or in any hybrid form, i.e., using software components and hardware components.

[0026] According to a further aspect of the invention, a vehicle is provided. The vehicle has a vehicle system, preferably safety-related, for performing a driving function in normal operation. Depending on a first malfunction of the vehicle system, the vehicle system can be operated in a first emergency mode to at least partially maintain the driving function. Furthermore, the vehicle, preferably the vehicle system, has a control unit for carrying out a method according to the invention.

[0027] Thus, a vehicle according to the invention offers the same advantages as those already described in detail with reference to a method and / or a computer program product according to the invention. The control unit can comprise a processor and / or a microprocessor. Furthermore, the control unit can be at least partially or completely integrated into a central control unit of the vehicle. However, it is also conceivable that the control unit is at least partially or completely integrated into one or more decentralized control units of the vehicle and / or the vehicle system. Further advantages, features, and details of the invention will become apparent from the following description, in which exemplary embodiments of the invention are described in detail with reference to the drawings.

[0028] They show schematically: Figure 1 shows a vehicle according to the invention, Figure 2 shows the sequence of a method according to the invention for operating the vehicle, Figure 3 shows the course of a driving parameter of the vehicle over a time.

[0029] In the following description of some embodiments of the invention, the same reference numerals are used for the same technical features even in different embodiments.

[0030] Figure 1Figure 1 shows a vehicle 1 according to the invention with a vehicle system 10, particularly a safety-relevant system, for performing a driving function during normal operation of the vehicle system 10. In the present embodiment, the vehicle system 10 is a steering system of the vehicle 1, particularly in the form of a steer-by-wire system. However, it is equally conceivable that the vehicle system 10 is a braking system, e.g., in the form of a brake-by-wire system, or another on-board system of the vehicle 1. Furthermore, the vehicle 1 has a control unit 11 for executing a method 100 according to the invention for operating the vehicle 1. For this purpose, for example, a computer program product can be provided which includes commands that, when executed by a control unit 11, cause the control unit 11 to execute the method 100. A sequence of the method 100 is shown schematically in Figure 1. Figure 2 shown.

[0031] Depending on a first fault 200 of the vehicle system 10, it can be operated in a first emergency mode 210 to at least partially maintain the driving function. As shown, the first fault 200 can, for example, include a failure of a communication line 14 between the control unit 11 and a steering unit 13. The first emergency mode 210 thus forms, in particular, a first fallback level for a first fault event. Preferably, the vehicle system 10 can also be operated in a second emergency mode to at least partially maintain the operation of the vehicle 1, depending on a second fault 201 of the vehicle system 10 following the first fault 200. In the second emergency mode, the driving function of the vehicle system 10 can, for example, be partially available or unavailable.For example, the second fault 201 could involve the failure of another redundant communication line 14 between the control unit 11 and a steering unit 13. The second emergency operation thus provides, in particular, a second fallback level for a secondary fault.

[0032] In procedure 100, the occurrence of the first fault 200 of the vehicle system 10 is detected 101. The failure of the communication line 14 of the first fault 200 can, for example, be detected by the control unit 11. Depending on the first fault 200, the first emergency operation 210 is then initiated 102. The control unit 11 can, for example, actively switch to the first emergency operation 210 or passively continue communication via the remaining communication line 14.

[0033] To assess the potential impact of the second fault 201 on vehicle 1, a further step is to predict 103 a restriction 212.1 of at least one driving parameter 212 of vehicle 1 for the second fault 201 of vehicle system 10. This prediction 103 can be carried out, for example, after initiating 102 the first emergency operation 210, particularly depending on the first fault 200. For this purpose, for example, a fault type of the first fault 200 can be determined in order to predict the restriction 212.1 of driving parameter 212. For example, the driving parameter 212 can include a steering angle and / or a speed of vehicle system 10.

[0034] Furthermore, the driver's driving behavior is recorded during the first emergency operation. As in Figure 3As shown, a course 212.2 of the driving parameter 212 can be sensorially recorded over a time t. Preferably, the recording 104 of the driving behavior 213 is carried out over a grace period 104.1 in order to create a database and / or to be able to classify the driving behavior 213 as temporary or permanent. After the grace period 104.1, an evaluation 105 of the driving behavior 213 is performed depending on the restriction 212.1. During the evaluation 105 of the driving behavior 213, the driving behavior 213 can, for example, be classified as critical if the driver exceeds the predetermined restriction 212.1 of the driving parameter 212, preferably frequently and / or permanently, during the first emergency operation 210. Additionally or alternatively, a vehicle environment 1.1 of the vehicle 1 can be monitored during the first emergency operation 210 by sensors 15, e.g. B. in the form of a front camera, and / or captured by the control unit 11.

[0035] Depending on the predetermined restriction 212.1 of the driving parameter 212, at least one driver warning 220 is issued 106 during the first emergency operation 210. The evaluation 105 of the driving behavior 213 and the vehicle environment 1.1 are preferably taken into account. For example, the driver warning 220 can only be issued 106 if the driving behavior 213 is evaluated as critical in the detected vehicle environment 1.1. The driver warning 220 can be issued 106, for example, as in Figure 1The driver is shown to receive information 220.2 in the form of an output 106 of optical and / or acoustic information 220.2. Furthermore, it is conceivable that the driver instruction 220 is output haptically by activating 220.1 of the vehicle component 12, such as a wheel brake, to induce a vibration in the vehicle 1. Preferably, several driver instructions 220 are output sequentially and / or with a time interval between them, depending on the evaluation 105 of the driving behavior 213.

[0036] In addition to issuing the driver instruction 220 (106), a vehicle reaction 107 is executed to restrict the driving behavior 213, depending on the predetermined restriction 212.1 of the driver instruction 220 from the vehicle environment 1.1 and / or the evaluation 105 of the driving behavior 213. This allows the driver's driving behavior 213 to be electronically restricted, in particular penalized, in order to improve the safety of the vehicle 1 in the first emergency operation 210 and to bring the vehicle 1 into a safe driving mode in preparation for a possible occurrence of the second emergency operation.

[0037] The preceding explanation of the embodiments describes the present invention solely by way of examples. Naturally, individual features of the embodiments can be freely combined with one another, provided this is technically feasible, without departing from the scope of the present invention. Reference symbol list

[0038] 1 Vehicle 1.1 Vehicle environment 10 Vehicle system 11 Control unit 12 Vehicle component 13 Steering unit 14 Communication line 15 Sensors 100 Procedure 101 Detecting Occurrence of 200 102 Initiating 210 103 Predicting 212.1 104 Detecting 213 104.1 Grace Period 105 Evaluating 213 106 Outputting 220 107 Vehicle Reaction 200th first fault 201st second fault 210 First emergency operation 212 Driving parameters 212.1 Restriction 212.2 Progress of 212 213 Driving behavior 220 Driver information 220.1 Control 220.2 Information tTime

Claims

1. Method (100) for operating a vehicle (1) having a vehicle system (10) for performing a driving function in a normal mode, which vehicle system can, on the basis of a first fault (200) of the vehicle system (10), be operated in a first emergency mode (210) for at least partially maintaining the driving function, characterized in that the method (100) comprises: - detecting (101) an occurrence of the first fault (200) of the vehicle system (10), - initiating (102) the first emergency mode (210) on the basis of the first fault (200), - predetermining (103) a restriction (212.1) of at least one driving parameter (212) of the vehicle (1) for a second fault (201) of the vehicle system (10) that occurs after the first fault (200), - outputting (106) at least one driver notification (220) during the first emergency mode (210) on the basis of the restriction (212.1), - detecting (104) driving behavior (213) of the driver during the first emergency mode (210), - evaluating (105) the driving behavior (213) on the basis of the restriction (212.1), the driver notification (220) being output (106) on the basis of the evaluation (105) of the driving behavior (213).

2. Method (100) according to claim 1, characterized in that the driving behavior (213) is detected (104) over a waiting period (104.1) before the driving behavior (213) is evaluated (105) and the driver notification (220) is output (106).

3. Method (100) according to either of the preceding claims, characterized in that the driver notification (220) is output (106) haptically by the vehicle component (12) being actuated (220.1) to perform a vibration.

4. Method (100) according to any of the preceding claims, characterized in that the driver notification (220) is output (106) in the form of an output (106) of optical and / or acoustic information (220.2).

5. Method (100) according to any of the preceding claims, characterized in that a plurality of driver notifications (220) are output, consecutively and / or with a time interval between them, with different output types on the basis of the evaluation (105) of the driving behavior (213).

6. Method (100) according to any of the preceding claims, characterized in that vehicle surroundings (1.1) of the vehicle (1) are detected in the first emergency mode (210), the vehicle surroundings (1.1) being taken into account when predetermining (103) the restriction (212.1) and / or when evaluating (105) the driving behavior (213).

7. Method (100) according to any of the preceding claims, characterized in that in addition to outputting (106) the driver notification (220), a vehicle response (107) is performed to restrict the driving behavior (213) on the basis of the predetermined restriction (212.1) of the driver notification (220), the vehicle surroundings (1.1) and / or the evaluation (105) of the driving behavior (213).

8. Computer program product comprising instructions which, when executed by a control unit (11), cause the control unit (11) to perform a method (100) according to any of the preceding claims.

9. Vehicle (1) having a vehicle system (10) for performing a driving function in a normal mode, which vehicle system can, on the basis of a first fault (200) of the vehicle system (10), be operated in a first emergency mode (210) for at least partially maintaining the driving function, and a control unit (11) for performing a method (100) according to any of claims 1 to 7.