METHOD FOR GENERATING A REGULAR SETPOINT VALUE FOR A DRIVE ELEMENT OF A MOTOR VEHICLE

Description

TECHNICAL FIELD TO WHICH THE INVENTION RELATES

[0001] The present invention relates generally to driving aids for motor vehicles.

[0002] It relates more particularly to a method for developing a supervision instruction for the control of at least one driving component of a motor vehicle (typically the steering system and / or the braking system and / or the engine of the motor vehicle, etc.).

[0003] The invention also relates to a system for controlling at least one driving member of a motor vehicle, adapted to develop this supervision instruction.

[0004] The invention applies more particularly to vehicles equipped with an autonomous driving mode. TECHNOLOGICAL BACKGROUND

[0005] To make driving a motor vehicle easier and safer, it is known to equip it with driver assistance systems. These may be systems that allow the vehicle to drive autonomously (without human intervention), or systems that allow the vehicle to drive partially autonomously (typically systems that are designed to temporarily take control of the vehicle, for example to apply emergency braking or to return the vehicle to the center of its lane).

[0006] To enable these systems to understand the environment around the vehicle, numerous sensors such as cameras, RADAR, LIDAR, SONAR sensors, etc. are placed on the vehicle.

[0007] Each sensor has its own strengths and weaknesses.

[0008] In order to minimize environmental detection errors, it is known to practice "data fusion", that is to say, taking into account the data emitted by different sensors to deduce a single environmental data. In this way, it is possible to take advantage of the qualities of each sensor.

[0009] Unfortunately, even so, the computer still sometimes makes mistakes, that is, it misjudges a situation. For example, it may wrongly consider an innocuous object as a dangerous obstacle and therefore order unnecessary and risky emergency braking for the vehicles behind it.

[0010] We then seek to reduce these errors.

[0011] WO 2016 / 162624 A1 discloses a method and a system for developing a supervision instruction for a vehicle, comprising redundant computers and selecting a result from one of the computers on the basis of a respective diagnosis. SUBJECT OF THE INVENTION

[0012] The present invention therefore proposes a new method and a new system meeting an ASIL D level as defined by the ISO26262 standard.

[0013] More particularly, the invention proposes a method for developing a supervision instruction for controlling at least one driving member of a motor vehicle equipped with a plurality of sensors, comprising: a first step of merging the signals received from at least a first part of the sensors, to determine at least a first data item relating to the environment around the motor vehicle, a second step of merging the signals received from at least a second part of the sensors, to determine at least a second data item relating to the environment around the motor vehicle, a step of calculating a first preliminary supervision instruction as a function of each first data item, a step of comparing the first and second data items to establish a first diagnosis, a step of checking the first preliminary supervision instruction, taking into account at least one of the first and second data items, to establish a second diagnosis, and a step of determining the supervision instruction as a function of the first and second diagnoses. The merging and calculation steps are implemented by a main computer equipping the motor vehicle.A further calculation step is provided, implemented by an auxiliary computer equipping the motor vehicle, of a second preliminary supervision instruction for each driving member, taking into account signals emitted by at least a third part of the sensors. In the determination step, the supervision instruction is chosen to be equal to the second preliminary supervision instruction if the first diagnosis indicates a discrepancy between the results of the two fusion steps and / or if the second diagnosis indicates a discrepancy between the first preliminary supervision instruction and the results of at least one of the two fusion steps.

[0014] The first and second data from the fusion steps are then compared. If they do not differ too much (or are consistent), it is concluded that the risk of a fusion error having been made is low (first diagnosis).

[0015] The first preliminary supervision instruction is checked by verifying that its value is not surprising, taking into account the data from at least one of the two fusion stages, in order to conclude whether an error in calculating this instruction has been made (second diagnosis).

[0016] These two diagnostics thus make it possible to check with great reliability and simplicity that the first preliminary supervision instruction can be used.

[0017] Other advantageous and non-limiting characteristics of the method according to the invention are as follows: in the determination step, the supervision setpoint is chosen equal to the first preliminary supervision setpoint if the first diagnosis indicates a concordance between the results of the two fusion steps and if the second diagnosis indicates a concordance between the first preliminary supervision setpoint and the results of at least one of the two fusion steps; the supervision setpoint is zero if the first diagnosis indicates a discrepancy between the results of the two fusion steps and / or if the second diagnosis indicates a discrepancy between the first preliminary supervision setpoint and the results of at least one of the two fusion steps; in the control step, it is verified that the value of the first preliminary supervision setpoint is included in an interval whose limits are defined as a function of said first data; said first and second parts of the sensors form two disjoint or intersecting sets.

[0018] The invention also proposes a control system which is adapted to implement a method for developing a supervision instruction as defined above, comprising for this purpose: a main computer adapted to receive signals from a plurality of sensors equipping the motor vehicle and to calculate a first preliminary supervision instruction for the control of each driving member, and a relay which receives said first preliminary supervision instruction from the main computer and which is adapted to communicate it or not to each driving member.

[0019] This control system further comprises an auxiliary computer adapted to receive signals from a plurality of sensors equipping the motor vehicle and to calculate a second preliminary supervision instruction for the control of each driving member, in which case the relay is adapted to communicate to each driving member one or other of the first and second preliminary supervision instructions. DETAILED DESCRIPTION OF AN EXAMPLE OF IMPLEMENTATION

[0020] The description which follows with reference to the appended drawings, given as non-limiting examples, will make it clear what the invention consists of and how it can be implemented.

[0021] On the attached drawings: THE figures 1 et 2 are diagrams illustrating two embodiments of a control system , the first mode illustrated on the figure 1 being in accordance with the invention, the second mode illustrated on the figure 2 not being included within the scope of the invention.

[0022] As a preliminary point, it will be noted that the identical or similar elements of the different embodiments of the invention represented in the different figures will, as far as possible, be referenced by the same reference signs and will not be described each time.

[0023] The invention relates to a motor vehicle equipped with a control system allowing autonomous driving of the vehicle, without human intervention.

[0024] More specifically, it relates to a system for controlling at least one driving member 71.

[0025] In the examples shown in the figures, only one driving member 71 is considered, but a greater number of driving members 71 can be controlled in the same way.

[0026] This driving member 71 may for example be formed by the engine of the vehicle, or by the steering device. In the remainder of this presentation, it will be considered that the driving member 71 is constituted by the braking system of the vehicle.

[0027] In the examples shown, the control system is connected, at the input, to several sensors 11, 12, 13, 14, and, at the output, to the control member 71.

[0028] Any type of sensor can be used. For example, the motor vehicle may be equipped with at least four cameras facing each of the four sides of the vehicle. It may also include RADAR and / or LIDAR and / or SONAR sensors, facing different directions in space.

[0029] Each sensor has its strengths and weaknesses. For example, a camera provides good obstacle detection at short range, while a radar sensor provides good obstacle detection at long range.

[0030] The control system is then connected, at the input, to these different sensors so as to be able to develop a supervision instruction C3 based on the signals received from these sensors and to be able to transmit it to the control unit 71.

[0031] In the remainder of this presentation, it will be considered that this supervision instruction C3 could be formed by a speed reduction instruction to be imposed on the motor vehicle over a predetermined period.

[0032] The supervision instruction C3 transmitted to the control unit 71 will be developed based on the signals received from several sensors 11, 12, 13, 14, by merging the data provided by these signals.

[0033] By "data fusion" we mean a mathematical method that is applied to several data from heterogeneous sensors and which makes it possible to create or refine data relating to the environment around the motor vehicle.

[0034] For example, data from images acquired by the front camera can be merged with data from other sensors facing the front of the vehicle, in order to detect a possible obstacle and determine its exact position.

[0035] On the figures 1 et 2 , two embodiments of the control system of the driving member 71 are shown, the second not being included in the scope of the invention.

[0036] In the first part of this presentation, we will first describe in detail the first embodiment of the control system, with reference to the figure 1 The second embodiment will be described later in this presentation.

[0037] In the first embodiment, the control system comprises: two computers connected to sensors 11, 12, 13, 14, namely a main computer 1 and an auxiliary computer 2, and a relay 61 which is connected to both computers 1, 2.

[0038] Advantageously, relay 61 responds to an ASIL-D level. It has one output and three inputs. It allows the transmission on its output of the information it receives on one or other of two of its inputs (the input in question being selected according to the information the relay receives on its third input).

[0039] Here, and preferably, the main computer 1 is more reliable than the auxiliary computer 2. It responds to an ASIL-D level while the auxiliary computer 2 responds here only to an ASIL-B level. It is also more powerful than the latter. The auxiliary computer 2 is therefore less expensive and is here designed to carry out simpler operations than those carried out by the main computer 1.

[0040] In practice, the main computer 1 is designed to carry out complex operations allowing the motor vehicle to operate autonomously over an extended period, without any intervention from the driver.

[0041] The auxiliary computer 2 is only designed to carry out simple operations allowing the motor vehicle to move autonomously for a limited period (this limited period may be a few seconds, a few minutes, or even an hour), in order to give the driver time to regain control and / or to perform emergency braking.

[0042] While the main computer 1 takes into account data from sensors of all categories, the auxiliary computer 2 takes into account data from a smaller number of sensors, which all come from a particular category: reliable and proven sensors (i.e. sensors that are more reliable and proven than the average sensor).

[0043] These two calculators 1, 2 are suitable for working in parallel.

[0044] They each include a processor (CPU), random access memory (RAM) and / or read only memory (ROM), and different input and output interfaces to communicate with the sensors 11, 12, 13, 14 and with the relay 61.

[0045] The memory of each computer stores data used in the process described below. In particular, it stores a computer application, consisting of computer programs comprising instructions whose execution by the processor allows the computers to implement the process described below.

[0046] The method for developing the supervision instruction C3 (allowing the control unit 71 to be controlled) can now be described in detail.

[0047] This method is implemented here in several successive steps. Alternatively, the steps could be implemented in a different order than that described below.

[0048] During a first step S21, the main computer 1 carries out a first fusion of the signals received from a first set of sensors 11, 12, 13, 14.

[0049] During a second step S22, the main computer 1 performs a fusion of the signals received from a second set of sensors 11, 12, 13, 14.

[0050] During a third step S23, the auxiliary computer 2 performs a fusion of the signals received from a third set of sensors 11, 12, 13, 14.

[0051] Each of these three steps S21, S22, S23 makes it possible to determine at least one piece of data relating to the environment around the motor vehicle. This may, for example, be a distance to an obstacle, an obstacle direction, a traffic lane position, etc.

[0052] The data from the first and second steps S21, S22 are of the same nature. In other words, if the first step S21 allows the calculation of a distance to an obstacle and an obstacle direction, the second step S22 will also be provided to calculate the distance to this same obstacle and its direction.

[0053] The calculation methods used during the first and second steps S21, S22 or the data used as inputs are, on the other hand, different. Thus, if the first, second and third sets of sensors can be identical, they will preferably be disjoint or intersecting.

[0054] Preferably, the third set of sensors will be the smallest. The first and second sets of sensors will preferably be intersecting.

[0055] During a fourth step S31, the main computer 1 calculates a first preliminary supervision instruction C1 capable of enabling the driving member 71 to be controlled according to the data from the sensors.

[0056] This first preliminary supervision instruction C1 is calculated using a first algorithm, based solely on the data from the first fusion step S21.

[0057] During a fifth step S32, the auxiliary computer 2 calculates a second preliminary supervision instruction C2 capable of enabling the driving member 71 to be controlled according to the data from the sensors.

[0058] This second preliminary supervision instruction C2 is calculated using a second algorithm, based solely on the data from the third fusion step S23.

[0059] It should be noted here that these two algorithms are different, and that the second algorithm has a lower number of instructions than the first algorithm.

[0060] Since such algorithms are well known to those skilled in the art, they will not be described in detail here. It can only be specified that, as an example, the algorithms may respectively use statistical logic and fuzzy logic or Dempster-Shafer logic (evidence theory).

[0061] At the end of these two steps, two preliminary supervision instructions C1, C2 have been calculated and are transmitted to relay 61. The latter will then have the objective of selecting one of these two instructions (which will then be called “supervision instruction C3”) and transmitting it to the control unit 71.

[0062] In the event that no failure is observed, the first preliminary supervision instruction C1 will be selected since the latter is developed based on a greater number of data and thus makes it possible to control the control member 71 autonomously over an extended period.

[0063] Otherwise, the second preliminary supervision instruction C2 will be selected since the latter is developed based on reliable and proven data.

[0064] So that relay 61 can know in which of the two aforementioned cases it is, the main computer 1 will establish two diagnoses Diag1, Diag 2.

[0065] More precisely, during a sixth step, a comparator 41 equipping the main computer 1 compares the data from the first and second fusion steps S21, S22.

[0066] It is recalled that these two steps can be described as redundant in the sense that they are intended to provide results of the same nature and that in the absence of calculation errors, they are expected to provide similar or identical results.

[0067] In practice, this sixth step may, for example, consist of comparing, for each data item resulting from the fusion, the difference between the values ​​from the first and second fusion steps S21, S22 with a predetermined threshold.

[0068] If the difference is less than the predetermined threshold, which means that no calculation error has been detected, the comparator 41 issues a first positive diagnosis Diag1, meaning that the first fusion step S21 has been carried out correctly (the value 1 is then assigned to the first diagnosis Diag1).

[0069] On the other hand, if the difference is greater than the predetermined threshold, which means that a calculation error has been detected, the comparator 41 issues a first negative diagnosis Diag1, meaning that an error may have been made during the first fusion step S21 (the value 0 is then assigned to the first diagnosis Diag1).

[0070] During a seventh step, a controller 33 will verify that the first preliminary supervision instruction C1 presents a possible value (i.e. not surprising), taking into account the data resulting from the first fusion step S21.

[0071] To do this, the controller 33 acquires at least part of the data from the first fusion step S21, then it reads the limits of an interval in a map stored in the main computer 1 (which limits vary depending on the data resulting from the first fusion step S21).

[0072] The controller 33 then checks whether the first preliminary supervision instruction C1 is included or not in this interval.

[0073] If it is included in this interval, which means that no calculation error has been detected, the controller 33 issues a second positive diagnosis Diag2, meaning that the fourth step S31 of calculating the first preliminary supervision instruction C1 has been carried out correctly (the value 1 is then assigned to the second diagnosis Diag2).

[0074] On the other hand, if the first preliminary supervision instruction C1 is not included in this interval, which means that a calculation error has been noted, the controller 33 issues a second negative diagnosis Diag2, meaning that the fourth step S31 of calculating the first preliminary supervision instruction C1 did not take place correctly (the value 0 is then assigned to the second diagnosis Diag2).

[0075] During an eighth step, the main computer 1 checks that the two diagnoses Diag1, Diag2 are positive.

[0076] For this purpose, it includes a logic gate 51 of the “OR” type which is connected, at the input, to the comparator 41 and to the controller 33, and, at the output, to the relay 61.

[0077] Thanks to this logic gate 51, the relay 61 selects the first preliminary supervision instruction C1 if the two diagnostics Diag1, Diag2 are positive. Otherwise, it selects the second preliminary supervision instruction C2.

[0078] It should be noted here that if no signal is transmitted by logic gate 51 to relay 61, for example because the latter is faulty or because the main computer 1 is no longer functioning, relay 61 will naturally consider this absence of signal as an indication to select the second preliminary supervision instruction C2.

[0079] In the embodiment of the figure 2 , not included in the scope of the invention, the control system comprises a single computer 1, which is connected at the input to the sensors 11, 12, 13, 14, and, at the output, to the relay 61.

[0080] This calculator 1 is identical and is programmed identically to the one shown on the figure 1 . Relay 61 also operates identically to the one shown in the figure 1 .

[0081] It is then understood that in this embodiment, the relay 61 selects the first preliminary supervision instruction C1 if the two diagnoses Diag1, Diag2 are positive. Otherwise, it does not transmit any supervision instruction to the control unit 71. This embodiment then applies to the case where the driver can quickly regain control of the motor vehicle, using the steering wheel and the accelerator and brake pedals.

[0082] This embodiment also applies in the case where the disappearance of the supervision instruction does not prevent the safety of the vehicle and its occupants from being ensured. For example, it may be used in the case where the driving assistance system commands the vehicle to move at low speed (which is the case with parking assistance systems, where the application of a predetermined braking instruction in the braking device is sufficient to ensure the desired safety).

Claims

1. Method for generating a supervision setpoint (C3) for controlling at least one driving unit (71) of a motor vehicle equipped with a plurality of sensors (11, 12, 13, 14), comprising: - a first step of fusing signals (S21) received from at least a first group of sensors (11, 12, 13, 14), with a view to determining at least a first datum relating to the environment around the motor vehicle, - a second step of fusing signals (S22) received from at least a second group of sensors (11, 12, 13, 14), with a view to determining at least a second datum relating to the environment around the motor vehicle, - a step (S31) of computing a first preliminary supervision setpoint (C1) depending on each first datum, further comprising: - a step of comparing the first and second data with a view to establishing a first diagnosis (Diag1), - a step of testing the first preliminary supervision setpoint (C1), taking into account at least one of the first and second data, with a view to establishing a second diagnosis (Diag2), and - a step of determining the supervision setpoint (C3) depending on the first and second diagnoses (Diag1, Diag2), wherein: - the fusing and computing steps are implemented by a main computer (1) with which the motor vehicle is equipped, - provision is made for another step (S32), implemented by an auxiliary computer (2) with which the motor vehicle is equipped, of computing a second preliminary supervision setpoint (C2) for each driving unit (71), taking into account signals sent by at least a third group of sensors (11, 12, 13, 14), and - in the determining step, the supervision setpoint (C3) is set equal to the second preliminary supervision setpoint (C2) if the first diagnosis (Diag1) indicates a mismatch between the results of the two fusing steps and / or if the second diagnosis (Diag2) indicates a mismatch between the first preliminary supervision setpoint (C1) and the results of at least one of the two fusing steps.

2. Generating method according to the preceding claim, wherein, in the determining step, the supervision setpoint (C3) is set equal to the first preliminary supervision setpoint (C1) if the first diagnosis (Diag1) indicates a match between the results of the two fusing steps and if the second diagnosis (Diag2) indicates a match between the first preliminary supervision setpoint (C1) and the results of at least one of the two fusing steps.

3. Generating method according to either of Claims 1 and 2, wherein no supervision setpoint (C3) is transmitted to said driving unit (71) if the first diagnosis (Diag1) indicates a mismatch between the results of the two fusing steps and / or if the second diagnosis (Diag2) indicates a mismatch between the first preliminary supervision setpoint (C1) and the results of at least one of the two fusing steps.

4. Generating method according to any of the preceding claims, wherein, in the testing step, it is verified whether the value of the first preliminary supervision setpoint (C1) is contained in an interval the bounds of which are defined depending on said first datum.

5. Generating method according to any of the preceding claims, wherein said first and second groups of sensors (11, 12, 13, 14) form two disjoint or secant sets.

6. Control system for at least one driving unit (71) of a motor vehicle, comprising: - a main computer (1) configured to receive signals from a plurality of sensors (11, 12, 13, 14) with which the motor vehicle is equipped and to compute a first preliminary supervision setpoint (C1) for controlling each driving unit (71), and - a relay (61) that receives said first preliminary supervision setpoint (C1) from the main computer (1), and that is configured to communicate or not communicate it to each driving unit (71), the system being configured to implement a generating method according to any of the preceding claims, the system further comprising an auxiliary computer (2) configured to receive signals from a plurality of sensors (11, 12, 13, 14) with which the motor vehicle is equipped and to compute a second preliminary supervision setpoint (C2) for controlling each driving unit (71), the relay (61) being configured to communicate to each driving unit (71) either of the first and second preliminary supervision setpoints (C1, C2).

7. Computer program, comprising program code for implementing the method of any of Claims 1 to 5, when said program is run on a computer.

8. Computer program product, comprising program code, stored on a computer-readable medium, for implementing the method according to any of Claims 1 to 5, when said program product is run on a computer.