Autonomous vehicle management system

Abstract

Autonomous Vehicle Management System. The present invention relates to a management system (1) for an autonomous vehicle, comprising: at least one central unit (2) comprising a plurality of management modules (4) for a characteristic related to the autonomous vehicle, each management module (4) being capable of processing measurements or data to generate a control instruction for actuators (8) and / or to generate data for at least one other management module; at least one safety unit (3) comprising a plurality of safety modules (5), each being specifically linked to one of the management modules (4) of the central unit (2) and being configured to detect an anomaly in the corresponding management module (4); and an emergency stop module (6) ensuring the emergency stop of the vehicle in the event of a detected anomaly. The invention also covers a management method implemented by such a management system (1). (Figure 1)

Description

Title of the invention: Management system for an autonomous vehicle

[0001] The present invention relates to the field of autonomous vehicles, and more particularly concerns a management system for such autonomous vehicles.

[0002] Autonomous vehicles are designed to operate in specific environments and under specific conditions. They regularly encounter specific situations due to environmental variables and the type of sensors / actuators they use, and must respond to these situations as efficiently and safely as possible. Autonomous vehicles must therefore be equipped with sensors capable of detecting essential characteristics for autonomous operation, and with management systems configured to, firstly, retrieve precise data on parameters such as, for example, perception of the external environment or geolocation, via these sensors, in order to generate instructions, and secondly, based on this data, generate control instructions for actuators that ensure the implementation of the vehicle's driving functions, among others.

[0003] Autonomous vehicles must be capable of performing more or fewer actions without driver intervention, depending on their degree of autonomy. It is understood that the higher the degree of autonomy, the higher the safety standards.

[0004] It is thus known to have, within the management system, means of verifying the instruction sent to an actuator so that in the event of an anomaly detected, the autonomous vehicle can adapt its operation to said anomaly, by acting on the vehicle's actuators, either via a correction or via an emergency stop depending on the severity of the anomaly.

[0005] Current management systems are, however, configured to detect anomalies in the final command instruction sent to the actuator by the management system. This command instruction may result from the compilation of several data points detected by different sensors. In fact, current management systems are configured to act in the same way, and in particular to perform a safe emergency stop, regardless of the source of the anomaly. Autonomous vehicles may therefore not respond optimally to an anomaly occurring specifically in a particular characteristic of the autonomous vehicle or its environment.

[0006] The present invention falls within this context and, as such, proposes a management system for autonomous vehicles, comprising: - at least one central unit comprising a plurality of management modules for a characteristic related to the autonomous vehicle, each management module being capable of processing measurements from detection means, and / or processing data from at least one other management module, to generate a control instruction for actuators and / or to generate data for at least one other management module, - at least one safety unit comprising a plurality of safety modules, each being specifically linked to one of the management modules of the central unit and being configured to detect an anomaly of the corresponding management module, as well as an emergency stop module ensuring the emergency stop of the vehicle in the event of an anomaly detected.

[0007] In other words, all security control operations are decentralized and performed in a unit separate from the central unit. They can thus be advantageously divided into several control operations, each control operation specific to a parameter implemented by a management module. Each control operation is performed by one of the security modules linked to said management module. Each security module only acts on the control of the parameter processed by the management module to which it is associated. This allows, on the one hand, for a more specific and tailored response to potential anomalies, and on the other hand, for the simplified integration of new functions without having to make complex modifications to the security system, since it is necessary to add a security module independent of the other security modules already in place.

[0008] The central unit is capable of acting on the vehicle according to the control instructions generated by one or more of its management modules. The central unit continuously receives measurements from the detection means, which may be sensors onboard the vehicle. These measurements are then processed by the management modules to generate a control instruction for one or more actuators. Each actuator receives measurements specific to it, and some measurements may be useful and thus sent to several modules. In addition, the management modules are capable of generating data for a higher-level management module, based on the information received, which may be a measurement acquired by a sensor on the vehicle or data previously generated by a lower-level management module.

[0009] In this respect, the management system according to the invention can be considered as a hierarchical system, in which an intermediate-level management module can receive data from a lower-level management module and use this data, and where appropriate other parameters acquired by suitable sensors, to generate new data for a higher-level management module.

[0010] In other words, the management modules are configured to operate in cascade, and according to the invention, the security unit is configured so that a security module can intervene at each of these successive operating stages.

[0011] The central processing unit, and in particular via the highest-level control module, is configured to generate a global control instruction for the actuators, taking into account the various data generated successively by each of the control modules. For example, the actuators could be the accelerator, the brakes, or the steering wheel. The actuators are then activated to respond effectively to this control instruction or instructions.

[0012] According to various non-exhaustive examples, the management modules can be dedicated to vehicle localization, environmental perception, vehicle navigation or vehicle control.

[0013] The safety unit comprises a safety module for each of the corresponding management modules as well as the emergency stop module. A safety module specifically linked to a management module means that a management module and a safety module are linked only to each other, forming pairs of modules, each pair being related to a characteristic of the autonomous vehicle.

[0014] It follows from the above that the safety unit comprises an additional module compared to the central unit, namely the emergency stop module. The safety modules are configured to generate, based on the operation of the monitoring function of their associated management module, an alert to this emergency stop module, which is capable of directly activating the actuators for an emergency stop, particularly if the situation is deemed critical.

[0015] When a new function needs to be added to the management system provided in previous versions of the autonomous vehicle, it is thus easier to integrate it into the management system. If it is necessary to add a management module to the central unit and to configure said central unit so that the overall control instruction to be sent to the actuators takes into account the presence, in the data chain transmitted from management module to management module, of the data generated by the new management module, the modification of the safety unit is simplified insofar as it is sufficient to add a corresponding safety module, independent of the other safety modules.

[0016] According to one feature of the invention, each safety module is configured to receive the measurements and / or data received by the corresponding management module. While the central unit, through its management modules, uses the measurements transmitted by the detection means to generate a control instruction to one or more actuators associated with a given function, the unit of security is configured to process, for each management module that is part of this security unit, the measurements transmitted by the detection means and / or the data received from a lower-level management module, only to check in one case whether the corresponding detection means are in good working order and whether the measurements taken are sufficiently reliable and in the other case whether the data transmitted by the lower-level management module(s) in the chain of management modules are sufficiently reliable, so that the command instruction generated by the central unit can be considered.

[0017] According to one feature of the invention, each safety module is configured to receive control instructions and / or data generated by the corresponding management module. Such control instructions and / or data are generated by the management modules based on measurements and / or data previously received. According to the invention, it is the responsibility of the safety module associated with a management module to verify whether the control instruction and / or data generated by said management module is correct. To this end, the control instructions and / or data are transmitted from the management modules to the corresponding safety modules.

[0018] In other words, a double check is performed by the security module associated with a management module in order to carry out an upstream check, via the detection means directly and the data received, and a downstream check, via the control instructions and / or the data generated by its corresponding management module. This also improves the ability to detect a potential anomaly and makes it possible to locate this anomaly within the hierarchical system with management modules of different ranks. The management system according to the invention, in addition to being simplified, is also more efficient.

[0019] According to one feature of the invention, the emergency stop module is configured to communicate with each of the safety modules. The emergency stop module acts as an intermediary between the safety modules, which can detect a potential anomaly, and the actuators. The emergency stop module is configured to compile the safety alerts that can be sent to it by each of the safety modules, and to determine whether or not to initiate an emergency stop based on the severity of the safety alerts.

[0020] The invention also covers a method for managing an autonomous vehicle, implemented by a management system as described above, comprising: - a measurement step of at least one parameter by detection means and / or a generation step of at least one data point by a management module of rank n-1 of the central processing unit, - a step of transmitting the measurements and / or data generated by said management module to a management module of rank n of the central unit and to the security module of the security unit which is associated with the management module of rank n, - a generation step by the central processing unit's level n management module of control instructions destined for actuators and / or data destined for at least one level n+1 management module by the central processing unit's management module from the measurement of at least one parameter and / or at least one transmitted data point, - a step of transmitting command instructions and / or data generated by the nth-level management module of the central unit to the security module of the security unit associated with the nth-level management module, - a comparison step, by the security module of the security unit, of the measurements and / or data transmitted to the level n management module by the detection means, and / or the control instructions and / or the data generated by the level n management module of the central unit, to a threshold value, - an emergency stop step by the emergency stop module depending on the result of the comparison step.

[0021] Such a process is carried out and repeated continuously to monitor the autonomous vehicle, prevent any anomaly that may occur during a journey of the autonomous vehicle, and bring the vehicle to an emergency stop in the event of a detected anomaly. The detection means perform measurements that can be analyzed by one or more management modules and / or one or more safety modules. As mentioned, the detection means can be sensors.

[0022] When measurements are transmitted, they are sent identically to one of the management modules and its corresponding safety module, each safety module being specifically linked to one of the management modules. The same measurement can be transmitted to several management modules and several safety modules if said measurement is relevant to different characteristics related to the autonomous vehicle. Similarly, in the hierarchical system, when data generated by a management module of rank n is transmitted, it is sent identically on the one hand to the module of rank n+1, so that the latter can use the data to generate other, broader data or a control instruction to actuators, and on the other hand to a safety module associated with the module of rank n.

[0023] The management modules are capable of receiving measurements and / or data from a lower-level management module, analyzing them, and generating control instructions for the actuators and / or data for a higher-level management module. These control instructions and / or data are also transmitted to the corresponding safety modules. As previously stated, each safety module of the safety unit is configured to detect a first type of structural anomaly, for example, based on the analysis of measurements transmitted by the detection means, and a second type of software anomaly, for example, based on the analysis of control instructions transmitted by the management module of the central unit associated with that safety module.Each security module of the security unit is thus capable of verifying the veracity of the information received by the corresponding management module, at a structural level of control, and of verifying the correctness of the command instruction executed by the corresponding management module, at a software level of control.

[0024] The comparison step allows for the detection of anomalies. For each measurement or instruction, a threshold value is established to determine a limit beyond which the situation to which said measurement, data, or instruction is linked is considered abnormal. For each measurement, data, or instruction, an anomaly can be detected if said measurement, data, or instruction is greater than or less than the threshold value.

[0025] In the event of an abnormal exceedance of this threshold value, the emergency stop step is then triggered to stop the autonomous vehicle.

[0026] According to one feature of the method, the measurement step is performed by at least one sensor and / or the control instruction generation step is performed by at least one software data generator. As mentioned previously, the sensor, i.e., the detection means, can perform the measurements and then transmit them simultaneously to a central processing unit management module and to the safety module of the safety unit associated with that management module.The software data generator is integrated into each of the central unit's management modules to generate control instructions based on measurements transmitted by the detection means. These control instructions are then transmitted both to the actuators, via, if necessary, a compilation of data with other control instructions to generate a global control instruction for the actuators, and to the corresponding safety module within the safety unit.

[0027] According to a characteristic of the process, a hierarchy of the measures and / or control instructions and / or data received by a safety module is This process is implemented to determine the priority order for processing measurements, control instructions, and / or data. This priority order can be based, for example, on the degree of importance or severity of potential anomalies resulting from incorrect measurements or control instructions. Depending on the progression of the comparison step, all measurements, data, and / or control instructions can be compared sequentially according to their priority order and against their respective threshold values.

[0028] According to a feature of the method, the processing of measurements transmitted by the detection means takes priority over the processing of data and / or control instructions. Measurement processing can be prioritized in particular because it can be implemented by the safety module with greater responsiveness, since it is not necessary to wait to receive the data or control instruction from the management module, and since the data or control instruction generated by the management module is itself affected by the accuracy of the measurement.

[0029] According to a feature of the process, the comparison step is linked to at least one heuristic rule. In other words, if the heuristic rule is not respected, the emergency stop step is implemented. A heuristic rule is not respected when the measurement, data, or instruction becomes greater than or less than the corresponding threshold value. If the heuristic rule is respected, the next measurement, data point, or control instruction, according to the hierarchy established for information processing by the safety module, is in turn compared to its threshold value, and so on until all measurements and / or data and / or instructions have been compared and all heuristic rules have been verified.

[0030] The following will list various parameters and their heuristic rule(s) according to several non-exhaustive examples. A parameter relating to the measurement transmitted by the detection means could be the number of satellites detected by the autonomous vehicle, and the associated heuristic rule triggers an emergency stop of the vehicle if the number of satellites is less than a minimum threshold.

[0031] Another parameter may be the quality of satellite reception and the associated heuristic rule causes an emergency stop of the vehicle if the quality of satellite reception is less than a minimum value.

[0032] Another parameter may be related to a discrepancy between the vehicle's actual location and its virtual location detected by satellite. The associated heuristic rule triggers an emergency stop of the vehicle if this discrepancy exceeds a maximum value.

[0033] Another parameter can be linked to the radar frequency of the autonomous vehicle. The associated heuristic rule triggers an emergency stop of the vehicle if this frequency is below a minimum value.

[0034] These example parameters can be detected by the detection means.

[0035] Another parameter can be linked to a deviation in orientation and / or position of the autonomous vehicle relative to satellite detection. Its heuristic rule triggers an emergency stop of the vehicle if the deviation in orientation and / or position of the autonomous vehicle exceeds a maximum value.

[0036] Another parameter can be linked to a deviation in the autonomous vehicle's speed from a reference speed or a speed limit imposed on the road. The associated heuristic rule triggers an emergency stop of the vehicle if the orientation and / or position of the autonomous vehicle exceeds a maximum value.

[0037] Another parameter can be linked to a deviation between the autonomous vehicle's trajectory and a reference trajectory. The associated heuristic rule triggers an emergency stop of the vehicle if this deviation exceeds a maximum value.

[0038] According to a feature of the process, several parameters with their own associated heuristic rule are specifically linked to a single module. In other words, a feature linked to a security module and its corresponding management module can be controlled with several heuristic rules governing that single feature.

[0039] According to one feature of the method, the emergency stop module maintains the emergency stop until the heuristic rule is resolved. If an attempt is made to restart the autonomous vehicle, the heuristic rule that triggered the emergency stop is checked again. If it is still not resolved, the autonomous vehicle stops again.

[0040] Other features and advantages of the invention will become apparent from the following description on the one hand, and from several illustrative and non-limiting examples of embodiments given with reference to the accompanying schematic drawings on the other hand, in which:

[0041] [Fig-1] is a schematic representation of a vehicle management system autonomous according to the invention,

[0042] [Fig.2] is a flowchart of a management process for said autonomous vehicle put into implemented by the management system according to the invention,

[0043] [Fig.3] is a parameter table for controlling a first characteristic of the autonomous vehicle by a safety module of the management system according to the invention,

[0044] [Fig.4] is a parameter table for controlling a second characteristic of the autonomous vehicle by a safety module of the management system according to the invention.

[0045] Figure 1 schematically represents a management system 1 according to the invention, configured to operate within an autonomous vehicle. The management system 1 is Specifically configured to define a driving command for the autonomous vehicle and to ensure the implementation and monitoring of this driving command. Depending on the degree of autonomy of the vehicle to which the management system is applied, the latter may be designed to provide driving assistance or to handle the entire vehicle driving process without human intervention.

[0046] The management system 1 comprises a central unit 2 and a safety unit 3, each of which comprises a plurality of modules. Thus, the central unit 2 comprises a plurality of management modules 4 while the safety unit 3 comprises a plurality of safety modules 5 as well as an emergency stop module 6.

[0047] In [Fig. 1], the central unit 2 comprises four management modules 4a, 4b, 4c, 4d, while the safety unit 3 comprises four safety modules 5a, 5b, 5c, 5d. It should be noted that the number of management modules 4 and safety modules 5 is not fixed and may depend on the vehicle model in which the management system is installed. However, as will be detailed below, the number of management modules within the central unit 2 is equal to the number of safety modules 5 within the safety unit 3.

[0048] The management system 1 also includes detection means 7. These detection means 7 can, for example, be sensors configured to measure various parameters related to the autonomous vehicle. The measurements are subsequently transmitted to the central unit 2 and the safety unit 3.

[0049] The management system 1 includes actuators 8 whose function is, in particular, to control the movement of the autonomous vehicle, the actuators being controlled by means of control instructions emanating from the central unit 2. The actuators 8 can, for example, be the accelerator, the brakes or the steering wheel of the autonomous vehicle.

[0050] The central unit 2 is capable of processing the measurements transmitted by the detection means 7 to generate a global control instruction to at least one actuator. This global control instruction may be a synthesis of the control instructions Ica, Icb, and Icc generated by each of the management modules 4 for that actuator, based on the measurements and input data sent to it. If applicable, only one of the management modules 4, here a control management module 4d, is configured to generate a control instruction, and the global control instruction corresponds to that single control instruction.

[0051] As can be seen in [Fig. 1], the management system is configured in a cascade with a hierarchical arrangement of the management modules 4 within the central unit 2. A management module of rank n is intended to receive, where applicable, a data Da, Db, From a lower-rank management module n-1 to generate in response data destined for a higher-rank management module n+1.

[0052] In the illustrated example, without limiting the invention as regards the number of modules or their function, the central unit 2 comprises four management modules including a localization management module 4a, a perception management module 4b, a navigation management module 4c and a control management module 4d.

[0053] The location management module 4a receives measurements directly from the sensors and is configured accordingly to calculate data describing the vehicle from a more generic perspective. It is thus configured to generate a Da data point which will be transmitted to the next higher-level management module, in this case the perception management module, and can, if necessary, generate a control instruction Ica intended for one or more vehicle actuators, which the general unit will then compile.

[0054] The perception management module 4b, a higher-level module compared to the location management module 4a, retrieves the data generated by the location management module and, where applicable, other data, such as parameters from sensors, necessary for it to generate a data Db for transmission to a higher-level management module, in this case, the navigation management module. Where applicable, as before, the management module can generate a control instruction Icb intended for one or more vehicle actuators, which the general unit will then compile.

[0055] The navigation management module 4c, a higher-level module compared to the perception management module 4b, retrieves the data generated by the perception management module and, where applicable, other data, such as parameters from sensors, necessary for it to generate a De data point and transmit it to a higher-level management module, in this case, the control management module. Where applicable, as before, the management module can generate a control instruction Icc intended for one or more vehicle actuators, which the general unit will then compile.

[0056] It is understood that the cascade operation makes it possible to arrive at a general data suitable for controlling the actuators, the data generated by a management module being linked to an increasingly broader technical perspective as the data is considered by the management modules of rank n+1. Thus, in the configuration of the system according to the invention, there is a flow of information that passes from management module to management module to ultimately allow the central unit to act globally on the actuators.

[0057] For example, a Da data generated by the location management module 4a can be the speed of the vehicle or its orientation, a Db data subsequently generated by the perception management module 4b can be obstacle detection, the estimated time before a collision or trajectory estimation, a De data subsequently generated by the navigation management module 4c can be the definition of target trajectories and it is on this basis that the control management module 4d generates a command instruction le for the actuators 8.

[0058] The safety unit 3 has the function of detecting anomalies in the global control instruction generated by the central unit 2 for the actuators 8, and according to the invention, this anomaly detection function is carried out separately by each of the safety modules on the control instruction carried out by one of the management modules to which this safety module is associated.

[0059] The distinctive feature of the management system 1 according to the invention is that each management module 4 of the central unit 2 is specifically linked to one of the safety modules 5 of the safety unit 3. "Specifically linked" means that a management module 4 and a safety module 5 are linked only to each other and not to any other module, the set of modules thus forming pairs of modules specifically linked to each other. Advantageously, there are therefore as many management modules 4 as there are safety modules 5. However, there is one more module in the safety unit 3 than in the central unit 2, as the safety unit 3 also includes the emergency stop module 6.

[0060] A management module 4 and the corresponding safety module 5 are linked to the management of a characteristic or category of characteristics of the autonomous vehicle, for example, the management of location, environmental perception, or control of the autonomous vehicle. Thus, the management of the autonomous vehicle is compartmentalized, which makes it possible, on the one hand, to implement, in the event of a detected anomaly, a vehicle response more adapted to said anomaly, and on the other hand, to simplify modifications to the management system 1, for example, when adding or removing a feature and the associated pair of modules, which can thus be done without having to modify the entire management system 1.

[0061] As illustrated in [Fig. 1], the detection means 7 are capable of communicating the measurements taken to the central unit 2 but also directly to the security unit 3. More specifically, the measurements are transmitted to the management modules 4 and the security modules 5. At least one management module, the lowest-ranking management module in the hierarchical organization of management modules, receives the measurements that are specific to its associated characteristic and can process said measurements to generate a data point Da. Where appropriate, a measurement can be transmitted to several management modules 4 and several security modules 5 if said measurement is relevant for the analysis of several characteristics related to different modules.

[0062] The safety unit 3 receives the measurements transmitted by the detection means 7 to verify whether the information contained in these measurements is reliable and can subsequently serve as a basis for generating reliable control instructions, while the central unit 2 receives the measurements transmitted by the detection means 7 to generate said control instructions, without specific verification of the veracity of the information received. As illustrated, based on initial information from the detection means 7, the management modules progressively generate data Da, Db, De, which they communicate to the higher-level management module so that the latter can determine broader data for the operation of the vehicle.

[0063] According to the invention, the control modules 4 can also transmit to their corresponding safety module 5 the instructions and / or data generated from the measurements and / or data received. The safety modules have the function of verifying, for their corresponding control module, the control instruction Ica, Icb, Icc, and / or the generated data Da, Db, De.

[0064] The safety modules can thus bring the vehicle to a halt if they detect an anomaly in the measurements directly transmitted by the detection means 7 or in the instructions and / or data generated and transmitted by the management modules 4. Advantageously, the safety modules 5 implement a dual verification process: both software-based, to verify the accuracy of the control instruction based on given measurements, and structural, to verify the reliability of the measurements sent by the detection means. The configuration of the safety modules thus improves the anomaly detection capability of the management system 1.

[0065] In order to ensure effective and easy-to-implement anomaly detection, and in particular to adapt to the type of vehicle on which the management system is mounted, a management process 10, the logic diagram of which is represented in [Fig.2], is implemented by the management system and in particular by each of the safety modules provided in the management system.

[0066] According to the management process 10, this begins with a measurement step 11 by the detection means 7. As previously described, the detection means 7 can be sensors capable of taking measurements relevant to the continuation of the management process 10.

[0067] Once measurement step 11 has been completed, the measurements are transmitted to the central unit 2 and the safety unit 3 during a measurement transmission step 12. These measurements can then be analyzed by both units 2 and 3. In particular, the measurements of a given parameter are analyzed by a central unit 2 management module, to deduce a command instruction and / or data to be forwarded to a higher-level management module, and analyzed by the corresponding security module of the security unit 3 to verify if the measurements are reliable.

[0068] Each management module of rank n of the central unit 2 processes the received measurements and / or data and consequently generates instructions for actuators and / or data for a management module of rank n+1 during an instruction generation step 13, then transmits these instructions and / or data to the safety unit 3 during an instruction transmission step 14. The instruction generation step 13 can be carried out via a software data generator.

[0069] During the instruction transmission step 14, the control instructions Ica, Icb, Icc and / or data Da, Db, De are transmitted equally to the actuators 8 and to the safety modules of the safety unit 3.

[0070] The safety modules of the safety unit 3 can therefore process both the measurements received during the measurement transmission step 12 and the instructions and / or data received during the instruction transmission step 14. More specifically, each processing operation takes place between the management module and its corresponding safety module, individually as described above. Depending on the characteristic being analyzed, the processing can be performed directly from the measurements taken during the measurement step 11 and / or from the instructions and / or data generated during the instruction generation step 13, depending on the characteristic to be processed.

[0071] Based on these measurements, data, or instructions, a comparison step 15 of said measurements and / or data and / or instructions is implemented by the safety module corresponding to a given function, using one or more heuristic rules. Each heuristic rule consists of comparing a measurement, data, and / or control instruction to threshold values ​​Vs, the latter being established to detect an anomaly when the measurement, data, and / or instruction exceeds the corresponding threshold value. The threshold values ​​can be a maximum limit, exceeding which is abnormal, or a minimum limit below which it is important not to fall.

[0072] Thus, in the event of an abnormal value, an anomaly is detected. In this situation, the management process 10 then continues with an emergency stop step 16. This step is carried out via the emergency stop module 6 described previously, the latter being capable of acting on the actuators 8. This step allows the autonomous vehicle to stop.

[0073] During comparison step 15, all the measurements of the data and instructions received by the security module can be processed, in an order of Defined and prioritized processing. Specifically, measurements are processed before instructions. As illustrated in [Fig. 2], the values ​​X and Y are processed before the values ​​Z and W. The values ​​X and Y can thus result from measurements, while the values ​​Z and W can result from data or instructions. Furthermore, a priority order can also be implemented at the measurement level, or at the data and instruction level.

[0074] It is noteworthy that these heuristic rules are specific to a safety module, solely associated with monitoring the proper functioning of a specific management module. This pair of modules is intended for carrying out instructions relating to a given characteristic of the vehicle.

[0075] In other words, one or more parameters linked to one or more heuristic rules are associated with a given characteristic of the vehicle, and this characteristic is associated with a pair of modules specifically linked to each other. The characteristic could, for example, be the vehicle's location, the perception of the environment outside the vehicle, the vehicle's navigation, or the vehicle's control.

[0076] By way of example, without limiting the invention, the security operations carried out by the appropriate security module for a feature relating to vehicle location, as well as the security operations carried out by the appropriate security module for a feature relating to vehicle control, will be described below.

[0077] Fig. 3 illustrates more particularly the parameterization of a security module 5a associated with a management module 4a dedicated to a first characteristic Cl relating to the location of the vehicle.

[0078] This first characteristic Cl is controlled here through five parameters Pli, P12, ..., PI5, it being understood that the number of parameters and their descriptions are given here by way of example. These five parameters are hierarchically ordered as mentioned previously, with reference to the fact that they involve the control of a measurement transmitted by the detection means or the control of the software data resulting in a command instruction or data destined for the higher-level management module. Here, the first three parameters Pli to P13 relate solely to measurements transmitted by the detection means and are therefore controlled before the last two parameters P14 and P15, which relate both to measurements transmitted by the detection means and to the content of the data and / or command instruction generated by the management module 4a corresponding to the first characteristic Cl relating to the vehicle's location.

[0079] The first parameter PI 1 controlled by the safety module 5a during the comparison step 15 is a number of satellites Ns detected by the autonomous vehicle and the The associated heuristic rule "Ns < Vsl" triggers an emergency stop of the vehicle if the number of satellites Ns is less than a minimum threshold value Vsl.

[0080] The second parameter P12 controlled by the safety module 5a during the comparison step 15 is the satellite reception quality Q and the associated heuristic rule “Q < Vs2” results in an emergency stop of the vehicle if the satellite reception quality is less than a minimum threshold value Vs2.

[0081] The third parameter P13, controlled by the safety module 5a during the comparison step 15, is the flidar operating frequency of the detection means, for example, of the LIDAR type (Light Detection And Ranging), of the autonomous vehicle. The associated heuristic rule "flidar < Vs3" triggers an emergency stop of the vehicle if this frequency is lower than a minimum threshold value Vs3.

[0082]

[0083] The fourth and fifth parameters P14, P15 controlled by the safety module 5a during the comparison step are respectively an orientation deviation El and a position deviation E2 of the autonomous vehicle relative to the satellite detection. The associated heuristic rules "I0LOC - 0GNSS l> Vs4" and "^xLOC-xGNSS)2 + (yLOC-yGNSS)2 > Vs5 * emergency of the vehicle if the orientation and / or position of the autonomous vehicle is greater than a threshold value Vs4, Vs5 maximum. Figure 4 illustrates in particular the parameterization of a 5b safety module associated with a 4b management module dedicated to a second characteristic C2 relating to vehicle control.

[0084] This second characteristic C2 is controlled here through three parameters P21, P22, and P23, it being understood that the number of parameters and their descriptions are given here as examples. These three parameters all relate to the content of the data generated by the management module 4b corresponding to the second characteristic C2 concerning vehicle control, so that their hierarchy is based on the impact that an anomaly may have on the user of the autonomous vehicle.

[0085] The first and second parameters P21, controlled by the safety module 5b during the comparison step 15, are related to a deviation in the autonomous vehicle's speed from a reference speed and from a speed limit imposed on the road. The associated heuristic rules "VLoc - Vnav > Vs6" and "VLoc - Vlim > Vs7" trigger an emergency stop of the vehicle if the difference between the vehicle's speed and the considered speed exceeds a threshold value Vs6, with a maximum of Vs7.

[0086]

[0087]

[0088]

[0089]

[0090] The third parameter P23, controlled by the safety module 5b during the comparison step 15, is linked to a difference between the position of the autonomous vehicle at a given time and a reference trajectory. The associated heuristic rule "J(xLOC-xNAVf + (yLOC-yNAVf > Vs8)" leads to a deflection of the vehicle if this difference is greater than a maximum threshold value Vs. If, during management process 10, after verification of all parameters, no anomaly is detected, management process 10 is implemented again with new measures by detection means 7. Management process 10 thus ensures constant verification of the proper functioning of the autonomous vehicle over time. If an anomaly is detected and the emergency stop step 16 is implemented, the autonomous vehicle cannot restart until the heuristic rule that caused the emergency stop of the autonomous vehicle has been resolved, i.e. until the threshold value Vs is exceeded. Thus, the autonomous vehicle is more secure, able to respond more specifically depending on the nature of an anomaly occurring in said autonomous vehicle, and is simplified in its structure to ensure an easier addition or removal of functions. Of course, the invention is not limited to the examples just described and many modifications can be made to these examples without departing from the scope of the invention.

[0091] The invention, as described above, achieves its intended purpose and provides a management system capable of specifically monitoring a plurality of characteristics related to an autonomous vehicle. Variants not described here could be implemented without departing from the scope of the invention, provided that, in accordance with the invention, they include a management system conforming to the invention.

Claims

Demands

1. Management system (1) for autonomous vehicle, comprising: - at least one central unit (2) comprising a plurality of management modules (4) of a characteristic related to the autonomous vehicle, each management module (4) being capable of processing measurements from detection means (7), and / or of processing data from at least one other management module, to generate a control instruction for actuators (8) and / or to generate data for at least one other management module (4), - at least one safety unit (3) comprising a plurality of safety modules (5), each being specifically linked to one of the management modules (4) of the central unit (2) and being configured to detect an anomaly of the corresponding management module (4), as well as an emergency stop module (6) ensuring the emergency stop of the vehicle in the event of an anomaly detected.

2. Management system (1) according to claim 1, wherein each safety module (5) is configured to receive the measurements and / or data received by the corresponding management module (4).

3. Management system (1) according to claim 1 or 2, wherein each safety module (5) is configured to receive control instructions and / or data generated by the corresponding management module (4).

4. Management system (1) according to any one of the preceding claims, wherein the emergency stop module (6) is configured to communicate with each of the safety modules (5).

5. Method of managing (10) an autonomous vehicle, implemented by a management system (1) according to any one of the preceding claims, comprising: - a measurement step (11) of at least one parameter by the detection means (7) and / or a generation step of at least one data point by a management module of rank n-1 of the central unit (2), - a transmission step (12) of the measurements and / or data generated by said management module to a level n management module of the central unit (2) and to the safety module of the safety unit (3) which is associated with the level n management module, - a generation step (13), by the level n management module of the central unit (2), of control instructions to actuators and / or data to at least one level n management module from the measurement of at least one parameter and / or at least one transmitted data, - a transmission step (14) of the control instructions and / or data generated by the level n management module of the central unit (2) to the safety module of the safety unit (3) associated with the level n management module, - a comparison step (15), by the safety module of the safety unit,measurements and / or data transmitted to the nth rank management module and / or control instructions and / or data generated by the nth rank management module of the central processing unit, at a threshold value (Vs), - an emergency stop step (16) by the emergency stop module (6) depending on the result of the comparison step (15).

6. Management method (10) according to the preceding claim, wherein the measurement step (11) is carried out by at least one sensor and / or the instruction generation step (13) is carried out by at least one software data generator.

7. Management method (10) according to claim 5 or 6, wherein a prioritization of the measurements and / or control instructions and / or data received by a security module is implemented to respectively determine a priority order for the processing of the measurements and / or control instructions and / or data.

8. A management method (10) according to the preceding claim, wherein the processing of the measurements transmitted by the means 19. Detection takes priority over the processing of data and / or command instructions.

9. Management method (10) according to any one of claims 5 to 8, wherein the comparison step (15) is linked to at least one heuristic rule.

10. Management method (10) according to claim 9, wherein the emergency stop module (6) maintains the emergency stop until the heuristic rule is resolved.

Images