Functional safety in longitudinal control systems

Abstract

To determine a safe acceleration in a system performing longitudinal control of a vehicle as part of an ADS feature.SOLUTION: A method for performing an ADS feature, which enables a vehicle to provide driving automation. The method comprises controlling an acceleration of the vehicle using a control system on the basis of automotive sensor data and a planned acceleration. The control system comprises: a first set of control components having a first automotive safety integrity level (ASIL); and a second set of control components having a second ASIL. Therein: the first ASIL is lower than the second ASIL; an acceleration deviation caused by the first set of control components is detected on the basis of the automotive sensor data; and when the acceleration deviation is detected, a safe acceleration state is determined using the second set of control components.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates generally to ensuring functional safety when controlling a vehicle, and more precisely to ensuring functional safety when performing longitudinal control of a vehicle as part of an automated driving system (ADS). [Background technology]

[0002] ADS functions in modern vehicles must control the vehicle's motion in a manner that ensures functional safety within the meaning of ISO standard 26262:2018. To this end, each ADS function must conform to the Automotive Safety Level (ASIL) required for the ADS function's functionality. Each ADS function is implemented by a system including a set of components, and the set must accordingly conform to the required ASIL. However, some individual components of the system may not conform to the required ASIL, while others may only conform to a lower ASIL. Therefore, a system implementing a given ADS function must guarantee the required ASIL even if some components do not conform to the required ASIL. To achieve this, the system must identify and mitigate erroneous control decisions of components with a lower ASIL. In the context of a system implementing longitudinal control as part of an ADS function, if an erroneous control decision of a component with a lower ASIL is identified, such a mitigation decision must identify an appropriate acceleration of the vehicle. However, if an erroneous control decision is identified, such a mitigation decision must identify a safe acceleration of the vehicle. Summary of the Invention [Problem to be solved by the invention]

[0003] Therefore, an object of the present disclosure is to identify safe accelerations in systems that perform longitudinal control of a vehicle as part of their ADS functionality upon identification of erroneous control decisions of components that do not comply with the required ASIL level. [Means for solving the problem]

[0004] To achieve this object, the present disclosure provides a method for performing ADS functions, the method enabling at least conditional driving automation in a vehicle, and including controlling acceleration of the vehicle using a control system based on data obtained by one or more vehicle sensors of the vehicle and a planned acceleration. The control system includes a first set of control components having a first ASIL and a second set of control components having a second ASIL, the first ASIL being lower than the second ASIL. The method further includes detecting an acceleration deviation caused by the first set of control components based on the vehicle sensor data. Finally, the method includes identifying a safe acceleration state using the second set of control components upon detecting the acceleration deviation, the safe acceleration state being selected from a set of safe acceleration states based on the vehicle sensor data, the set including at least maximum deceleration, reduced deceleration, and reduced acceleration.

[0005] The present disclosure further provides a vehicle control unit including at least one processing unit and a memory coupled to the at least one processing unit and configured to store machine-readable instructions. The machine-readable instructions cause the at least one processing unit to implement a control system configured to control acceleration of a vehicle including a first set of control components having a first ASIL and a second set of control components having a second ASIL, the first ASIL being lower than the second ASIL. The machine-readable instructions cause the at least one processing unit to control acceleration of the vehicle using the control system based on vehicle sensor data obtained by one or more vehicle sensors of the vehicle and a planned acceleration, detect an acceleration deviation caused by the first set of control components based on the vehicle sensor data, and identify a safe acceleration state using the second set of control components if an acceleration deviation is detected, the safe acceleration state being selected from a set of safe acceleration states based on the vehicle sensor data, the set including at least maximum deceleration, reduced deceleration, and reduced acceleration.

[0006] The present disclosure further provides a vehicle including a plurality of sensors and a vehicle control unit.

[0007] Examples of the present disclosure will be described with reference to the accompanying drawings, in which like reference numerals refer to like elements and in which: [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a flowchart of a method for performing ADS functions according to an example of the present disclosure. [Figure 2] FIG. 1 is a block diagram of a control system configured to control the acceleration of a vehicle according to an example of the present disclosure. [Figure 3] FIG. 1 illustrates a vehicle including multiple automotive sensors according to an example of the present disclosure. [Figure 4] FIG. 1 illustrates a vehicle control unit according to an example of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0009] It should be understood that the above drawings are not intended to limit the present disclosure. Rather, each drawing is provided to aid in understanding the present disclosure. Those skilled in the art will understand that aspects of the invention shown in one drawing may be combined with aspects in other drawings or omitted without departing from the scope of the present disclosure.

[0010] The present disclosure generally provides an automotive control unit, a vehicle, and a method configured to perform ADS functions that enable the provision of at least conditional driving automation. More precisely, the present disclosure provides a method for controlling a planned acceleration a planned , i.e., receiving accelerations specified by one or more driving automation system (DAS) functions of the vehicle and a planned acceleration a planned is the torque applied by the brake and / or engine, i.e., the braking torque M brake and engine torque M engine ADS functionality is possible using a control system such as the example control system 200 shown in Figure 2, which converts the moment to torque. It is understood that the term moment may be used interchangeably with the term torque throughout this disclosure.

[0011] In the context of this disclosure, DAS functions refer to functions that perform aspects of vehicle driving automation regardless of the level of driving automation according to the driving automation classification defined in SAE International Standard J3016. Conversely, DAS functions in the context of this disclosure refer to functions that perform aspects of vehicle driving automation corresponding to at least Level 3 according to the driving automation classification defined in SAE International Standard J3016.

[0012] Control system 200 includes control components, as illustrated by the various elements shown in Figure 2, which in the example of Figure 2 have two different ASILs. The fact that the control components of control system 100 have different ASILs is illustrated by the patterned control component 121, which has a lower ASIL than the other control components of control system 100. The higher ASIL of the control components of control system 100 corresponds to the ASIL that control system 100 must comply with.

[0013] The control system 200 receives the odometry signal S odometry , which may include vehicle odometry data, e.g., an odometry signal S , which may indicate the current acceleration, acceleration deviation, speed, and / or position deviation of the vehicle 300. odometry Based on this, the control system 200 calculates the acceleration deviation, i.e., the planned acceleration a of the vehicle. planned and the current acceleration. If the control system 200 determines that the acceleration deviation exceeds, for example, the specifications or standard control capabilities of the control system 100, the control system switches to identifying safe acceleration conditions in order to maintain compliance with the required ASIL of the control system 200 and thereby ensure the functional safety of the control loop 100.

[0014] The general concept will now be described with reference to the accompanying drawings, in which Figure 1 provides a flow chart of a method for performing ADS functions and Figure 2 provides a block diagram of a control system 200. Figure 3 illustrates a vehicle including a number of vehicle sensors and a vehicle control unit. Finally, Figure 4 illustrates an example vehicle control unit in more detail.

[0015] It is understood that dashed boxes in FIG. 1 indicate optional steps in the method 100.

[0016] The method 100 is configured to perform ADS functions that enable a vehicle, such as the vehicle 300 of FIG. 3, to provide at least conditional driving automation.

[0017] Briefly referring to FIG. 3 , vehicle 300, and more generally, vehicle, in the context of this disclosure, refers to any type of motorized vehicle configured to transport people and / or cargo. The motor of vehicle 300 may be any type of motor, such as an electric motor or an internal combustion engine. Vehicle 300 may be, for example, a passenger car, as shown in FIG. 2 . However, it is understood that vehicle 300 may also be a bus, truck, or any other type of vehicle that includes one or more sensors 310 and a vehicle control unit 300 that enables vehicle 300 to provide at least conditional driving automation. In other words, vehicle control unit 300 and one or more sensors 310 may be configured to enable vehicle 300 to provide vehicle control functions that enable at least conditional driving automation, i.e., Level 3 of the driving automation classification defined in SAE International Standard J3016. That is, the vehicle 300 can be configured to provide at least one ADS that performs the entire dynamic driving task (DDT) based on vehicle sensor data provided by one or more sensors 310 in a persistent and operational design domain (ODD)-specific manner under customary / normal operation where the user of the vehicle 300 acts as the corresponding user for the DDT fallback when requested to take over the DDT by the ADS or in the event of a DDT performance-related system failure in other vehicle systems.

[0018] ODD in the context of this disclosure refers to the operating conditions under which a particular DAS feature is specifically designed to operate, including, but not limited to, environmental, geographic, and time of day restrictions and / or the required presence or absence of certain traffic or road characteristics.

[0019] DDT in the context of this disclosure includes all real-time operational and tactical functions required to operate vehicle 300 in road traffic, excluding strategic functions such as trip scheduling and destination and waypoint selection. In the context of DDT, DDT fallback refers to a user corresponding to DDT fallback taking over the performance (operation) of DDT or ADS functions, or achieving a minimum risk condition (state), i.e., a stable stopping condition (state) of vehicle 300, after the occurrence of a system failure related to DDT performance or when ODD is terminated.

[0020] It is understood that the vehicle 300 can be configured to enable high driving automation, i.e., higher levels of driving automation, such as level 4 or higher of the driving automation classification defined in SAE International standard J3016.

[0021] Given the ODD specificity of the ADS functions performed by method 100, it is understood that vehicle 300 may perform DAS functions with higher or lower levels of automation outside of the ODD of the ADS functions performed by method 100.

[0022] One or more sensors 310 are configured to capture vehicle sensor data representative of the vehicle's 300 surroundings. The vehicle sensor data thus provides environmental awareness to one or more vehicle control modules, and thus to the vehicle 300, to enable at least driver assistance. For example, the vehicle sensor data captured by one or more sensors 310 can provide the vehicle 300 with information about the location and size of other vehicles, road markings, or traffic signs. To this end, one or more sensors 310 may be radar sensors configured to emit radio waves to determine the distance, angle, and speed of objects around the vehicle based on reflected radio waves. One or more sensors 310 may be light detection and ranging (LIDAR) sensors configured to emit laser beams to determine the distance, angle, and speed of objects around the vehicle based on reflected laser beams. One or more sensors 310 may be cameras that capture images of the vehicle's surroundings. One or more sensors 310 may be infrared cameras that capture images of the vehicle's surroundings based on infrared light. It is understood that a LIDAR sensor, a radar sensor, or a camera are provided merely as examples of sensor types for the one or more sensors 310. For example, the one or more sensors 310 may be ultrasonic sensors. The one or more sensors 310 may be Global Navigation Satellite System (GNSS) sensors configured to receive position data, such as satellite signals, for determining the location of the vehicle 200. More generally, the one or more sensors 310 may be any type of sensor capable of capturing vehicle sensor data representative of the surroundings of the vehicle 300. Furthermore, the one or more sensors 310 may also be any type of sensor capable of capturing odometry data, such as the speed and acceleration of the vehicle 300. Such capturing capabilities may be integrated into the above sensor types or may be provided by a dedicated motion sensor. It is further understood that the one or more sensors 310 may include multiple sensors of different types of sensors.Additionally, one or more sensors 310 of the same type may exhibit different characteristics by being configured to capture sensor data at different ranges, such as short, medium, and long range. For example, vehicle 300 may include three short-range radar sensors, one at the front and one at the rear of vehicle 300, a medium- to long-range radar sensor at the rear of vehicle 200, a LIDAR sensor at the front of vehicle 300, a rear-facing camera at the rear of vehicle 200, a front-facing camera at the front of the vehicle, a front-facing camera in the rearview mirror, and rear short- to medium-range radar sensors in the outer rearview mirrors mounted on the doors. It is understood that vehicle 300 may include more or fewer of the automotive sensors illustrated in FIG. 3 and mentioned in the examples above.

[0023] In step 110, the method 100 calculates the planned acceleration a planned and vehicle sensor data obtained by one or more of the vehicle sensors 310 described above, and control system 200 of Figure 2 is used to control the acceleration of vehicle 300. In other words, method 100 controls the longitudinal movement of vehicle 300 as part of an ADS function, while the lateral movement of the ADS function is controlled by other systems of vehicle 300. For example, method 100 may control the acceleration (degrees) of vehicle 300 as part of the execution of a motorway cruise function, i.e., a function that provides Level 3 driving automation on motorways up to a specified driving speed, such as 60 km / h, 90 km / h, or 120 km / h.

[0024] Planned acceleration a planned can indicate the acceleration to be performed by the vehicle 300 during the planning period. That is, the planned acceleration a plannedcan be determined by an acceleration determination module connected to the control system 200 for each clock cycle of a system clock, such as the clock of one of the processing units described below with reference to Figure 4. The acceleration determination module determines the planned acceleration a based on a model of the operating environment of the vehicle 300 derived from vehicle sensor data. planned , i.e., any kind of DAS function configured to specify the acceleration that the vehicle 300 should perform based on the driving environment. The acceleration specification module may specify the planned acceleration a for the planning period, i.e., the planned acceleration a planned The acceleration specification module determines the period during which the acceleration a can be determined to be constant based on the driving environment. planned For a predetermined period, the planned acceleration a planned For example, the planning period can be in the range of 1 to 10 seconds. planned can be specified for the planning period, but may nevertheless be re-specified for each clock cycle. That is, the acceleration specification module can specify, for each clock cycle, which may be in the millisecond or nanosecond range, what the acceleration of the vehicle 300 should be for, for example, the next 2 seconds or 5 seconds. In other words, the planned acceleration a planned may correspond to the acceleration that the vehicle 300 should exert for a period into the future that is updated at a time interval shorter than the period during which the vehicle 300 exerts that acceleration.

[0025] Planned acceleration a to indicate the planned acceleration to be performed by the vehicle planned It will be appreciated that the planned acceleration a may include a number of planned vehicle parameters, which may include the planned velocity, the planned position at the planned time, and any other parameters that may be planned for the longitudinal movement control performed by the method 100. To this end, the planned acceleration a planned is a trajectory vector v that can contain any number of planned vehicle parameters. trajectory It can be considered as such.

[0026] Control system 200 includes a first set of control components having a first ASIL and a second set of control components having a second ASIL. The first ASIL is lower than the second ASIL. In the context of this disclosure, a component may refer to one or more hardware portions and / or software units that perform logically separate functions within the performance of an ADS function. In the context of this disclosure, ASIL refers to the requirements that a given component must meet and the safety measures that a given component must implement to avoid adverse risks, i.e., to provide functional safety as required within the meaning of standard ISO 26262:2018. Accordingly, components of control system 200 may have quality management (QM) levels ranging from level QM, representing the lowest ASIL, to level D, representing the highest ASIL. Therefore, it is understood that QM is considered an ASIL in the context of this disclosure. Control system 200 is described below with reference to FIG. 2.

[0027] 2 illustrates an exemplary control system 200 including acceleration control 210 and torque control 220, which constitute control components of control system 200 and thus represent logically separate functions as described above. It is understood that any control component of control system 200 described below can be implemented by one or more hardware portions and / or software units and may further include sub-portions and / or sub-units. It is further understood that any control component of control system 200 can perform additional functionality supplemental to the functionality of those elements described below.

[0028] The acceleration control unit 210 calculates the planned acceleration a planned In the example of Figure 2, at least the odometry data S odometry The acceleration control unit 210 can be configured to receive vehicle sensor data including the instantaneous acceleration of the vehicle 300 as odometry data S odometry The vehicle sensor data and the planned acceleration a plannedBased on the instantaneous acceleration obtained from target , i.e., the instantaneous acceleration that the vehicle 300 should exert at a given time point. target is the planned acceleration a considering the instantaneous acceleration of the vehicle 300 planned Therefore, in summary, the acceleration control unit 210 determines the instantaneous acceleration that the vehicle 300 should exert in order to achieve the target acceleration a target To determine the planned acceleration a planned and vehicle sensor data.

[0029] To implement this functionality, the acceleration control unit 210 may include a target acceleration specification unit 211 and an acceleration deviation specification unit 212. The acceleration deviation specification unit 212 may specify a planned acceleration a planned The system may be configured to determine the deviation of the instantaneous acceleration of the vehicle 300 from the planned acceleration a, i.e., the difference between the two accelerations. The deviation determination may be performed by determining the deviation from the planned acceleration a as described above. planned If the odometry data S further includes planned vehicle parameters, it is possible to further take into account the deviation between the other planned vehicle parameters and the corresponding obtained instantaneous vehicle parameters. odometry is received from the vehicle sensor 310 and the planned acceleration a planned The acceleration deviation determiner 212 may be further configured to provide the determined deviation to the target acceleration determiner 211, which may determine the instantaneous acceleration of the vehicle and the planned acceleration a planned to a value close to zero. target can be configured to identify

[0030] The torque control unit 220 calculates the target acceleration a target and the target acceleration a target Brake torque Mbrake and engine torque M engine Therefore, the torque control 220 can be configured to convert the planned acceleration a planned To achieve this, the torque control unit 220 may be configured to identify control parameters of the vehicle 300 that affect the acceleration of the vehicle 300. To implement this functionality, the torque control unit 220 may include an acceleration-torque converter 221, which converts at least the odometry data S odometry and target acceleration a target The brake torque M calculated based on brack_calc and the calculated engine torque M engine_calc The calculated brake torque M brake_calc and the calculated engine torque M engine_calc As will be explained later, the torque M brake and engine torque M engine can be output from the control system 200 as

[0031] Acceleration-to-torque converter 221 may have a lower ASIL than the other control components of control system 200. For example, acceleration-to-torque converter 221 may comply with ASIL QM, while the other control components of control system 200 may comply with ASIL B. This fact is illustrated by the patterning of acceleration-to-torque converter 221. Thus, acceleration-to-torque converter 221 may correspond to a first set of control components having a first ASIL, while the other control components of control system 200 of FIG. 2 may correspond to a second set of control components having a second ASIL, which may be, for example, ASIL B. Thus, in this example, control system 200 may comply with ASIL B. It is understood that the number of components in the first and second sets shown in FIG. 2 are provided by way of example only, and that the first and second sets of control components may include any number of control components as required by the actual implementation of control system 200.

[0032] Based on the above description of the control system 200, step 110 determines whether the method 100 calculates at least the planned acceleration a planned and at least odometry data S odometry and for each clock cycle of the system clock of the vehicle 300 based on vehicle sensor data that may include a target acceleration a target The step can include step 111 in which the method 100 can identify the target acceleration a. The step can be performed by the acceleration control unit 210, the target acceleration identification unit 212, and the acceleration deviation identification unit 213. Furthermore, step 110 can be performed by the method 100 in which the method 100 can identify the target acceleration a. target Brake torque M brake and engine torque M engine Step 121 can be performed by the torque control unit 220 and the acceleration-torque conversion unit 221.

[0033] In step 120, the method 100 adjusts the acceleration control to the target acceleration a to the value indicated by the override signal. target Sets the override signal S override Therefore, it is possible to receive the override signal S override This allows other DAS functions, such as the acceleration determination module described above, to determine the target acceleration a target Therefore, it is possible to set the instantaneous acceleration that the vehicle 300 should exert, regardless of the control decisions made by the acceleration control unit 210, the target acceleration specifying unit 211 and the acceleration deviation specifying unit 212.

[0034] In step 130, the method 100 detects an acceleration deviation caused by the first set of control components based on the vehicle sensor data. In the context of the example control system 200 of FIG. 2, the acceleration control unit 210 and the acceleration deviation determination unit 212 use the vehicle sensor data, i.e., at least the odometry data S odometry The instantaneous acceleration of the vehicle 300 obtained from the planned acceleration a plannedIt is possible to detect a deviation from the braking torque M by a larger amount than the deviation threshold value. brake and engine torque M engine can be identified by the acceleration-torque converter 221, i.e., the first set of control components having the first, and therefore lower, ASIL, so the deviation is assumed to be caused by the acceleration-torque converter 221. In other words, the method 100 determines in step 130 whether the control parameters of the vehicle 300 identified by the control system 200 in step 110 are greater than the planned acceleration a due to a control problem or error condition of, for example, the set of components having the first ASIL. planned Detects that the target is not achieved.

[0035] Planned acceleration a planned / orbit vector v trajectory It will be appreciated that if includes additional planned vehicle parameters as discussed above, then detecting an acceleration deviation in step 130 may include detecting deviations in the additional vehicle parameters.

[0036] In step 140, method 100 identifies a safe acceleration condition using a second set of control components when an acceleration deviation is detected in step 130. The safe acceleration condition is selected from a set of safe acceleration conditions based on vehicle sensor data and includes at least maximum deceleration, reduced deceleration, and reduced acceleration. In other words, the vehicle control parameter identified by control system 200 based on normal operation as described above with respect to step 110 is the brake torque M brake and engine torque M engine leads to an acceleration deviation, the second set of components having the second ASIL adjusts the vehicle control parameter brake torque M brake and engine torque M engine , and specifies a safe acceleration to ensure functional safety of the longitudinal control of the ADS function performed by the control system 200 and thus the method 100.

[0037] The reduced deceleration and reduced acceleration are reduced relative to the deceleration or acceleration specified by the control system 200 under normal operation, i.e., the second set of components having a second ASIL are reduced relative to the vehicle control parameter brake torque M brake and engine torque M engine When the brake torque M brake and engine torque M engine The normal identification of the planned acceleration a can continue and can be taken into account to identify a safe acceleration state, but cannot be output to the brakes and engine. planned In other words, the reduced deceleration and the reduced acceleration are determined based on the planned acceleration a planned It is possible to determine when a safe acceleration state is selected by a reduced deceleration or reduced acceleration determined by normal operation of control system 200, which may take into account the magnitude of the acceleration deviation. Additionally, the reduced deceleration and reduced acceleration can be determined based on one or more preset offsets, which may be absolute or relative to the acceleration determined in step 110, and which may depend on the magnitude of the acceleration deviation.

[0038] The maximum deceleration rate serves as a fallback safe acceleration state to achieve a minimum risk state if any other acceleration state is determined to be insufficient to ensure the functional safety of the control system 200 during the identification of a safe acceleration state in step 140.

[0039] To perform steps 140 and 141, the control system 200, and more precisely the torque control unit 220 of FIG. 2, may further comprise a brake torque multiplexer 222, a safe torque identification unit 223 and an engine torque multiplexer 224.

[0040] The safe torque identifier 223 determines the safe braking torque M by selecting one of the safe acceleration states from the set of safe acceleration states and by specifying the corresponding vehicle control parameter. brake_safe and safe engine torque M engine_safe For this purpose, the safe torque determiner 223 can be configured to determine a safe acceleration state by determining the brake torque M calculated from the acceleration-torque converter 221 as indicated by the two-way connection between the two control components. brake_calc and the calculated engine torque M engine_calc and configured to receive a safety acceleration request signal S req_safe_acc The acceleration request signal S can be further configured to receive a safe acceleration request signal S. req_safe_acc can be generated by the acceleration control unit 210 and the acceleration deviation specifying unit 212 in step 130 when an acceleration deviation is detected. Similarly, the acceleration control unit 210 and the acceleration deviation specifying unit 212 generate the safe acceleration selection signal S req_safe_acc The safe acceleration selection signal S req_safe_acc transmits the calculated brake torque M to the brake torque multiplexer 222 and the engine torque multiplexer 224 depending on whether an acceleration deviation is detected in step 130. brake_calc and the calculated engine torque M engine_calc or safety brake torque M brake_safe and safe engine torque M engine_safe Brake torque M brake and engine torque M engine In other words, the safe acceleration selection signal S req_safe_acc can serve as a selection signal for the brake torque multiplexer 222 and the engine torque multiplexer 224, and can select the safe brake torque M based on the detection of the acceleration deviation in step 130. brake_safe and safe engine torque M engine_safe can be selected as the output.

[0041] The safe torque identification unit 223 can select and identify a safe acceleration state in accordance with the above description based on any type of control scheme suitable for selecting and identifying a safe acceleration state in a manner that complies with the ASIL of the control system 200 and ensures the functional safety of the control system 200.

[0042] In step 150, method 100, as part of steps 130 and 140, may cause vehicle 300 to perform a DDT fallback if method 100 identifies an acceleration deviation as causing a performance impairment of control system 200. If the ADS functionality performed by method 100 provides Level 3 driving automation, step 150 may include step 151, in which method 100 may issue a request for user intervention corresponding to a fallback of vehicle 300. At higher levels of automation, DDT fallback may include entering a "limp back home" mode, which may allow vehicle 300 to continue slowly en route to its destination or slowly drive to a maintenance facility.

[0043] Finally, method 100 can include step 160, in which method 100 can achieve a minimal risk condition for vehicle 300. Method 100 can make this determination, for example, if maximum deceleration is selected in step 140, or if a fault in the performance of control system 200 prevents vehicle 300 from continuing to operate.

[0044] In summary, the method 200 performs longitudinal control as part of the ADS function on control components of different ASILs, and ensures functional safety of the vehicle 300 by detecting acceleration deviations and identifying corresponding safe acceleration states in the event of a failure of a lower ASIL component.

[0045] 4 illustrates a vehicle control unit 400 configured to perform method 100. Vehicle control unit 400 may include a processor 410, a graphics processing unit (GPU) 420, a vehicle processing system 430, memory 440, removable storage 450, storage 460, a cellular interface 470, a global navigation satellite system (GNSS) interface 480, and a communication interface 490.

[0046] Processor 410 may be any type of single-core or multi-core processing unit employing a reduced instruction set (RISC) or complex instruction set (CISC). Exemplary RISC processing units include an ARM-based core or a RISC-V-based core. Exemplary CISC processing units include an x86-based core or an x86-64-based core. Processor 410 is capable of executing instructions that cause vehicle control unit 400 to perform method 200. Processor 410 may be directly connected to any component of vehicle control unit 400, or may be directly connected to memory 430, GPU 420, or a device bus.

[0047] GPU 420 may be any type of processing unit optimized for processing graphics-related instructions, or more generally, for parallel processing of instructions. As such, GPU 420 may be configured to generate a display of information, such as ADAS information or telemetry data, to a driver, for example, via a head-up display (HUD) or a display located within the driver's field of view. GPU 420 may be connected to the HUD and / or display via connection 420C. GPU 420 may further execute at least a portion of method 100 to enable rapid parallel processing of instructions related to method 100. It should be noted that in some embodiments, processor 410 may specify that GPU 420 does not need to execute instructions related to method 200. GPU 420 may be directly connected to any component of vehicle control unit 400, or may be directly connected to processor 410 and memory 430. In some embodiments, GPU 420 may also be connected to a device bus.

[0048] Vehicle processing system 430 may be any type of system-on-chip configured to provide trillions of operations per second (TOPS) to enable vehicle control unit 400 to implement one or more ADAS while driving. Vehicle processing system 430 may interface only with processor 410 or may interface with other devices via a system bus. Vehicle processing system 430 may, for example, execute instructions for one or more vehicle sensor data processing modules and one or more vehicle control modules.

[0049] Memory 440 may be any type of high-speed storage that allows processor 410, GPU 420, and vehicle processing system 430 to store instructions for fast retrieval while the instructions are being processed, as well as to cache and buffer data. Memory 440 may be a unified memory connected to processor 410, GPU 420, and vehicle processing system 430 to allow allocation of memory 440 to processor 410, GPU 420, and vehicle processing system 430 as needed. Alternatively, processor 410, GPU 420, and vehicle processing system 430 may be connected to separate processor memory 440a, GPU memory 440b, and vehicle processing system memory 440c.

[0050] Removable storage 450 may be a storage device that can be removably connected to vehicle control unit 400. Examples include a digital versatile disc (DVD), a compact disc (CD), a universal serial bus (USB) storage device such as an external SSD, or magnetic tape. It should be noted that removable storage 450 may or may not store data such as instructions for method 200, vehicle sensor data, and / or vehicle control data.

[0051] Storage 460 may be a storage device capable of storing program instructions and other data. For example, storage 460 may be a hard disk drive (HDD), a solid state drive (SSD), or some other type of non-volatile memory. Storage 460 may store, for example, instructions for method 100, vehicle sensor data, intermediate data, and / or vehicle control data.

[0052] Removable storage 450 and storage 460 may be connected to processor 410 via a system bus, which may be any type of bus system that allows processor 410 and optional GPU 420, as well as vehicle processing system 430, to communicate with other devices in vehicle control unit 400. Bus 440 may be, for example, a Peripheral Component Interconnect Express (PCIe) bus or a Serial ATA (SATA) bus.

[0053] Cellular interface 470 may be any type of interface that allows vehicle control unit 400 to communicate over a cellular network, such as a 4G network or a 5G network.

[0054] GNSS interface 480 may be any type of interface that allows vehicle control unit 300 to receive location data provided by a satellite network such as the Global Positioning System (GPS), the Global Navigation Satellite System (GLONASS), or Galileo. Location data, in the context of this disclosure, may be one of the types of vehicle sensor data.

[0055] The communication interface 490 may enable the vehicle control unit 400 to interface with external devices directly or via a network. The communication interface 480 may, for example, enable the vehicle control unit 300 to connect to a wired or wireless network, such as Ethernet, Wi-Fi, a Controller Area Network (CAN) bus, or any bus system suitable in a vehicle. For example, the vehicle control unit 400 may be connected to one or more vehicle sensors 310 to receive vehicle sensor data.

[0056] The vehicle control unit 400 can be integrated into the vehicle 300 , for example, below the passenger compartment, under the dashboard or in the trunk of the vehicle 300 .

[0057] The present invention can be further illustrated by the following examples.

[0058] In one example, a method for implementing ADS functions that enable a vehicle to provide at least conditional driving automation includes controlling acceleration of the vehicle using a control system based on data obtained by one or more vehicle sensors of the vehicle and a planned acceleration. The control system includes a first set of control components having a first ASIL and a second set of control components having a second ASIL, the first ASIL being lower than the second ASIL. The method further includes detecting an acceleration deviation caused by the first set of control components based on the vehicle sensor data. Finally, the method includes identifying a safe acceleration state using the second set of control components upon detecting the acceleration deviation, the safe acceleration state being selected from a set of safe acceleration states based on the vehicle sensor data, the set including at least maximum deceleration, reduced deceleration, and reduced acceleration.

[0059] In this exemplary method, the planned acceleration represents the acceleration to be performed by the vehicle during a planning period, and the planned acceleration can be determined for each clock cycle of the system clock by an acceleration determination module connected to the control system.

[0060] The example method may further include causing the vehicle to perform a DDT fallback.

[0061] In the example method, causing the vehicle to perform a DDT fallback may include issuing a request for user intervention corresponding to the vehicle fallback.

[0062] The example method may further include causing the vehicle to achieve a minimum risk condition.

[0063] In this exemplary method, controlling acceleration may include determining a target acceleration based on at least a planned acceleration and vehicle sensor data for each clock cycle of a vehicle system clock, and converting the target acceleration into braking torque and engine torque.

[0064] The example method can further include receiving an override signal, the override signal causing the acceleration control to set a target acceleration of the control system to a value indicated by the override signal.

[0065] In this example method, identifying the safe acceleration condition may include identifying one of a reduced deceleration and a reduced acceleration of a set of safe acceleration conditions based on the planned acceleration.

[0066] In one example, a vehicle control unit includes at least one processing unit and a memory coupled to the at least one processing unit and configured to store machine-readable instructions. The machine-readable instructions cause the at least one processing unit to implement a control system configured to control acceleration of a vehicle including a first set of control components having a first ASIL and a second set of control components having a second ASIL, the first ASIL being lower than the second ASIL. The machine-readable instructions cause the at least one processing unit to control acceleration of the vehicle using the control system based on vehicle sensor data obtained by one or more vehicle sensors of the vehicle and a planned acceleration, detect an acceleration deviation caused by the first set of control components based on the vehicle sensor data, and identify a safe acceleration state using the second set of control components if an acceleration deviation is detected, the safe acceleration state being selected from a set of safe acceleration states based on the vehicle sensor data, the set including at least maximum deceleration, reduced deceleration, and reduced acceleration.

[0067] In the exemplary automobile control unit, the machine-readable instructions may further cause at least one processing unit to perform any one of the exemplary methods described above.

[0068] In one example, a vehicle includes a plurality of vehicle sensors and the exemplary vehicle control unit described above.

[0069] The above description has been provided to illustrate the provision of functional safety in a longitudinal control system. It is understood that this specification is not intended to limit the scope of the present disclosure to the specific examples set forth throughout this specification. Rather, those skilled in the art will recognize that examples of the present disclosure can be combined, modified, and abstracted without departing from the scope of the present disclosure, as defined by the following claims. [Explanation of symbols]

[0070] 100 ways 110~160 method steps 200 Control System 210 Acceleration control section 211 Target acceleration identification section 212 Acceleration deviation identification section 220 Torque control section 221 Acceleration-torque conversion unit 222 Brake Torque Multiplexer 223 Safe Torque Identification Section 224 Engine Torque Multiplexer 300 vehicles 310 Automotive Sensors 400 Automotive Control Unit 410 CPU 420 GPU 420c connection 430 Automotive Processing System 440 memory 450 Removable Storage 460 Storage 470 Cellular Interface 480 GNSS interface 490 Communication Interface

Claims

1. 1. A method for performing an automated driving system (ADS) function, the ADS function enabling a vehicle to provide at least conditional driving automation, the method comprising: controlling acceleration of the vehicle using a control system based on vehicle sensor data obtained by one or more vehicle sensors of the vehicle and a planned acceleration, the control system including a first set of control components having a first Automotive Safety Level (ASIL) and a second set of control components having a second ASIL, the first ASIL being lower than the second ASIL; detecting an acceleration deviation caused by the first set of control components based on the vehicle sensor data; and identifying a safe acceleration condition using the second set of control components when an acceleration deviation is detected; The safe acceleration state is selected from a set of safe acceleration states based on the vehicle sensor data, the set including at least maximum deceleration, reduced deceleration, and reduced acceleration. The method.

2. 2. The method of claim 1, wherein the planned acceleration represents an acceleration to be performed by the vehicle during a planning period, and the planned acceleration is determined for each clock cycle of a system clock by an acceleration determination module connected to a control system.

3. 3. The method of claim 1 or 2, further comprising causing the vehicle to perform a dynamic driving task (DDT) fallback.

4. 4. The method of claim 3, wherein causing the vehicle to perform a DDT fallback includes issuing a request to intervene to a user of the vehicle corresponding to the fallback.

5. 5. The method of claim 1, further comprising causing the vehicle to achieve a minimum risk condition.

6. Acceleration control is determining a target acceleration based on at least the planned acceleration and the vehicle sensor data for each clock cycle of the vehicle's system clock; and Converting the target acceleration into a brake torque and an engine torque. The method according to any one of claims 1 to 5, comprising:

7. 7. The method of claim 1, further comprising receiving an override signal, the override signal causing the control system to control acceleration by setting a target acceleration to a value represented by the override signal.

8. 8. The method of claim 1, wherein identifying the safe acceleration state comprises identifying one of a reduced deceleration and a reduced acceleration of the set of safe acceleration states based on the planned acceleration.

9. at least one processing unit (410, 420, 430); a memory (440, 450) coupled to the at least one processing unit (410, 420, 430) and configured to store machine-readable instructions; It contains The machine-readable instructions cause the at least one processing unit (410, 420, 430) to implement a control system configured to control acceleration of a vehicle including a first set of control components having a first Automotive Safety Level (ASIL) and a second set of control components having a second ASIL, the first ASIL being less than the second ASIL; The machine-readable instructions further cause the at least one processing unit (410, 420, 430) to: controlling acceleration of the vehicle using the control system based on vehicle sensor data obtained by one or more vehicle sensors of the vehicle and the planned acceleration; Detecting an acceleration deviation caused by the first set of control components based on the vehicle sensor data; If an acceleration deviation is detected, the second set of control components are used to identify a safe acceleration condition, the safe acceleration condition being selected from a set of safe acceleration conditions based on the vehicle sensor data, the set including at least maximum deceleration, reduced deceleration, and reduced acceleration. A vehicle control unit (400).

10. 10. The vehicle control unit (400) of claim 9, wherein the machine readable instructions further cause the at least one processing unit (410, 420, 430) to perform the method of any one of claims 2 to 8.

11. A vehicle (300) comprising a plurality of vehicle sensors and a vehicle control unit (410, 420, 430) according to claim 9 or 10.

Images