Electronic driver assistance module for a motor vehicle

Abstract

The invention relates to an electronic driver assistance module for a motor vehicle, comprising: - at least one reliable block (U1, U2) adapted to generate a first output data (S1, S2) exhibiting a high level of reliability, and - at least one fallible block (U3) which receives at least one input data relating to the motor vehicle and provides at least one second output data (S3), said second output data being a function of said at least one input data and exhibiting a lower level of reliability than each first output data, and - a security block (U4) which receives the first and second output data as input and provides as output secure information (S4) whose level of reliability is higher than that of said second output data. Figure for the abstract: Fig. 2

Description

Title of the invention: Electronic module for assisting the driving of a motor vehicle Technical field of the invention

[0001] The present invention relates generally to safety in the automotive field.

[0002] It relates more particularly to an electronic module programmed and structured for the purpose of assisting a driver in driving his motor vehicle.

[0003] The invention finds a particularly advantageous application in the design of secure software for automating the driving of motor vehicles. Prior art

[0004] Modern motor vehicles include several computers that offer a large number of functions, including autonomous or semi-autonomous vehicle control functions.

[0005] Among these functions, we can cite for example the function of automatically keeping the vehicle in the center of its lane of travel, or the adaptive speed regulation function (which makes it possible to maintain the speed of the vehicle at a set speed and, if necessary, to regulate this speed if the traffic becomes denser in order to maintain appropriate safety distances).

[0006] These functions implement a significant amount of software, generally representing several million lines of code.

[0007] Some of these functions are critical to vehicle safety. Therefore, the software must be developed according to rigorous design rules defined, for example, by the ISO 26262 standard. The computer hardware and sensors (camera, radar, etc.) are also selected according to this standard.

[0008] This ISO26262 standard defines levels of requirement for automotive safety ranging from level ASIL-A (least critical level) to level ASIL-D (most critical level).

[0009] During the design of the vehicle, it is planned to develop each function in compliance with the ASIL level assigned to it.

[0010] Naturally, the more critical the function, the higher the ASIL level, and the more costly the software development becomes, particularly in terms of development time.

[0011] In parallel with this, the SAEJ3016 standard defines degrees of driving delegation, the highest level (five) designating fully autonomous vehicles and the other levels designating vehicles requiring driver input. Attention may be more or less high.

[0012] In the context of partial vehicle automation (with a level below four), it is necessary to implement a driver attention monitoring function. This program typically consists of monitoring whether the driver has their hands on the steering wheel. Thus, the vehicle's semi-autonomous driving functions can only be implemented if the driver's hands are on the steering wheel.

[0013] The driver attention monitoring function must also satisfy a given ASIL level (for example an ASIL-B level).

[0014] Two strategies can be used to determine whether the driver has his hands on the steering wheel.

[0015] A first strategy consists of measuring the torque exerted by the driver on the steering wheel, while a second strategy consists of equipping the steering wheel with capacitive sensors.

[0016] The second strategy gives the best results, but it is much more expensive than the first, which does not require any dedicated sensors (those used are already present in the vehicles being sufficient).

[0017] In this context, document US20210024075 then proposes to use artificial intelligence (in this case a neural network) in order to improve the detection of the driver's hands on the steering wheel.

[0018] This technical solution proves effective but it has a major drawback which makes it practically unusable: it is not possible to ensure at a reasonable cost that the neural network has the desired ASIL level.

[0019] Furthermore, a new standard, ISO / PAS 21448, has been introduced to cover defects related to the intrinsic limitations of a function. The combination of these two standards for a component incorporating neural network-based functions makes their qualification extremely difficult.

[0020] This is why the best technical solution remains that based on the second strategy, which, it should be noted, is the most expensive. Presentation of the invention

[0021] The present invention proposes a solution for using algorithms that are difficult to qualify at an ASIL level, while limiting their development cost.

[0022] More specifically, the invention proposes an electronic module for assisting the driving of a motor vehicle, comprising: - at least one safe block suitable for generating a first output data that exhibits a high level of reliability, and - at least one fallible block that receives at least one input data relating to the motor vehicle, and that provides at least one second output data, said the second output data being a function of said at least one input data and exhibiting a lower level of reliability than each first output data point, and - a security block which receives as input the first and second output data and which provides as output secure information whose level of reliability is higher than that of said second output data.

[0023] Thus, thanks to the invention, the security block makes it possible, on the basis of the data transmitted by the secure blocks, to verify the data transmitted by the fallible block in order to guarantee its validity and to deduce secure information.

[0024] Thus, it is possible to use artificial intelligence to perform calculations, and then to check the result of these calculations not by redoing these calculations in a safe block, but simply by checking that the fallible block works correctly.

[0025] This solution therefore proves to be inexpensive in terms of development and implementation on a vehicle.

[0026] Other advantageous and non-limiting features of the electronic module according to the invention, taken individually or in all technically possible combinations, are as follows: - said secure information indicates whether a driver of the motor vehicle is attentive; - said secure information indicates whether or not the driver has their hands on the steering wheel of the motor vehicle; - said secure information is determined based on the torque exerted by the driver on the steering wheel; - said at least one input data relates to the torque exerted by a driver of the motor vehicle on a steering wheel of the motor vehicle, and said at least one second output data is determined by comparing said at least one input data with a threshold; - said at least one second output data is determined by means of a neural network; - the fail-safe block provides at least one other output data, the secure information being identical to said second output data if at least one condition is met, said condition being that said other output data is comparable to said first output data; - said other output data is calculated by the fallible block and is considered comparable to said first output data if it is equal to a value that is a function of said first output data; - said other output data is calculated by the fallible block and is considered comparable to said first output data if it is complementary to a function of said first output data; - the secure information is identical to said second output data if at least one condition is met, said condition being that said first output data indicates an absence of hardware error.

[0027] The invention also proposes a motor vehicle comprising a chassis and bodywork elements which define a passenger compartment, at least two steering wheels, a steering system comprising a steering wheel which is located in the passenger compartment and which is connected to the steering wheels, and a torque sensor adapted to measure the torque exerted by the driver on the steering wheel, as well as an electronic module as mentioned above.

[0028] Of course, the various features, variants, and embodiments of the invention can be combined in various ways, provided they are not incompatible or mutually exclusive. Detailed description of the invention

[0029] The following description with regard to the attached drawings, given by way of non-limiting examples, will make it clear what the invention consists of and how it can be carried out.

[0030] On the attached drawings:

[0031] [Fig-1] is a schematic perspective view of a motor vehicle conforming to the invention;

[0032] [Fig.2] is a schematic view of a software for detecting when a driver takes control of the steering wheel of the motor vehicle in [Fig.1].

[0033] In [Fig.1], a motor vehicle adapted to implement the invention is shown.

[0034] This refers to a car. Alternatively, it could be another type of vehicle (truck, motorcycle, bus...).

[0035] Here, this vehicle 1 classically comprises a chassis and bodywork elements which define a passenger compartment in which there is in particular a seat for the driver 5 of the vehicle, a dashboard and a steering wheel 3. It also comprises wheels, of which at least two are steerable.

[0036] This vehicle 1 comprises a powertrain, a braking system, and a steering system for turning the vehicle (not shown in the figure). Typically, the steering system comprises an electronically controlled power steering actuator, the powertrain comprises an electronically controlled engine control actuator, and the braking system comprises an electronically controlled brake actuator.

[0037] This vehicle 1 is further equipped with at least one human-machine interface. In practice, the dashboard incorporates a display screen 4 and at least one speaker (not visible).

[0038] The vehicle 1 also includes an electronic processing unit 2 which includes one or more computers (microprocessors or microcontrollers), memories and input and output interfaces.

[0039] Thanks to its input interfaces, the electronic processing unit 2 is adapted to receive various input data, which come from third-party sensors or computers. This input data relates, for example, to the motor vehicle and its external environment (position on the road, etc.).

[0040] The electronic processing unit 2 is specifically adapted to receive a signal E2 corresponding to the torque measured by a torque sensor acting on the steering system. This measured torque corresponds in practice to the torque exerted by the driver on the steering wheel 3.

[0041] It is also adapted to receive other E31 - E34 signals, including for example the speed of the motor vehicle 1.

[0042] Thanks to its output interfaces, the electronic processing unit 2 is adapted to control the human-machine interface in order to provide information to the driver. It is also adapted to control the power steering actuator, the engine control actuator, and the braking actuator.

[0043] Thanks to its memories, the electronic processing unit 2 stores a computer application, consisting of computer programs (or "software") comprising instructions whose execution by the computers allows the implementation of the process described below.

[0044] In the remainder of this presentation, we will consider that each "software" enables the implementation of a particular "function" to assist in driving the vehicle.

[0045] Here, we will consider more particularly three software programs enabling the execution of two distinct functions of autonomous vehicle piloting and a function of monitoring the driver's attention.

[0046] One of these piloting functions is the automatic regulation of the vehicle speed, known as the ACC function (from the English "Adaptive Cruise Control").

[0047] Thanks to this function, the driver can select a speed setting. This could be, for example, a specific speed (such as 80 km / h), or a request instructing the vehicle to travel, if possible, at the maximum speed permitted on the lane being used. Based on this speed setting and data from sensors on board the vehicle, the ACC function calculates control commands for the engine control actuator and the brake actuator. These commands are calculated to regulate the vehicle's speed either at the set speed as long as no other vehicle is too close ahead of vehicle 1, or at a reduced speed that depends on the speed of the other vehicle ahead. in order to maintain an acceptable safety distance from it.

[0048] Another of these steering functions is keeping the vehicle in the center of its lane, known as the LCA function (from the English "Lane Centering Assist").

[0049] This function allows the vehicle's steering to be controlled automatically so that it remains centered on its lane of travel.

[0050] The monitoring function, which is the subject of this description, makes it possible to check that the driver is paying attention to the operation of his vehicle. It is based here on the detection of the driver holding the steering wheel 3.

[0051] This function, called the HOD function (from the English "Hands On Detection"), is necessary for the implementation of the other two functions in the sense that these other two functions can only be implemented if the driver keeps his hands on his steering wheel (permanently or at least intermittently).

[0052] At this stage, it can be noted that each function must be characterized by a level of reliability, hereinafter referred to as the "ASIL safety level" (from the English "Automotive Safety Integrity Level").

[0053] This ASIL security level allows, on the basis of a risk analysis, to determine to what extent the software is able to implement the function safely.

[0054] The ASIL security level considered here will be established in accordance with the ISO26262 standard.

[0055] Thus, software with a guaranteed level of security can be classified according to four levels, from the lower level ASIL-A to the higher level ASIL-D (level offering the greatest security), passing in order through the levels ASIL-B and ASIL-C.

[0056] On the other hand, software that does not meet any particular security level will have a "QM" classification.

[0057] A first software program will then be said to have a higher ASIL level than another if its ASIL level is classified at a higher level than that of the other software program or if the other software program is classified as "QM".

[0058] It should also be noted that data and equipment can be certified by a security level. This security level will again be defined by the aforementioned standard. Thus, in the following, data, a sensor, or a computer can be characterized by its ASIL level.

[0059] The invention proposes to simplify the design and development of driver assistance software for motor vehicles, while ensuring an ASIL level conforming to the specifications.

[0060] To this end, it is proposed to separate, in the electronic module 20, the electronic processing unit 2 which is responsible for implementing the driving assistance function in question (here the HOD function): - initial functionalities that can be developed with the required ASIL level and - second functionalities that cannot be, then adding a security block to verify that the second functionalities give reliable results based on the results given by the first functionalities.

[0061] Therefore, the electronic module 20 is divided into several distinct software components, hereinafter referred to as "blocks", including: - at least one secure block (Ul, U2) meeting the required ASIL level - at least one fallible U3 block exhibiting a lower ASIL level (typically a QM level), and - a safety block U4 which allows checking the validity of the outputs of each fallible block U3 on the basis of the output of at least one safe block Ul, U2, and which preferably presents the desired ASIL level.

[0062] These blocks are distinct software components. They also preferably form distinct hardware components. In other words, the software components are preferably stored in separate memories and executed by separate computers (processors, logic units, etc.).

[0063] Once these blocks are defined, it is planned to create certification scenarios at the desired ASIL level for the entire driver assistance function. These scenarios are preferably developed to validate this ASIL level in extreme cases, so as to reduce the number of scenarios to be considered.

[0064] It is thus possible to determine the coverage of the chosen model, that is, the percentage of validated scenarios. The objective is for all scenarios to be validated so that all functionalities are guaranteed. The coverage rate is said to be 100%.

[0065] In the context of this presentation, the driving assistance function that will be considered more specifically will therefore be the HOD function, for detecting whether the driver is holding the steering wheel.

[0066] This function will be based on the detection of torque applied to the steering wheel 3 by the driver 5. In other words, the steering wheel will lack capacitive sensors to detect whether or not the driver is placing their hands on it. Instead, the function will be executed based on data transmitted by the torque sensor applied to the steering wheel.

[0067] Here, the electronic module 20 implementing this function comprises two safe blocks Ul, U2, that is to say two software components enabling the provision of data at the desired ASIL level, here at the ASIL B level.

[0068] The first safe block Ul is a component for determining both software and hardware faults. Typically, this block allows the detection of a fault in the Power steering, a fault in the signals circulating on the vehicle's CAN network, a fault in the electronic processing unit 2... Such a block is already known to those skilled in the art, so it will not be described further here. We can only specify that it outputs an SI signal, which may be, for example, a Boolean value equal to 0 as long as no fault is detected and 1 otherwise.

[0069] The second safety block U2 is an interface component for receiving signals E2 from networks external to the electronic processing unit 2, typically CAN or Ethernet networks. This second safety block U2 outputs an output signal S2, which may be, for example, a variable whose value is equal to the torque exerted by the driver 5 on the steering wheel 3. Typically, this can be an analog-to-digital interface.

[0070] The electronic module 20 here comprises a single fallible block U3, that is to say a single software and hardware component which provides data not at the desired ASIL level, here data at the QM level.

[0071] This fallible block U3 nevertheless constitutes the heart of the electronic module 20 since it is the one that is able to determine whether the driver has, or does not have, his hands on the steering wheel.

[0072] It receives as input the S2 output signal from the second safe block U2 (the torque exerted on the flywheel).

[0073] It also receives several other data points here, namely: - an E31 signal indicating the vehicle's speed, - an E32 signal indicating any request from the driver relating to the LCA function (does he wish to activate it or not?), - an E33 signal indicating whether the LCA and ACC functions are active or not, and - an E34 signal relating to the friction torque detected on the steering system.

[0074] Based on this information, this block is able to provide, firstly, an S33 signal relating to whether or not the driver is holding the steering wheel. This signal is, for example, in the form of a boolean equal to 0 as long as the driver has their hands on the steering wheel and to 1 otherwise.

[0075] This fallible block U3 is also capable of providing two signals S31, S32 which will be used to verify whether the signal S33 is reliable. These two signals are preferably formed by forcing the fallible block U3 to perform operations. The reliability of this fallible block U3 can thus be checked by verifying that the results of these calculations are correct.

[0076] In practice, one of these signals S31 is equal to the average of the torque exerted by the driver on the steering wheel over a predetermined period, for example on the order of a second. Another of these signals S32 results from a signal coding operation S33. In this case, it is a mirror version of the S33 signal, which therefore takes the form of a boolean equal to 1 as long as the driver has their hands on the steering wheel and to 0 otherwise.

[0077] At this stage, we can describe in more detail how the S33 signal relating to whether or not the driver is holding the steering wheel is generated here.

[0078] The fallible block U3 here comprises three units U31, U32, U33.

[0079] The first and second units U31, U32 are designed to determine in parallel, and on the basis of the received signals, two evaluations of the signal S33.

[0080] Alternatively, only one of the two evaluations could be carried out, in which case the S33 signal would be equal to that evaluation.

[0081] Here, one of these evaluations is carried out by thresholding.

[0082] For this operation, the driver is considered to have their hands on the steering wheel when the difference between the measured torque and the friction torque exceeds a predetermined threshold. This threshold may vary, for example, depending on the vehicle's speed.

[0083] The other of these evaluations is carried out using a neural network. It is based on a part of the inputs, here on all of them.

[0084] This neural network could be of any type. Here, it is a feedforward / recurrent neural network (“RNN”).

[0085] This neural network comprises an input layer, at least one hidden layer, and an output layer, with several artificial neurons on the hidden layers.

[0086] The activation functions used within the hidden layers are, for example, of the sigmoid type.

[0087] The neural network will be trained, for example, by backpropagation of the error gradient on a training set. The training set will correspond to already known data values.

[0088] We will not define this neural network further here, but we can only specify that it is very difficult to qualify at the ASIL B level. This is also the reason why the fallible block U3 is not qualified here at the ASIL B level.

[0089] Based on the two evaluations, it is possible to determine the S33 signal, for example by considering one or the other of the two evaluations when they differ, depending on the configuration in which the vehicle is located (the thresholding working for example better at low speed but less well at high speed).

[0090] The third unit U33 integrated into the fallible block U3 is designed to select one of the two evaluations. Furthermore, based on signal S2, it allows the average torque applied to the flywheel to be determined over a predetermined period (signal S31). Additionally, based on signal S33, it allows a mirror image of this signal S33 to be determined (i.e., signal S32).

[0091] As explained above, these two signals S31 and S32 will allow To verify that the fallible block U3 functions correctly, we use two distinct signals. These signals are preferably formed using operations of different types performed on separate signals. Alternatively, we could use a larger or smaller number of signals to verify that the fallible block U3 functions correctly.

[0092] We can now focus on the safety block U4 which receives all the output signals from the fallible blocks U3 and safe blocks Ul, U2.

[0093] This U4 security block is designed to validate or reject the S33 signal, under at least one condition. In the described and illustrated embodiment, three conditions are necessary to validate the S33 signal.

[0094] The first condition is controlled by a U41 block, which receives as input the SI signal (relating to the presence or absence of a fault, whether software or hardware).

[0095] This U41 block checks in practice whether a fault has been detected or not. As long as no fault is detected, this U41 block outputs a signal S41 corresponding to a boolean value of 1. Otherwise, the signal is zero.

[0096] The second condition is controlled by two blocks U42 and U43.

[0097] The U42 block receives the S2 signal (the measured torque) as input and deduces a average of the couple measured over the predetermined period.

[0098] Block U43 compares this average with the one calculated by block U3 (signal S31). In practice, it outputs a signal S43 corresponding to a boolean value of 1 if the two averages are of the same order. Otherwise, the signal is zero.

[0099] It should be noted here that the consistency check of the two average torque values ​​is carried out by allowing a margin of error over a maximum duration. Typically, a maximum margin of 0.1 Nm for a maximum of 100 ms can be allowed.

[0100] The advantage of this mechanism is that it will allow the validity of the S33 signal to be checked by verifying that the U3 block calculates a reliable average torque.

[0101] The third condition is controlled by block U44, which receives input signals S32 and S33, which are assumed to be complementary. If this is indeed the case, the third condition is met. Therefore, block U44 outputs a signal S44 corresponding to a Boolean value of 1. Otherwise, the signal S44 is zero.

[0102] The advantage of this mechanism is once again to be able to control the validity of the S33 signal by verifying that the U3 block gives reliable results, thus meaning that the component is not corrupted and that there has been no transmission error between these two components.

[0103] Therefore, if the three conditions are met simultaneously, that is, if all the signals S41, S43, and S44 are equal to 1, the consolidation block U45 provides at the output of the electronic module 20 a signal S4 equal to the signal S33 calculated by the block U3. In other words, the signal S33 from the fallible block U3 is thus considered reliable. and that it reliably indicates whether or not the driver has their hands on the steering wheel.

[0104] Otherwise, the S4 signal takes a different value from that of the S33 signal. This default value allows the LCA and ACC functions to be deactivated. In other words, the S33 signal from the fallible U3 block is considered unreliable, and since it cannot reliably determine whether the driver has their hands on the steering wheel, it is necessary to deactivate the LCA and ACC functions. Note that this deactivation can be gradual and occur after several warnings to the driver (displayed on the screen and emitted through the speakers).

[0105] It is understood that the U4 security block, which responds to the ASIL B level and which relies on data from secure blocks, makes it possible to transform an S33 signal at the QM level into an S4 signal at the ASIL B level.

[0106] The present invention is in no way limited to the embodiment described and represented, but a person skilled in the art will be able to make any variation in accordance with the invention.

Claims

Demands

1. Electronic module (20) for assisting the driving of a motor vehicle (1), comprising: - at least one reliable block (U1, U2) adapted to generate a first output data (SI, S2) which has a high level of reliability, and - at least one fallible block (U3) which receives at least one input data relating to the motor vehicle, and which provides at least one second output data (S33), said second output data (S33) being a function of said at least one input data and having a lower level of reliability than each first output data (SI, S2), and - a security block (U4) which receives as input the first and second output data (SI, S2, S33) and which provides as output secure information (S4) whose level of reliability is higher than that of said second output data (S33), in which the fallible block (U3) provides at least one other output data (S31, S32),the secure information (S4) being identical to said second output data (S33) if at least one condition is met, said condition being that said other output data (S31, S32) is comparable to said first output data (S1, S2).

2. Electronic module (20) according to claim 1, wherein said secure information (S4) indicates whether a driver of the motor vehicle (1) is attentive, preferably by indicating whether or not he has his hands on a steering wheel (3) of the motor vehicle (1).

3. Electronic module (20) according to claim 2, wherein said secure information (S4) is determined as a function of the torque exerted by the driver on the steering wheel (3).

4. Electronic module (20) according to any one of claims 1 to 3, wherein said at least one input data relates to the torque exerted by a driver of the motor vehicle (1) on a steering wheel (3) of the motor vehicle (1), and said at least one second output data (S33) is determined by comparing said at least one input data with a threshold.

5. Electronic module (20) according to any one of claims 1 to 4, wherein said at least one second output data (S33) is determined by means of a neural network.

6. Electronic module (20) according to any one of claims 1 to 5, in which said other output data (S31, S32) is calculated by the fallible block (U3) and is considered comparable to said first output data (SI, S2) if it is equal to a value function of said first output data (SI, S2).

7. Electronic module (20) according to any one of claims 1 to 6, wherein said other output data (S31, S32) is calculated by the fallible block (U3) and is considered comparable to said first output data (SI, S2) if it is complementary to a function of said first output data (SI, S2).

8. Electronic module (20) according to any one of claims 1 to 7, wherein the secure information (S4) is identical to said second output data (S33) if at least one condition is met, said condition being that said first output data (SI, S2) indicates an absence of hardware error.

9. Motor vehicle (1) comprising a chassis and bodywork elements which define a passenger compartment, at least two steering wheels, a steering system comprising a steering wheel (3) which is located in the passenger compartment and which is connected to the steering wheels, and a torque sensor adapted to measure the torque exerted by the driver on the steering wheel, characterized in that it further comprises an electronic module (20) according to any one of claims 1 to 8.

Images