A vehicle for performing a minimal risk maneuver and a method for operating the said vehicle.

Abstract

A vehicle supporting minimal-risk maneuvers will be revealed. [Solution] The vehicle performs a driving maneuver, and if a specific event occurs during driving, it performs a minimal risk maneuver. The commencement of the minimal risk maneuver eliminates the danger to the vehicle. Once the danger to the vehicle is eliminated, the minimal risk maneuver is terminated, and the vehicle can resume driving after the minimal risk maneuver has been terminated.

Description

Technical Field

[0001] The present disclosure relates to a vehicle for performing a minimal risk maneuver and a method of operating the vehicle.

Background Art

[0002] Recently, advanced driver assistance systems (ADAS) have been developed to assist drivers in driving. ADAS has multiple sub-technical classifications and provides convenience to drivers. Such ADAS is sometimes called autonomous driving and is also sometimes called an automated driving system (ADS).

[0003] On the other hand, when a vehicle performs autonomous driving, accidents or events that could not be predicted may occur. If appropriate measures are not taken for these events, the vehicle may be placed in a dangerous state.

Summary of the Invention

Problems to be Solved by the Invention

[0004] According to the present disclosure, when the vehicle faces danger due to an event occurring during the running of the vehicle, a minimal risk maneuver (MRM) for removing (or reducing) such danger can be performed.

Means for Solving the Problems

[0005] The vehicle according to the present disclosure performs autonomous driving without driver intervention. When a specific event occurs during autonomous driving, a minimal risk maneuver is performed. By starting the minimal risk maneuver, the risk of the vehicle is removed, and when the danger of the vehicle is removed, the minimal risk maneuver is terminated, thereby converting to a minimal risk condition.

Effects of the Invention

[0006] According to this disclosure, even if a vehicle is exposed to danger due to an event that occurs while it is driving autonomously, it can perform a minimal risk maneuver that eliminates the aforementioned danger. This allows the vehicle to escape the danger and transition to a minimum risk state, further increasing the vehicle's driving stability. [Brief explanation of the drawing]

[0007] [Figure 1] Figure 1 shows the vehicle according to this disclosure. [Figure 2] Figure 2 is a diagram showing the state of the vehicle in the first embodiment of this disclosure. [Figure 3] Figure 3 is a flowchart showing the operation of a vehicle in the first embodiment of this disclosure. [Figure 4] Figure 4 shows an example of a minimal risk maneuver in the first embodiment of this disclosure. [Figure 5] Figure 5 illustrates an example of a minimal risk maneuver in the first embodiment of this disclosure. [Figure 6] Figure 6 shows an example of a minimal risk maneuver in the first embodiment of this disclosure. [Figure 7] Figure 7 shows an example of a minimal risk maneuver in the first embodiment of this disclosure. [Figure 8] Figure 8 shows an example of a minimal risk maneuver in the first embodiment of this disclosure. [Figure 9] Figure 9 is a block diagram illustrating the steps involved in performing a minimal risk maneuver according to a second embodiment of the present disclosure. [Figure 10] Figure 10 is a diagram illustrating the MRM stage in a second embodiment of the present disclosure. [Figure 11] Figure 11 is a diagram illustrating the MRM type in a second embodiment of the present disclosure. [Figure 12] Figure 12 is a diagram illustrating the minimum sensing range in a second embodiment of the present disclosure. [Figure 13]Figure 13 is a diagram illustrating the minimum sensing range in a second embodiment of the present disclosure. [Figure 14] Figure 14 is a flowchart showing a method for selecting the type of minimal risk maneuver in a third embodiment of the present invention. [Figure 15] Figure 15 is a flowchart showing the stopping operation of a safety zone using a minimal risk maneuver in a fourth embodiment of the present disclosure. [Figure 16] Figure 16 is a flowchart showing the determination of an emergency situation and the processing of the said emergency situation in the fifth embodiment of this application. [Figure 17] Figure 17 is a flowchart showing a method for generating notification by a minimal risk maneuver in the sixth embodiment of this disclosure. [Figure 18] Figure 18 is a flowchart showing a method for granting control authority in the seventh embodiment of this disclosure. [Modes for carrying out the invention]

[0008] The present disclosure will be described below with reference to the attached drawings.

[0009] Where multiple embodiments are described in this disclosure, each embodiment may be an independent embodiment, but two or more embodiments may also be combined.

[0010] Figure 1 shows a vehicle according to a first embodiment of the present disclosure. Referring to Figure 1, vehicle 100 can assist in automated driving. According to the embodiment, vehicle 100 can perform steering, acceleration, braking, gear shifting, or parking without driver intervention, and can drive according to driver control when a driver intervenes. For example, vehicle 100 can mean a vehicle that can perform automated driving according to SAE (Society of Automation Engineers) Level 3 or higher, but the present disclosure is not limited thereto.

[0011] For example, the automatic driving described in this specification can include at least one of ADS functions such as PDCMS (Pedestrian Detection and Collision Mitigation System), LCDAS (Lane Change Decision Aid System), LDWS (Land Departure Warning System), ACC (Adaptive Cruise Control), LKAS (Lane Keeping Assistance System), RBDPS (Road Boundary Departure Prevention System), CSWS (Curve Speed Warning System), FVCWS (Forward Vehicle Collision Warning System), LSF (Low Speed Following).

[0012] Vehicle 100 can include sensor 110, controller 120, processor 130, display 140, and communication circuit 150.

[0013] Sensor 110 can sense the environment around vehicle 100 and generate data related to the surroundings of vehicle 100. According to an embodiment, sensor 110 can include at least one of a camera, a lidar (Light Detection and Ranging (LIDAR)) sensor, a radar (Radio Detection and Ranging (RADAR)) sensor, and a position sensor.

[0014] The camera can capture the surroundings of vehicle 100 and generate an image of the surroundings of vehicle 100 based on the capture result. The camera can sense the front, rear, and / or sides of vehicle 100 and generate image data based on the sensing result. For example, the camera can generate image data for other objects (e.g., other vehicles, people, objects, lanes, obstacles) located in the front, rear, and / or sides of vehicle 100.

[0015] According to the embodiment, the camera may include an image sensor, an image processor, and a camera MCU. For example, the image sensor may sense an image of a subject captured through the lens, the image processor may receive and process the data from the image sensor, and the camera MCU may receive the data from the image processor.

[0016] A lidar sensor can use light (or a laser) to sense the area in front of, behind, and / or to the sides of a vehicle 100, and generate sensing data based on the sensing results. For example, a lidar sensor can sense or recognize other objects (e.g., other vehicles, people, objects, lanes, obstacles) located in front of, behind, and / or to the sides of a vehicle 100.

[0017] According to the embodiment, the lidar sensor can consist of a laser transmission module, a laser detection module, a signal acquisition and processing module, and a data transmission and reception module. The laser light source has a wavelength in the 250 nm to 11 μm range, and a laser light source capable of changing wavelengths can be used. Furthermore, lidar sensors can be classified into TOF (Time of Flight) type and phase shift type depending on the signal modulation method.

[0018] A radar sensor can use electromagnetic waves (or radio waves) to sense the area in front of, behind, and / or to the sides of vehicle 100, and generate sensing data based on the sensing results. For example, a radar sensor can sense or recognize other objects (e.g., other vehicles, people, objects, lanes, obstacles) located in front of, behind, and / or to the sides of vehicle 100.

[0019] The radar sensor can detect objects up to 150m ahead within a horizontal angle of 30 degrees using either a frequency-modulated carrier wave (FMCW) or pulse carrier. The radar sensor can process the data generated from the detection results, and such processing may include magnifying the sensed forward object or focusing on the object's region within the overall field of view.

[0020] The position sensor can measure the current position of the vehicle 100. According to the embodiment, the position sensor may include a GPS sensor, which can measure the position, speed, and current time of the vehicle 100 by communicating with satellites. According to the embodiment, the GPS sensor can measure the delay time of radio waves emitted from satellites and determine the position of the vehicle 100 in relation to its distance from orbit.

[0021] The controller 120 can control the operation of the vehicle 100 under the control of the processor 130. According to the embodiment, the controller 120 can control the steering, driving, braking, and shifting of the vehicle 100. For example, the controller 120 can control the components for performing the steering, driving, braking, and shifting of the vehicle 100.

[0022] The controller 120 can control the steering of the vehicle 100 under the control of the processor 130. According to the embodiment, the controller 120 can perform control over the electric power steering system (MDPS) that drives the steering wheel. For example, the controller 120 can control the steering of the vehicle in a direction that avoids a collision or minimizes damage when a collision is expected.

[0023] The controller 120 can control the driving of the vehicle 100 under the control of the processor 130. According to the embodiment, the controller 120 can perform deceleration, acceleration, or engine on / off of the vehicle 100. For example, the controller 120 can perform acceleration or deceleration under the control of the processor 130, and can perform engine on / off at the start or end of the operation of the vehicle 100.

[0024] Furthermore, the controller 120 can control the movement of the vehicle 100 without driver control. For example, the controller 120 can perform autonomous driving of the vehicle 100 in accordance with the control of the processor 130.

[0025] The controller 120 can control the brakes of the vehicle 100 under the control of the processor 130. According to the embodiment, the controller 120 can control whether or not the brakes of the vehicle 100 are applied and can control the braking force. For example, the controller 120 can be controlled to automatically activate emergency brakes when a collision is anticipated.

[0026] The processor 130 can control the overall operation of the vehicle 100. According to the embodiment, the processor 130 may be an ECU (Electrical Control Unit) that can integrally control the components within the vehicle 100. For example, the processor 130 may include a CPU (Central Processing Unit) or an MCU (Micro Processing Unit) that can perform arithmetic processing.

[0027] The processor 130 can make decisions regarding the control of the vehicle 100 and control the controller 120 based on the decision results. According to the embodiment, the processor 130 can receive data from the sensor 110 and generate control commands to control the controller 120 based on the received data. The processor 130 can transfer the control commands to the controller 120. The processor 130 can also receive driver input or control and control the controller 120 in accordance with the driver input.

[0028] On the other hand, although the above explanation assumed that the controller 120 and the processor 130 were separate components, according to the embodiment, the controller 120 and the processor 130 can be integrated as a single component. For example, the controller 120 and the processor 130 can be integrated as a single device and can work together.

[0029] The display 140 can visually display information related to the vehicle 100. According to the embodiment, the display 140 can provide the driver of the vehicle 100 with various information about the vehicle 100 under the control of the processor 130. For example, the display 140 can visually display the current state of the vehicle 100 under the control of the processor 130.

[0030] The communication circuit 150 can communicate with the outside of the vehicle 100. According to the embodiment, the communication circuit 150 can receive data from or transmit data to the outside of the vehicle 100, in accordance with the control of the processor 130. For example, the communication circuit 150 can perform communication using a wireless communication protocol or a wired communication protocol.

[0031] For example, vehicle 100 can communicate with other vehicles (Vehicle to Vehicle) or with infrastructure (Vehicle to Infra) using the communication circuit 150.

[0032] Figure 2 is a diagram showing the state of the vehicle in a second embodiment of this disclosure. Referring to Figures 1 and 2, the state of vehicle 100 can be changed (or transitioned) according to the diagram shown in Figure 2.

[0033] The state of vehicle 100 can be any one of the following: driving state S1, minimal risk maneuver (MRM) state S2, minimum risk condition state S3, and minimal risk maneuver completion state S4. According to the embodiment, states S1 to S4 can transition to other states when specific conditions are met.

[0034] Driving state S1 can mean the state in which the vehicle 100 is in motion. According to the embodiment, in driving state S1, the vehicle 100 can be driven according to the control of the processor 130. For example, driving state S1 can mean the state in which the vehicle 100 is in autonomous driving mode.

[0035] The minimal risk maneuver state S2 can mean a state in which the vehicle 100 performs the minimal risk maneuver in response to a request for it. According to the embodiment, the vehicle 100, while in motion, can initiate the minimal risk maneuver if it is required. That is, the driving state S1 can transition to the minimal risk maneuver state S2.

[0036] In the minimal risk maneuver state S2, the vehicle 100 can perform operations to reduce the risk to the vehicle 100. According to the embodiment, the vehicle 100 can determine in various ways whether a minimal risk maneuver is necessary, and if so, it can generate a request for the minimal risk maneuver. For example, the vehicle 100 can perform a minimal risk maneuver by performing at least one of the following: steering, deceleration, acceleration, lane change, and emergency braking. The minimal risk maneuver does not suppress other safety functions of the vehicle 100 (e.g., automatic emergency braking, pedestrian collision detection braking, bicycle collision detection braking, etc.). That is, the minimal risk maneuver and the other safety functions of the vehicle 100 can be performed in parallel or sequentially.

[0037] Once a minimal risk maneuver is initiated, vehicle 100 will perform the minimal risk maneuver with priority over any existing driving, and the driver's control authority can be brought into play. In other words, vehicle 100 can cancel or terminate any previously scheduled driving and perform the minimal risk maneuver.

[0038] When vehicle 100 is performing autonomous driving, certain events may occur that prevent such autonomous driving from continuing. When such certain events occur, vehicle 100 may be placed in a dangerous (unpredictable) situation. To eliminate (or mitigate) such a dangerous situation, a minimal risk maneuver can be performed on vehicle 100. For example, vehicle 100 can automatically detect a certain event and automatically perform a minimal risk maneuver in response to the occurrence of such a event.

[0039] The aforementioned specific events may include failure of a component of the vehicle 100, deviation of the vehicle 100 from its path, or control failure of the vehicle 100.

[0040] According to the embodiment, the vehicle 100 can perform a minimal risk maneuver in the event of an automatic driving operation, a failure of a component for performing an automatic driving operation, or a failure of another component of the vehicle 100.

[0041] Furthermore, according to the embodiment, a minimal risk maneuver can be performed when the vehicle 100 approaches the boundary of the Operational Design Domain (ODD). The aforementioned operational design area may be a drivable section designed to allow the vehicle 100 to operate autonomously. For example, when the vehicle 100 approaches the outer boundary of the operational design area from within the operational design area, the vehicle 100 can perform a minimal risk maneuver.

[0042] Furthermore, according to the embodiment, the vehicle 100 can perform a minimal risk maneuver if the transfer of control authority of the vehicle 100 to the driver fails. When the vehicle 100 is changed from an automated driving mode to a manual driving mode (for example, in the case of Level 3 automated driving), the minimal risk maneuver may be disclosed if the driver fails to control the vehicle 100 (for example, the Dynamic Driving Task (DDT) of the SAE). For example, when changing from an automated driving mode to a manual driving mode, if the transfer of control authority of the vehicle 100 to the driver fails, the minimal risk maneuver can be initiated. That is, if a specific control action by the driver (for example, braking or steering) is required, but the driver fails to perform the said specific control action, the minimal risk maneuver may be disclosed.

[0043] If a minimal risk maneuver is not performed, vehicle 100 may collide with other vehicles, pedestrians, or other structures due to a malfunction in its (autonomous) driving system, potentially resulting in injury to the driver, passengers, or pedestrians. Furthermore, such a malfunction could also cause vehicle 100 to veer off the road. In other words, without a minimal risk maneuver, the autonomous driving of vehicle 100 may not perform as expected. A minimal risk maneuver is necessary to avoid the occurrence of such undesirable events.

[0044] In the minimal risk maneuver state S2, that is, once the minimal risk maneuver is initiated, the vehicle 100 can perform actions to minimize the risk to the vehicle 100, its driver, or passengers until the hazards around the vehicle 100 are eliminated and a state of no danger is guaranteed.

[0045] According to the embodiment, by initiating a minimal risk maneuver, the vehicle 100 can perform at least one of the following: stopping the vehicle, controlling the vehicle's steering, maintaining the lane, providing visual, auditory and tactile notifications, decelerating the vehicle, accelerating the vehicle, starting / ending autonomous driving, turning off the vehicle's start, transmitting an emergency signal, controlling the hazard lights, warning of speed reduction, controlling the brake lights, delegating control authority to other passengers, and remote control.

[0046] The minimum risk condition state S3 can mean a state in which the risk of vehicle 100 is eliminated or reduced. According to the embodiment, the risk of vehicle 100 can be eliminated by performing a minimal risk maneuver by vehicle 100. That is, the minimal risk maneuver state S2 can transition to the minimum risk condition state S3. For example, the minimum risk condition can mean when vehicle 100 is in a stable state or when vehicle 100 is stopped. Such a minimum risk condition can be achieved by the driver's operation or by vehicle 100 itself.

[0047] The minimum risk condition can be achieved when the risk of vehicle 100 is eliminated. In other words, a minimum risk maneuver can be performed to achieve the minimum risk condition.

[0048] On the other hand, if the minimum risk condition is not met, vehicle 100 can continue the minimal risk maneuver. In this case, the transition from the minimal risk maneuver state S2 to the minimum risk condition state S3 may not occur. For example, if the minimum risk condition is not met, vehicle 100 can ignore all controls other than those for the minimal risk maneuver. That is, once the minimal risk maneuver is initiated, vehicle 100 will continue to perform the minimal risk maneuver regardless of the driver's control.

[0049] The termination state S4 of the minimal risk maneuver can mean that the risk to vehicle 100 has been eliminated (i.e., the minimum risk condition has been met), and the minimal risk maneuver has ended. In other words, the minimum risk condition state S3 can transition to the termination state S4 of the minimal risk maneuver.

[0050] According to the embodiment, if the minimum risk conditions for vehicle 100 are met after the minimum risk maneuver has been performed, vehicle 100 can terminate the minimum risk maneuver. For example, if vehicle 100 stops, the minimum risk maneuver can be stopped or terminated.

[0051] According to the embodiment, the vehicle 100 can terminate the minimal risk maneuver when the conditions for the minimal risk maneuver are met and a reference time has elapsed. For example, if the vehicle 100 has performed the minimal risk maneuver and stopped, the vehicle 100 can terminate the minimal risk maneuver if the stopped state is maintained for the reference time.

[0052] After the minimal risk maneuver is completed, the vehicle 100 can start driving again. According to the embodiment, once the minimal risk maneuver is completed, the vehicle 100 can start a new drive or continue the existing drive according to the driver's operation or the control of the processor 130.

[0053] Overall, referring to the diagram in Figure 2, upon this start, vehicle 100 can perform (automatic) driving (i.e., driving state S1). If a specific event occurs while vehicle 100 is driving, vehicle 100 can perform a minimal risk maneuver (i.e., minimal risk maneuver state S2). Once the minimal risk maneuver is initiated, the risk to vehicle 100 is eliminated (i.e., minimum risk condition state S3). Once the risk to vehicle 100 is eliminated, the minimal risk maneuver ends (i.e., minimal risk maneuver termination state S4). After the minimal risk maneuver has ended, vehicle 100 can resume driving.

[0054] Figure 3 is a flowchart showing the operation of the vehicle in a first embodiment of this disclosure. Referring to Figures 1 to 3, a request for a minimal risk maneuver occurs (S110). According to the embodiment, the processor 130 can sense the state of the vehicle 100 and its surroundings and generate a request for a minimal risk maneuver according to the detection results. Alternatively, the vehicle 100 can recognize a request for a minimal risk maneuver transmitted from the outside. The request for a minimal risk maneuver can mean any command that causes the vehicle 100 to perform a minimal risk maneuver.

[0055] Vehicle 100 can determine the fault condition when a minimum risk maneuver is requested (S120). According to the embodiment, vehicle 100 can monitor the status of its components and identify faulty components. Vehicle 100 can monitor the status of each component of vehicle 100 in real time. Vehicle 100 can determine which of the sensors 110 are currently usable (or operational).

[0056] Furthermore, the vehicle 100 can determine the malfunction state and the cause (or circumstances) of the malfunction state. For example, the vehicle 100 can additionally determine the cause that induced the determined malfunction state.

[0057] Vehicle 100 can select the type of minimal risk maneuver (S130). According to the embodiment, vehicle 100 can select the type of minimal risk maneuver suitable for the current failure state based on the result of determining the failure state.

[0058] The types of minimal risk maneuvers mentioned above may include at least one of the following: stopping the vehicle, controlling the vehicle's steering, lane keeping, providing visual, auditory, and tactile notifications, decelerating the vehicle, accelerating the vehicle, starting / ending autonomous driving, turning off the vehicle's start, transmitting emergency signals, controlling hazard lights, warning of speed reduction, controlling brake lights, transferring control authority to other passengers, and remote control.

[0059] Vehicle 100 can initiate a minimal risk maneuver using the selected type of minimal risk maneuver (S140). According to the embodiment, vehicle 100 can be controlled according to the selected type of minimal risk maneuver. For example, the processor 130 of vehicle 100 can transfer a control command corresponding to the selected type of minimal risk maneuver to the controller 120, and the controller 120 can control vehicle 100 according to the control command.

[0060] Figure 4 illustrates an example of a minimal risk maneuver in a first embodiment of the present disclosure. Referring to Figures 1 to 4, a minimal risk maneuver without a lane change and a minimal risk maneuver with a lane change are shown. That is, by initiating a minimal risk maneuver, vehicle 100 can perform the minimal risk maneuver without changing lanes, or can perform the minimal risk maneuver with a lane change. A minimal risk maneuver without a lane change may include stopping straight ahead and stopping in the current lane, while stopping out of lane may include stopping in an adjacent lane and stopping on the shoulder. Lane change plus stop may mean stopping out of lane.

[0061] Vehicle 100 can perform at least one of the following actions based on the current malfunction status and the types of sensors available (sensor effectiveness): stopping while moving straight, stopping in the current lane, or stopping outside the lane.

[0062] Straight-line stopping means stopping by performing longitudinal (i.e., direction of travel) control without lateral control of the vehicle 100. According to the embodiment, the vehicle 100 can perform straight-line stopping through deceleration without steering control of the vehicle 100. For example, the vehicle 100 can perform straight-line stopping by deceleration (e.g., braking) without controlling the steering of the vehicle 100.

[0063] Only brake control of vehicle 100 is possible, and if other control functions fail, the vehicle 100 can be brought to a stop by controlling the brakes or by removing the driving force from vehicle 100.

[0064] Current lane stop refers to a stop performed by vehicle 100 in the lane it is traveling in (i.e., the current lane) before the commencement of the minimal risk maneuver. According to the embodiment, vehicle 100 can stop within the boundary range of the current lane it is traveling in by current lane stop. For example, vehicle 100 can stop within the boundary of the current lane by recognizing the current lane using sensor 110 and controlling the steering of vehicle 100 along the current lane using the steering function.

[0065] According to the embodiment, the vehicle 100 can perform a current lane stop through lateral and longitudinal control, or through lateral control.

[0066] For example, if the vehicle 100 is capable of steering and braking control and can sense what is in front of and behind the current lane, the vehicle 100 can perform a lane stop by maintaining the current lane through lateral and longitudinal control and performing a smooth stop.

[0067] For example, if vehicle 100 is capable of steering control and can sense what is in front of and behind the current lane, vehicle 100 can perform a stop in the current lane by performing an emergency stop while maintaining the current lane through lateral control. In this case, the brake control may not function properly.

[0068] Out-of-lane stopping refers to stopping outside the lane in which the vehicle 100 is traveling (i.e., the current lane) before the vehicle 100 begins its minimal-risk maneuver. According to the embodiment, the vehicle 100 can stop outside the current lane it is traveling in by utilizing its steering control function. For example, the vehicle 100 can stop within the boundary range of the current lane and another adjacent lane, or within the range of the shoulder.

[0069] Vehicle 100 can use sensor 110 to recognize other lanes adjacent to its current lane and stop within the boundary of the other lane. At this time, vehicle 100 can use sensor 110 to change lanes from its current lane to the other lane.

[0070] Vehicle 100 can use sensor 110 to recognize the shoulder and stop within the current shoulder boundary. At this time, vehicle 100 can apply conditions for identifying the shoulder (for example, a solid lane line) to determine whether an adjacent lane is a shoulder or not.

[0071] According to the embodiment, the vehicle 100 can perform lane-out stopping through lateral and longitudinal control.

[0072] For example, if vehicle 100 is capable of steering and braking control and can sense the current lane as well as the lane ahead and behind, vehicle 100 can perform a lane out-of-lane stop by changing its current lane through lateral and longitudinal control, thereby enabling a smooth stop or sudden stop. Also, if vehicle 100 is capable of steering and braking control and can sense the current lane as well as the lane ahead and behind, vehicle 100 can perform a shoulder stop by changing its current lane through lateral and longitudinal control, thereby enabling a smooth stop or sudden stop.

[0073] Figure 5 illustrates an example of a minimal risk maneuver in a first embodiment of the present disclosure. Vehicle 100 can perform a minimal risk maneuver according to the example shown in Figure 5. Referring to Figure 5, vehicle 100 can perform a minimal risk maneuver if a driver (or person)-related failure occurs, if the vehicle goes outside the operational design domain (ODD), or if a failure occurs due to unavoidable external circumstances.

[0074] Vehicle 100 can generate (or provide) a notification if the driver fails to take control of Vehicle 100. According to an embodiment, Vehicle 100 can sense the driver's status by performing active driver monitoring, and if the sensing results indicate that a transfer of control authority to the driver is not ready, it can use the notification provision function to provide the driver with a notification regarding the preparation for a transfer of control authority. For example, Vehicle 100 can provide the driver with a notification regarding the preparation for a transfer of control authority through visual, auditory, or tactile notifications.

[0075] Vehicle 100 can perform autonomous driving if the driver does not respond. According to the embodiment, vehicle 100 can perform autonomous driving without transferring control authority to the driver if it senses that the driver does not respond to the preparation for transfer of control authority (i.e., if transfer of control authority is not possible) by performing active driver monitoring.

[0076] If the vehicle 100 goes outside the operational design domain (ODD), it can reduce its speed or stop. According to the embodiment, if the vehicle goes outside the operational design domain (ODD), it can reduce its speed or stop by using at least one of steering control, acceleration control, or braking control.

[0077] Vehicle 100 senses the road configuration (off-curve, intersection or turnaround), road surface conditions (potholes, bumps, icy roads, water), weather (rain, fog, snow), and other factors (speed limits, traffic congestion, etc.) to determine whether vehicle 100 is outside the operational design domain (ODD). Based on the determination, it can either reduce the speed of vehicle 100 or stop vehicle 100.

[0078] In the event of a malfunction due to unavoidable external circumstances, the vehicle 100 can reduce its speed, come to a stop within its lane, or make an (emergency) stop on the shoulder. According to the embodiment, in the event of a malfunction due to unavoidable external circumstances, the vehicle 100 can use at least one of steering control, acceleration control, and brake control to reduce its speed, come to a stop within its lane, or make an (emergency) stop on the shoulder.

[0079] Vehicle 100 may determine if it is involved in a collision with another vehicle or if a malfunction occurs in a component of the vehicle (such as a tire puncture), and depending on the determination, may reduce the speed of vehicle 100, bring it to a stop in its lane, or bring it to a (emergency) stop on the shoulder.

[0080] Figure 6 illustrates an example of a minimal risk maneuver in a first embodiment of the present disclosure. Vehicle 100 can perform a minimal risk maneuver according to the example shown in Figure 6. Referring to Figure 6, vehicle 100 can perform a minimal risk maneuver if a failure occurs in the control system.

[0081] Vehicle 100 can perform a minimal-risk maneuver if a failure occurs in its actuation (drive) function.

[0082] For example, if a malfunction occurs in the steering function, the vehicle 100 can use at least one of the acceleration control and braking control to stop within the lane or reduce the speed of the vehicle 100.

[0083] For example, if a malfunction occurs in the acceleration mechanism, the vehicle 100 can use at least one of the steering control and brake control to stop in the lane, decelerate, or stop on the shoulder of the road.

[0084] For example, if a malfunction occurs in the deceleration mechanism, the vehicle 100 can use at least one of the steering control and acceleration control to bring it to a roadside stop.

[0085] For example, if another drive mechanism fails, the vehicle 100 can use at least one of steering control, acceleration control, and brake control to stop in its lane, decelerate, or stop on the shoulder of the road.

[0086] Vehicle 100 can perform a minimal risk maneuver if a malfunction occurs in its autonomous driving function.

[0087] For example, if the lane detection function malfunctions, the vehicle 100 can use the forward vehicle following function to stop or decelerate within the lane.

[0088] For example, if a malfunction occurs in the forward object detection function, the vehicle 100 can use at least one of the steering control and brake control functions to stop within the lane.

[0089] For example, if a malfunction occurs in the rear and side object detection functions, the vehicle 100 can use at least one of the steering control and brake control functions to stop or decelerate within the lane.

[0090] For example, if an autonomous driving ECU malfunctions, the vehicle 100 can use an alternative autonomous driving ECU to perform lane stopping or deceleration.

[0091] For example, if a failure occurs in the in-vehicle network, vehicle 100 can use network redundancy to stop or slow down within its lane. In other words, even if a failure occurs in the in-vehicle network, the vehicle can use pre-arranged redundancy to transmit commands over the network and perform a stop or slow down within its lane.

[0092] For example, if a failure occurs in the connection for connected ADS, the vehicle 100 can use at least one of the steering control and brake control to stop in the lane, decelerate, or stop on the shoulder.

[0093] Figure 7 illustrates an example of a minimal risk maneuver in a first embodiment of the present disclosure. Vehicle 100 can perform a minimal risk maneuver according to the example shown in Figure 7. Referring to Figure 7, vehicle 100 can perform a minimal risk maneuver if the driver (or person) acts incorrectly or if a failure occurs in the control system.

[0094] Vehicle 100 can provide notification to the driver if a driver (or person)-related malfunction occurs. According to the embodiment, vehicle 100 can perform active driver monitoring to sense the driver's condition and provide the driver with visual, auditory, or tactile notification if a driver (or person)-related malfunction occurs. For example, vehicle 100 can provide the driver with a speed reduction warning.

[0095] Vehicle 100 can provide notification to the outside or perform longitudinal control of vehicle 100 if a failure occurs in the control system.

[0096] For example, if a malfunction occurs in the control system, vehicle 100 can use the lighting control to turn on or off the emergency lights, or use the communication control function (or network redundancy) to transmit an emergency message to the traffic control center.

[0097] For example, if a malfunction occurs in the control system, the vehicle 100 can use the brake control function to reduce its speed, use the power supply control function to turn off the power to the engine (or drive means), or use the steering and brake control to bring the vehicle to a stop within its lane.

[0098] Figure 8 illustrates an example of a minimal risk maneuver in a first embodiment of the present disclosure. Vehicle 100 can perform a minimal risk maneuver according to the example shown in Figure 8. Referring to Figure 8, vehicle 100 can perform a minimal risk maneuver if a failure occurs in the control system.

[0099] If a failure occurs in the control system, vehicle 100 may either perform longitudinal control of vehicle 100 or transfer (or switch) control authority.

[0100] For example, if a failure occurs in the control system, the vehicle 100 can use at least one of the steering, acceleration, and braking functions to maintain its lane, perform a stop on the shoulder, or maintain the steering angle it had just left.

[0101] For example, if a failure occurs in the control system, vehicle 100 can control the turn-on / turn-off of the autonomous driving function using the power control function and the authority redundancy function. Vehicle 100 can turn off the autonomous driving function by turning off the vehicle's start-up, or by transferring authority over the autonomous driving of vehicle 100 to another entity (e.g., the driver). Vehicle 100 can turn on the autonomous driving function in the opposite manner.

[0102] For example, if a failure occurs in the control system, vehicle 100 can use the authority redundancy function to transfer authority to another passenger. Vehicle 100 can transfer control authority to another passenger and switch to manual driving mode.

[0103] For example, if a failure occurs in the control system, vehicle 100 can perform remote control using at least one of the communication control function and the authority redundancy function. Vehicle 100 can be controlled to be remotely controlled by transferring its control authority to an external party.

[0104] Figure 9 is a block diagram illustrating the steps in which a minimal risk maneuver is performed according to a second embodiment of the present disclosure.

[0105] While autonomous driving is being performed by ADS, events may occur that prevent the autonomous driving from being sustained. For example, an event corresponding to a failure of the autonomous driving system at autonomous driving levels 3 to 5 may occur. Alternatively, an event may occur where an autonomous vehicle at autonomous driving level 3 or 4 faces the risk of violating the ODD (Operational Design Domain) restrictions. ODD can refer to road boundaries, etc., as the operational design domain. Or, in autonomous driving systems at autonomous driving levels 3 to 5, an event may occur where the ADS requests driver intervention, but the driver is unable to take control of the vehicle.

[0106] In such situations, the ADS can ensure the safety of vehicle occupants by performing a minimal risk maneuver, and to that end, the system must select the most appropriate MRM type. This selection may take into account the vehicle's condition, surrounding traffic conditions, and other factors. Once the minimal risk maneuver is performed, the vehicle will come to a longitudinal stop, and if lateral control is possible, lateral control can also be performed simultaneously.

[0107] This disclosure presents the following five types of MRM. However, the scope of this disclosure is not limited to these, and may include other types of MRM that are identical or similar in form.

[0108] As the first type of MRM, straight-line stopping is performed only in the longitudinal direction and does not involve longitudinal control.

[0109] As a second type of MRM (Multi-Rate Stopping), in-lane stopping is a type in which the vehicle stops within the boundary of the lane it was previously traveling in.

[0110] As the third type of MRM (Multi-Lane Stop), Lane Change Plus Stop in Traffic Lane is a type in which a lane change is performed and the vehicle stops within the boundary of a road with multiple lanes.

[0111] As the fourth type of MRM (Multi-Rate Stop), the Shoulder Stop involves changing lanes and stopping on the shoulder of the road, away from the road boundary.

[0112] As the fifth type of MRM (Multi-Race Maneuver), the Parking Lane Stop involves changing lanes and leaving the road boundary to stop within the parking lines.

[0113] The vehicles referred to in this disclosure may include the Subject Vehicle and the Target Vehicle. The Subject Vehicle refers to the vehicle subject to the minimal risk maneuver, and the Target Vehicle refers to a vehicle in the vicinity of the Subject Vehicle that is likely to collide with it.

[0114] Furthermore, the term "potential stopping area" as used in this disclosure refers to an area adjacent to the vehicle's current position where the vehicle can stop. For example, the potential stopping area can be determined using location information such as HD maps, sensing information input through sensors, or information input through communication devices.

[0115] Furthermore, the lane boundaries referred to in this disclosure can be determined by visually recognizable markings, and if visually recognizable markings are not available, the lane boundaries may be determined by temporarily recognizable road features. Alternatively, lane boundaries can also be determined using information received from GPS or V2V and V2I information received from communication devices.

[0116] Referring to Figure 9, stage S910, in which the ADS operates normally, is illustrated. In this stage S910, the automated driving system (ADS) performs its functions normally as intended. The ADS can determine whether or not a minimal risk maneuver is necessary.

[0117] If event A1 occurs during the normal operation phase S910 of ADS, a transition may occur to the execution phase S920 of MRM. Event A1 may be a request for a minimal risk maneuver by ADS.

[0118] If event A2 occurs during the normal operation phase S910 of the ADS, a transition to the driver intervention request phase S950 may occur. Event A2 may be a request for driver intervention (RTI) by the ADS in the case of autonomous driving level 3. Alternatively, event A2 may be a warning issued to the driver by the ADS in the case of autonomous driving level 4 or level 5. Such event A2 may be selective.

[0119] At the driver intervention request stage S950, the ADS can request the driver to take driving authority. This stage can only be performed by certain ADSs (e.g., ADSs for autonomous driving level 3) because there may be situations where human driving is impossible. Specifically, if event B1 occurs at the driver intervention request stage S950, a transition may occur to the MRM execution stage S920. Event B1 may occur when a pre-set time is exceeded after a driver intervention request (RTI) is made. Alternatively, if event B2 occurs, a transition may occur to the ADS standby or ADS off stage S940. Event B2 may occur when driver intervention begins (e.g., autonomous driving level 3) or when a warning is issued (e.g., autonomous driving level 4 or 5).

[0120] During the MRM execution phase S920, the ADS can control its own vehicle. Specifically, during the MRM execution phase S920, the ADS can monitor its status, determine the MRM type, perform control of its own vehicle, and warn surrounding factors (e.g., surrounding vehicles) of danger. If event C1 occurs during the MRM execution phase S920, a transition to the MRC (Minimal Risk Condition) phase S930 may occur. Event C1 may occur when the vehicle's speed is 0, i.e., when the vehicle has stopped. If event C2 occurs during the MRM execution phase S920, a transition to the ADS standby or ADS off phase S940 may occur. Event C2 may occur when the driver intervenes while the MRM is being performed.

[0121] In MRC stage S930, the vehicle may be in a stopped state. In this stage, the vehicle can perform stop management, which can refer to vehicle control that maintains the vehicle in a stopped state regardless of the slope of the road surface where it is stopped. If event D1 occurs in MRC stage S930, a transition to ADS standby or ADS off stage S940 may occur. Event D1 may occur when the driver turns off ADS, when the driver receives control authority over the vehicle, and the driver takes control of the vehicle.

[0122] In the ADS standby or ADS off stage S940, ADS can be terminated. At this stage, the vehicle may no longer perform autonomous driving.

[0123] Stages S910, S920, S930, and S950 mentioned above represent states in which ADS is activated, while stage S940 may represent a state in which ADS is deactivated.

[0124] Figure 10 is a diagram illustrating the MRM stage in a second embodiment of the present disclosure.

[0125] When an MRM request is made (S1010), the system status is monitored (S1020). Specifically, the extent of failure of vehicle components is analyzed, the impact on the system is checked, the status of the system components is determined, and the current performance of autonomous driving is determined.

[0126] Subsequently, the MRM type is determined (S1030). Specifically, the most appropriate MRM type at the time the MRM is implemented can be determined. Such a determination is made based on internal information (e.g., system and vehicle status) and external information (e.g., surrounding traffic congestion, ODD). The MRM type determined in this way may transition to other MRM types if a specific event occurs.

[0127] Subsequently, the implementation of the MRM is carried out (S1040). Specifically, longitudinal and / or lateral control of the vehicle is input, and the vehicle control is performed accordingly.

[0128] The implementation stage of MRM (S1040) may lead to an MRC state (S1050), or it may revert to the monitoring stage S1020 of the ADS state, and stages S1020, S1030, and S1040 may be repeated. The repetition time may be a time predetermined by the system. If driver intervention occurs during the execution of MRM (S1060), MRM may be terminated.

[0129] Figure 11 is a diagram illustrating the MRM type in a second embodiment of the present disclosure.

[0130] As mentioned above, the MRM type can include five types, from the first to the fifth.

[0131] The first type of MRM is a straight-ahead stopping type, which performs only longitudinal deceleration control and no lateral control. The first type of MRM can be selected when lateral control is impossible, for example, in cases of lane detection failure or lateral actuator (steering) control failure. If MRM is performed using the first type of MRM, the vehicle can leave the lane boundary or leave the road. Therefore, acceleration control of the vehicle may not be permitted in the first type of MRM.

[0132] The second type of MRM is a lane-stopping type that can perform both longitudinal and lateral deceleration control. This type utilizes environmental information such as sensors, map data, and communication information to determine the target vehicle and path ahead. The second type of MRM can control lane changes, but may be selected when it is not possible to travel beyond a predetermined distance.

[0133] The third type of MRM is a lane change plus road-stay type, capable of longitudinal deceleration and acceleration control, as well as lateral control. This type utilizes environmental information such as sensors, map data, and communication information to determine the target vehicle and path ahead. The third type of MRM may be selected when it is not possible to move to a potential stopping area that deviates from the flow of traffic. For example, it may be selected when ADS is functioning normally but a potential stopping area is not detected, or when time and / or system limitations prevent ADS from driving to the potential stopping area. Acceleration control can also be performed for stable lane changes. Whether or not to change lanes, and the number of lanes that must be changed, may be determined on a case-by-case basis.

[0134] The fourth type of MRM is a shoulder-stopping type that can perform longitudinal acceleration and deceleration control, as well as lateral control. This type can determine the target vehicle and path ahead by utilizing environmental information such as sensors, map data, and communication information. The fourth type of MRM may be selected when it is possible to travel to the shoulder of a highway and when there are no obstacles on the shoulder. If deemed necessary in light of the traffic flow to the shoulder, acceleration control can also be performed.

[0135] The fifth type of MRM is a parking line stopping type that can perform longitudinal acceleration control and longitudinal deceleration control, as well as lateral control. This type can determine the target vehicle and path ahead by utilizing environmental information such as sensors, map data, and communication information. The fifth type of MRM may be selected when it is possible to drive to the parking space and there are no obstacles in the parking space. Acceleration control can also be performed if deemed necessary in light of the traffic flow to the parking space.

[0136] Each of the aforementioned MRM types can be executed within a predetermined execution time. This execution time may include a minimum and / or maximum execution time. If an MRM is not executed within the pre-set execution time, the MRM type may be immediately transitioned to a lower-level type that can be executed immediately.

[0137] To determine the MRM type as described above, the vehicle's condition may be monitored. For example, system performance and limitations may be monitored in real time. Based on such monitoring, the ADS can determine the most appropriate MRM type under given circumstances. Specifically, the ADS can monitor whether there are any mechanical or electronic defects as part of the vehicle's internal condition. The ADS can continuously monitor failures of vehicle components such as sensors and actuators in real time. These conditions can also be monitored when the ADS switches from an off state to an on state, or vice versa. Furthermore, external environmental conditions can also be monitored continuously in real time to determine the MRM type. For example, external environmental conditions may include whether the external conditions are on a highway or in a city, whether lane conditions are detectable, and whether tire pressure is appropriate.

[0138] As mentioned above, the determined MRM type can be transitioned either upwards or downwards. This will be explained in detail.

[0139] The MRM type can transition to a higher type. For example, even if a lower level MRM type is determined due to a temporary defect, if the defect is resolved during the execution of the MRM, it can be changed to a higher level MRM type. The transition to a higher level MRM type can be determined based on the state information of the vehicle's components. Alternatively, the transition to a higher level MRM type can be determined by considering the current vehicle speed and / or external environmental information. For example, if the execution of the MRM is performed at or above a predetermined level in a lower level MRM type, the MRM type can be maintained at the current lower level even though it could transition to a higher type. Or, even if it is performed at a predetermined level, a transition to a higher level MRM type may occur based on environmental information such as the absence of other vehicles in the vicinity. When changing to a higher level MRM type, it is desirable that the transition is to the highest level type based on the state information of the vehicle's components, vehicle speed, environmental information, etc., as described above.

[0140] The MRM type can transition to a lower type. For example, if a defect occurs in a vehicle component during MRM execution, if the defect worsens, or if lane changes become impossible due to changes in traffic conditions, the MRM type can be changed downwards from a high level to a low level. Downward transitions in MRM types can be determined based on the state information of the vehicle components. Furthermore, downward transitions in MRM types can be determined by considering the current vehicle speed and / or external environmental information. For example, in a high-level MRM type, if the MRM execution is performed above a predetermined level, the MRM type can be maintained at the current high level even though it should transition to a lower type. Alternatively, even if it is performed at a predetermined level, it may transition downwards to a lower-level MRM type based on environmental information such as the presence of other vehicles in the vicinity. When changing downwards, it is desirable that the MRM type transition to the highest level type is achieved based on the aforementioned state information of the vehicle components, vehicle speed, environmental information, etc.

[0141] To give a specific example, the modification from MRM Type 1 to MRM Type 2 is as follows: The lane ahead or the vehicle ahead was not recognized, but if such recognition problems are resolved, the modification to a higher level can be carried out.

[0142] The modifications from MRM Type 1 or 2 to MRM Type 4 or 5 are as follows: Modifications to a higher type can be performed if the internal conditions for performing the higher type are met (e.g., reactivation of the controller or when the vehicle's speed meets a previously set speed (e.g., 60 km / h)), if the external conditions for performing the higher type are met (e.g., when the congested section is cleared), if the vehicle stopped under the lower type but the stopping position is judged to be a high-risk location for an accident (e.g., one lane on a highway, on a railway track, at an interchange, etc.), and if the internal conditions for the vehicle to accelerate are met.

[0143] The following are the changes from MRM types 3, 4, and 5 down to MRM types 1 and 2. Changes down to lower types can be made if the internal conditions for performing a higher type are not met (for example, a control device failure, a timeout, or the vehicle's speed falling below a pre-set speed during MRM execution), or if the external conditions for performing a higher type are not met (for example, if a congested section occurs).

[0144] On the other hand, the vehicle speed required for MRM activation may differ depending on the MRM type. For example, in the case of MRM Type 1 or Type 2, the activation can be determined regardless of the vehicle's speed (whether the vehicle's speed is low or high). This is because, in the case of Types 1 and 2, a low level of MRM is performed, and it is desirable for the MRM function to operate across all speed ranges. In the case of MRM Types 3 through 5, the activation can only be determined if the vehicle's speed is above a pre-set speed. The pre-set speed required here may be the minimum speed required for automatic lane changes. In other words, even if a high-level type (Type 3 through 5) of MRM is possible as a result of evaluating internal and external conditions, a high-level type cannot be determined if the vehicle is below the pre-set speed, because it is desirable to move and stop the vehicle quickly.

[0145] As mentioned above, factors that determine the pre-set speed for determining a high-level type (third to fifth type) MRM can include the maximum sensing distance of the vehicle's front and rear sensors, the maximum speed limit, and measurement error. Specifically, the speed can be set such that the recognition distance value calculated considering the maximum speed limit and the measurement error of the relative speed is smaller than the maximum sensing distance of the rear-side radar.

[0146] For example, the recognition distance for a vehicle targeted by the lane-shifting and lane-changing assistance functions is 80m to 200m, relative to the vehicle's front bumper. Therefore, the recognition distance value (S_critical) can be determined to be 70m (80m - 10m). This determination takes into account the overall length of the vehicle and the target vehicle. If the pre-set speed for determining MRM is 60km / h, and considering the maximum speed limit of 110km / h under domestic law and a measurement error of 5km / h, the recognition distance value is derived to be 61.68m. Since this recognition distance value (61.68m) is smaller than the maximum detection range of the rear-side radar, which is 70m, 60km / h is suitable as the pre-set speed for determining MRM.

[0147] Furthermore, during MRM (Multi-Release Maneuver), it is desirable that the vehicle's deceleration is less than a pre-set value. This is to minimize the possibility of collision with other vehicles without disrupting the flow of traffic. This pre-set deceleration may vary depending on the MRM type, or it may be a constant value regardless of the MRM type (for example, 4 m / s²).

[0148] Furthermore, the minimal risk maneuver can also be canceled by driver intervention (RTI) or driver override.

[0149] Once a minimal risk maneuver is initiated, it may not be canceled except under specific conditions. For example, a minimal risk maneuver may not be canceled after its initiation unless it is completed and enters the MRC state, or without action from an authorized driver. In the embodiment, an authorized driver may include an adult driver as the registered user of the vehicle and / or a driver whose status is determined to be normal if a driver monitoring camera is present.

[0150] Furthermore, when performing a minimal risk maneuver, if there are occupants, notification can be provided internally or externally. For example, information regarding the minimal risk maneuver can be displayed internally or externally. If there are no occupants, notification can be provided externally only. For example, emergency lights can be flashed.

[0151] The autonomous driving system can determine the timing for initiating brake control. For example, it can decide to initiate brake control after a specified time has elapsed following the completion of a particular action. Preferably, brake control can be initiated 2.5 seconds after displaying an external notification, such as the flashing of hazard lights. This is to prevent collisions from vehicles behind.

[0152] Furthermore, when performing a minimal risk maneuver, depending on the MRM type, at least one of the following may differ: the vehicle's required speed, maximum deceleration, minimum sensing range, brake control, acceleration control, lateral control, MRC position, and maximum / minimum execution time.

[0153] For example, let's describe the first type of MRM as a straight-ahead stop.

[0154] In the case of MRM Type 1, there is no restriction on the vehicle's required speed. In other words, MRM Type 1 can be determined regardless of the vehicle's speed.

[0155] For the first type of MRM, it is desirable that the maximum deceleration be 4 m / s² or less.

[0156] For the first type of MRM, the minimum sensing range is explained with reference to Figure 12. The first type of MRM must detect obstacles at least in front of the vehicle. The minimum sensing distance in the longitudinal direction (d long,min ) can be determined as follows based on the maximum deceleration and the speed of the vehicle:

[0157]

number

[0158] Also, the minimum sensing distance in the lateral direction (d lat,min ) can be determined to be the same as the width of the vehicle itself.

[0159] The minimum sensing range for such MRM types should ideally be set wider as the MRM type level increases. This is because higher-level MRM types allow for a greater variety and number of usable sensors, and setting a wider minimum sensing area is desirable from a safety perspective as the MRM type level increases.

[0160] Alternatively, the minimum sensing range for the MRM type may be set wider as the MRM type decreases. This is because lower levels of MRM increase the risk of collision with surrounding vehicles, and therefore, a wider minimum sensing area is required for lower levels.

[0161] In the case of MRM Type 1, brake control can use maximum deceleration if the detectable distance is shorter than the minimum detectable distance, or if detection is impossible. However, if an obstacle within the minimum detectable distance can be detected, the brakes can be controlled at a deceleration lower than the maximum deceleration. In other words, in the case of MRM Type 1, it is desirable to allow maximum deceleration because the vehicle may violate its lane. For example, in situations where surrounding detection is impossible, when a rear-end collision is not expected during a sudden stop, when the road is curved, or when an obstacle is detected within a certain distance ahead, MRM Type 1 can perform maximum deceleration. However, as described later, in the case of MRM Type 2, it is desirable to decelerate at a deceleration lower than the maximum deceleration.

[0162] In the first type of MRM, lateral control is not performed. Also, since lateral control is not performed, the MRC position can be outside the lane boundary.

[0163] For the first type of MRM, the minimum / maximum execution time is as follows: The minimum execution time may be longer than the time it takes for your vehicle to complete the MRM from start to finish on level ground using a constant maximum deceleration. The maximum execution time may be shorter than the time it takes for your vehicle to complete the MRM from start to finish on level ground using neutral gear. For example, it may be the time it takes to complete the MRM from start to stop on level ground using neutral gear, or even shorter.

[0164] To give another example, let's describe lane stopping as a second type of MRM. In the case of the second type of MRM, there is no restriction on the required speed of the vehicle. In other words, the second type of MRM can be determined regardless of the speed of the vehicle.

[0165] For the first type of MRM, it is desirable that the maximum deceleration be 4 m / s² or less.

[0166] For the first type of MRM, the minimum sensing range is explained by referring to Figure 13. For the second type of MRM, it must detect obstacles that are at least in front of the vehicle and within the same lane. Minimum sensing distance in the longitudinal direction (d long,min ) can be determined as follows based on the maximum deceleration and the speed of the vehicle:

[0167]

number

[0168] Furthermore, in the case of stopping within a lane, the detection range must cover curvatures up to 500m, taking into account the case where the lane is curved.

[0169]

number

[0170] Also, the minimum sensing distance in the lateral direction (d lat,min) can be determined to be the same as the lane width, taking curvature into account.

[0171] The minimum sensing range for such MRM types should ideally be set wider as the MRM type level increases. This is because higher-level MRM types allow for a greater variety and number of usable sensors, and setting a wider minimum sensing area is desirable from a safety perspective as the MRM type level increases.

[0172] Alternatively, the minimum sensing range for an MRM type may be set wider as the MRM type decreases. This is because lower levels of MRM increase the risk of collision with surrounding vehicles, and therefore, a wider minimum sensing area is required for lower levels.

[0173] In the case of the second type of MRM, brake control can use maximum deceleration if the sensing distance is shorter than the minimum sensing distance, or if detection is impossible. However, if an obstacle within the minimum sensing distance can be detected, the brakes can be controlled at a deceleration lower than the maximum deceleration.

[0174] In the case of the second type of MRM, lateral control can be performed to the extent that it is possible to keep the vehicle within the same lane.

[0175] For the first type of MRM, the minimum / maximum execution time is as follows: The minimum execution time may be longer than the time it takes for your vehicle to complete the MRM from start to finish on level ground using a constant maximum deceleration. The maximum execution time may be shorter than the time it takes for your vehicle to complete the MRM from start to finish on level ground using neutral gear.

[0176] Figure 14 is a flowchart illustrating a method for selecting a type of minimal risk maneuver in a third embodiment of the present invention. Referring to Figure 14, the vehicle 100 can determine a fault condition (S210). According to the embodiment, the vehicle 100 can determine a fault condition using the controller 120 or using responses from components of the vehicle 100. Here, the fault condition includes whether or not the automated driving system is in a state where it can control the vehicle. For example, if the brakes, steering, or sensors are malfunctioning, it can mean that the automated driving system (ADS) is unable to control them.

[0177] Vehicle 100 can determine whether its deceleration and acceleration functions are possible (S220). According to the embodiment, vehicle 100 can determine whether the drive unit such as the engine, the acceleration pedal, the brakes and related components of vehicle 100 are operating normally.

[0178] When the vehicle 100 is capable of deceleration and acceleration (Y in S220), the vehicle 100 can determine whether or not its steering function is capable (S230). According to the embodiment, the vehicle 100 can determine whether or not the steering wheel of the vehicle 100 and its related components are functioning normally.

[0179] When the steering function of vehicle 100 is unavailable (N in S230), vehicle 100 can perform a straight-line stop as a minimal risk maneuver. In other words, if only the deceleration and acceleration functions of vehicle 100 are available, vehicle 100 will perform a straight-line stop as a minimal risk maneuver.

[0180] When the steering function of vehicle 100 is available (Y in S230), vehicle 100 can determine whether or not it is able to sense road conditions (S250). According to the embodiment, vehicle 100 can determine whether or not the sensor 110 and related components are operating normally.

[0181] When the vehicle 100 is unable to sense the road conditions (N in S250), the vehicle 100 can perform a straight-ahead stop or a stop in its current lane as a minimal risk maneuver (S260). In other words, when the vehicle 100 is able to decelerate and accelerate and steer, and is unable to sense the road conditions, the vehicle 100 can perform a straight-ahead stop or a stop in its current lane as a minimal risk maneuver.

[0182] According to the embodiment, the vehicle 100 can travel along a lane using the steering function and stop within the lane using the deceleration and acceleration functions.

[0183] When the vehicle 100 is capable of sensing road conditions (Y in S250), the vehicle 100 can perform a straight-ahead stop, a stop in the current lane, or a stop outside the lane as a minimal risk maneuver (S270). That is, when the vehicle 100's deceleration and acceleration functions, steering function, and road condition sensing function are all capable, the vehicle 100 can perform a straight-ahead stop or a stop outside the current lane as a minimal risk maneuver. The stop outside the lane may include stopping in an adjacent lane or stopping on the shoulder.

[0184] According to the embodiment, the vehicle 100 can sense the state of the vehicle in front, behind, to the sides, and to the right by utilizing a road condition sensing function, change lanes using a steering function based on the sensing results, and stop the vehicle outside the lane using deceleration and acceleration functions. For example, the vehicle 100 can sense the state of the vehicle in front, behind, to the sides, and to the right by setting a region of interest that includes the area around the vehicle 100. The shape of the region of interest can be various shapes such as a circle, ellipse, square, or triangle.

[0185] Figure 15 is a flowchart illustrating the stopping operation in a safe zone by a minimal risk maneuver in a fourth embodiment of the present disclosure. Referring to Figure 15, when the vehicle 100 performs a minimal risk maneuver, the vehicle 100 can be stopped in a safe zone. In this specification, a safe zone means an area on the road where the vehicle 100 can stop safely, and can mean, for example, a rest area for napping, the shoulder of the road, or an unused variable lane.

[0186] Vehicle 100 can initiate a minimal risk maneuver (S210). According to the embodiment, vehicle 100 can initiate a minimal risk maneuver in response to a request for a minimal risk maneuver.

[0187] Vehicle 100 can determine the presence or absence of a safety zone using navigation information (S220). According to the embodiment, vehicle 100 can determine whether or not a safety zone exists on the road around vehicle 100 by using its current position and navigation information. The navigation information is stored in the memory of vehicle 100 or can be received via a network.

[0188] For example, vehicle 100 can determine, based on navigation information, whether or not there is a safe zone located near its current position.

[0189] Vehicle 100 can determine whether or not a safety zone exists using sensor 110 (S230). According to the embodiment, vehicle 100 can acquire video or images of the area around vehicle 100 using at least one of a camera, lidar sensor, and radar sensor, and determine whether or not a safety zone exists around vehicle 100 by analyzing the video. For example, vehicle 100 can recognize signs around vehicle 100 and determine whether or not the recognized signs indicate the presence of a safety zone.

[0190] Vehicle 100 can determine the presence or absence of a safe zone using infrastructure communication (S250). According to the embodiment, vehicle 100 can obtain information from the infrastructure regarding safe zones located around vehicle 100, and from this information it can determine whether or not a safe zone exists around vehicle 100. For example, vehicle 100 can provide its current location as infrastructure and receive information from the infrastructure regarding safe zones located around vehicle 100.

[0191] Vehicle 100 can stop in a safety zone based on a decision (S220 to S240) (S250). According to the embodiment, if a common safety zone exists as indicated by each of the decisions (S220 to S240), vehicle 100 can stop in the common safety zone. For example, if a first safety zone determined based on navigation information, a second safety zone determined using sensors, and a third safety zone determined based on infrastructure information are all located at the same location or adjacent to each other, vehicle 100 can determine that a safety zone exists and drive and stop in the common safety zone.

[0192] If there is no common safe zone indicated by each of the judgments (S220 or S240), the vehicle 100 may determine that there is no safe zone and continue driving without stopping.

[0193] Furthermore, according to the embodiment, if some of the decisions (S220-S240) of the vehicle 100 have not been made (for example, due to a malfunction), the vehicle 100 can stop in the common safety zone indicated by the decisions that have been made. For example, if no information is received from the infrastructure, the vehicle 100 can determine that a safety zone exists if the first safety zone determined based on navigation information and the second safety zone determined using sensors are all located in the same or adjacent location, and can drive the vehicle 100 to the common safety zone and stop. In other words, the vehicle 100 can determine that a safety zone exists based on whether or not the safety zones determined by the decisions that have been made are common.

[0194] Figure 16 is a flowchart showing the determination of an emergency situation and the processing of the said emergency situation in the fifth embodiment of this application. Referring to Figure 16, the vehicle 100 performs autonomous driving (S210).

[0195] Vehicle 100 can be inspected to check its status (S220). According to the embodiment, vehicle 100 can be inspected to check the status of each component and function of vehicle 100.

[0196] Vehicle 100 can check the status of its hardware and software configurations. According to the embodiment, vehicle 100 can determine whether or not there are any malfunctions in the components and functions of vehicle 100, and where the malfunctions are located. For example, vehicle 100 can determine whether or not sensor 110 has malfunctioned and where the malfunction is located, whether or not there are any malfunctions in the vehicle's drive functions such as steering, deceleration, acceleration, and brakes, whether or not autonomous driving is possible, whether or not there are any malfunctions in the object recognition function, whether or not there has been an external impact, and whether or not there is any damage.

[0197] Vehicle 100 can determine whether or not to perform a minimal risk maneuver (S230). According to the embodiment, vehicle 100 can determine whether or not to perform a minimal risk maneuver based on the determined state of vehicle 100. For example, vehicle 100 can calculate the severity of the current state of vehicle 100 based on at least one of the following: the number of faulty parts of vehicle 100 (i.e., faulty components and faulty functions), the location of the faulty parts, and the type of faulty parts, and then determine whether or not to perform a minimal risk maneuver based on the calculated severity.

[0198] Vehicle 100 may perform the minimal risk maneuver if it is decided to perform it (Y in S230) (S240). According to the embodiment, vehicle 100 may calculate the severity of the condition of vehicle 100 based on the determined condition of vehicle 100, and may perform the minimal risk maneuver if the calculated severity exceeds a predetermined level, or may not perform the minimal risk maneuver if it does not exceed the predetermined level.

[0199] If it is determined that the vehicle 100 will not perform the minimal risk maneuver (N in S230), it can perform a diagnostic function (S250). According to the embodiment, the diagnostic function is a function that self-checks the components and functions of the vehicle 100, and through the diagnostic function, some problems with the components and functions can be resolved (or cured). The diagnostic function can be performed by the processor 130.

[0200] According to the embodiment of this application, if the condition of the vehicle 100 is not serious, the diagnostic function can be executed without performing the minimal risk maneuver. This not only allows for accurate determination of the conditions for initiating the minimal risk maneuver, but also has the effect of increasing the stability of the vehicle 100 by avoiding the initiation of unnecessary minimal risk maneuvers.

[0201] Vehicle 100 can determine whether the condition of the vehicle has improved (S260). According to the embodiment, vehicle 100 can determine whether any failures or problems with the components and functions of vehicle 100 have been resolved. For example, vehicle 100 can re-check the condition of vehicle 100.

[0202] If the vehicle condition of vehicle 100 improves (Y in S260), vehicle 100 can perform autonomous driving. In other words, if the problem is resolved, vehicle 100 can resume autonomous driving.

[0203] If the condition of vehicle 100 does not improve (N in S260), vehicle 100 can switch to manual driving. According to the embodiment, if vehicle 100 has a malfunction despite the execution of the diagnostic function, vehicle 100 can switch to manual driving by delegating control authority to the driver, instead of continuing to maintain automatic driving.

[0204] According to the embodiment, if the condition of the vehicle 100 has not improved, the vehicle 100 can transmit a signal to notify of a malfunction. For example, the vehicle 100 can transmit a signal to a pre-designated management center (or server) indicating a malfunction of the vehicle 100.

[0205] Figure 17 is a flowchart illustrating a method for generating notification by a minimal risk maneuver in a sixth embodiment of the present disclosure. Referring to Figure 17, the vehicle 100 can perform driving (S210). According to the embodiment, the vehicle 100 can drive according to either automatic or manual driving.

[0206] Vehicle 100 can perform a minimal risk maneuver (S220). According to the embodiment, if a request for a minimal risk maneuver arises while the vehicle 100 is driving, it can perform the minimal risk maneuver in response to the request.

[0207] A minimal risk maneuver is performed, and the vehicle 100 can generate a notification (S230). According to the embodiment, the vehicle 100 can generate a notification regarding the minimal risk maneuver.

[0208] Vehicle 100 can provide notifications regarding the execution of a minimal risk maneuver to surrounding vehicles or facilities (e.g., infrastructure, police stations, fire stations, hospitals, etc.). According to the embodiment, vehicle 100 can define a certain area centered on vehicle 100 and provide notifications to other vehicles or facilities included in the said area.

[0209] Vehicle 100 can provide the notification by transmitting a signal containing specific information or by using visual and auditory means. For example, vehicle 100 can provide the notification by transmitting a signal containing information about minimal risk maneuvers, turning emergency lights on or off, or honking the horn.

[0210] According to the embodiment, the information relating to the minimal risk maneuver may include, but is not limited to, information regarding whether or not the minimal risk maneuver is being performed, the time at which the minimal risk maneuver is performed, and the type, location, and state of the vehicle 100 that performed the minimal risk maneuver. It may include a variety of information relating to the minimal risk maneuver.

[0211] Figure 18 is a flowchart showing a method for granting control authority in a seventh embodiment of this disclosure. Referring to Figure 18, the vehicle 100 can perform driving (S210). According to the embodiment, the vehicle 100 can drive according to either automatic driving or manual driving.

[0212] Vehicle 100 can perform a minimal risk maneuver (S220). According to the embodiment, if a request for a minimal risk maneuver arises while the vehicle 100 is driving, it can perform the minimal risk maneuver in response to the request.

[0213] Vehicle 100 can determine the entity that has control authority over the minimal risk maneuver (S230). According to the embodiment, vehicle 100 can determine whether to grant control authority over the minimal risk maneuver to vehicle 100 or to the driver. In this disclosure, control authority means authority to control the minimal risk maneuver, and the entity with said authority can perform control by the minimal risk maneuver.

[0214] Vehicle 100 can determine the entity with control authority based on the cause of the minimal risk maneuver. As described above, a request for a minimal risk maneuver may occur when a specific event (e.g., danger) occurs to vehicle 100. Vehicle 100 can determine the entity with control authority based on the characteristics of the event that requests the minimal risk maneuver.

[0215] According to the embodiment, if the request for a minimal risk maneuver is initiated by the driver, the vehicle 100 can determine that the driver is the entity with control authority over the minimal risk maneuver. For example, if the cause of the malfunction is the driver (e.g., inexperienced driving), the vehicle 100 can determine that the driver is the entity with control authority over the minimal risk maneuver. If the cause of the request for a minimal risk maneuver is the driver, the automated driving system may not transfer control authority to the driver even if the driver intervenes. The automated driving system can continue to perform the minimal risk maneuver even if the driver intervenes.

[0216] According to the embodiment, if the vehicle 100 initiates the request for a minimal risk maneuver, the vehicle 100 can determine that it is the entity with control authority over the minimal risk maneuver. For example, if the cause of the malfunction is the vehicle 100 (e.g., a malfunction or failure of the sensor 110), the vehicle 100 can determine that it is the entity with control authority over the minimal risk maneuver.

[0217] Vehicle 100 can grant control authority to either Vehicle 100 or the driver based on the determination result of the entity granting control authority (S240). According to the embodiment, if the entity granting control authority is Vehicle 100, the minimal risk maneuver is performed by Vehicle 100, and if the entity granting control authority is the driver, the minimal risk maneuver can be performed by the driver.

[0218] If the vehicle 100 is determined to be the entity with control authority, the vehicle 100 can perform the minimal risk maneuver until the minimum risk conditions are met. According to the embodiment, even if there is driver intervention in control before the minimum risk conditions are met, the vehicle 100 can perform the minimal risk maneuver without transferring control authority. For example, if the vehicle 100 is determined to be the entity with control authority, the minimal risk maneuver can continue to be performed by the vehicle 100 even if the driver performs steering, braking, or acceleration operations.

[0219] If the driver is determined to be the entity with control authority, the vehicle 100 can transfer control authority for the minimal risk maneuver to the driver if the driver takes action. According to the embodiment, if the driver takes action while the minimal risk maneuver is being performed, the vehicle 100 can discontinue the minimal risk maneuver and the vehicle 100 can be controlled by the driver's action. For example, if the driver takes action such as steering, braking, or accelerating, the vehicle 100 will discontinue the minimal risk maneuver and the vehicle 100 can be controlled by the driver's action.

[0220] According to this disclosure, it is possible to determine the entity with control authority over the minimal risk maneuver, thereby preventing damage caused by uncertainty in control authority during emergencies, and increasing the stability of the vehicle during the minimal risk maneuver through control by a designated entity.

[0221] The vehicle operation method described herein can be embodied by commands stored on a computer-readable storage medium and executed by a processor.

[0222] The storage medium can be a relational database, a non-relational database, an in-memory database, or any other suitable database, including distributed databases, whether directly and / or indirectly, regardless of whether it is in its original state, formatted state, organized state, or any other accessible state, and can store data and allow access to that data via a storage controller. The storage medium can also include any type of storage device, such as primary storage, secondary storage, tertiary storage, offline storage, volatile storage, non-volatile storage, semiconductor storage, magnetic storage, optical storage, flash storage, hard disk drive storage, floppy disk drives, magnetic tape, or any other suitable data storage medium.

[0223] In this specification, a command can be any of the following: an assembler command, an Instruction-Set-Architecture (ISA) command, a machine command, a machine-dependent command, microcode, a firmware command, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk and C++, and traditional procedural programming languages ​​such as the C programming language or similar languages.

[0224] This disclosure has been described with reference to the embodiments illustrated in the drawings, which are merely illustrative, and it will be understood by those with ordinary skill in the art that a variety of modifications and equivalent other embodiments are possible therefrom. Therefore, the true scope of technical protection of this disclosure must be determined by the technical idea of ​​the appended claims.

Claims

1. In vehicles designed to perform minimal risk maneuvers, A sensor that senses the surrounding environment of the vehicle and generates related data; A processor that monitors the status of the vehicle, generates related data, and controls the autonomous driving of the vehicle; A controller that controls the operation of the vehicle by the control of the processor; and The aforementioned processor, If it is determined that there is an abnormality in at least one of the conditions of the vehicle, a request for the vehicle's minimum risk maneuver is generated. Based on the condition of the aforementioned vehicle, one of several types is selected as the minimal risk maneuver type. The controller is controlled to perform the vehicle's minimal risk maneuver according to the contents of the minimal risk maneuver type. vehicle.

2. The aforementioned multiple types are, Including the straight-ahead stop type and the current lane stop type, The vehicle according to claim 1.

3. The aforementioned processor, If steering of the vehicle is impossible, the straight-ahead stopping type is determined to be the minimal risk maneuver type. The vehicle according to claim 2.

4. The aforementioned processor, If the vehicle is capable of steering but cannot detect the adjacent lane, the current lane stopping type is determined to be the minimal risk maneuver type. The vehicle according to claim 3.

5. The aforementioned multiple types are, This also includes lane change plus stop types, The aforementioned processor, If the vehicle is capable of steering and can sense the adjacent lane, the lane-out stopping type is determined to be the minimal risk maneuver type. The vehicle according to claim 2.

6. The aforementioned lane-out stopping type is, The vehicle according to claim 5, including a lane change plus road-stop type, a shoulder-stop type, and a parking line-stop type.

7. The aforementioned sensor is Further configured to provide the processor with information about potential stop regions, The aforementioned processor, The system is further configured to determine the minimal risk maneuver type based on the aforementioned potential stop region. The vehicle according to claim 6.

8. The aforementioned processor, If it is determined that there is no potential stopping area, or that the vehicle is unable to move to the potential stopping area, the lane change plus road-withdrawal stopping type is determined to be a minimal risk maneuver type. The vehicle according to claim 7.

9. The aforementioned processor, If it is determined that there are no parking spaces within the potential stopping area, or that the vehicle is unable to move to a parking space within the potential stopping area, and that the vehicle can move to the shoulder within the potential stopping area, then the shoulder stopping type is determined to be the minimal risk maneuver type. The vehicle according to claim 8.

10. The aforementioned processor, If it is determined that the vehicle can move to the parking space within the potential stopping area, the parking line stopping type is determined to be the minimal risk maneuver type. The vehicle according to claim 9.

11. In a method of operating a vehicle to perform a minimal risk maneuver, A first step in generating the requirements for the minimum risk maneuver of the vehicle; The second stage involves monitoring the condition of the aforementioned vehicle; The third stage involves determining one of several types as the minimal risk maneuver type based on the condition of the aforementioned vehicle; and A fourth stage is included in which the vehicle performs a minimal risk maneuver according to the content of the minimal risk maneuver type, method.

12. The aforementioned multiple types are, Including the straight-ahead stop type and the current lane stop type, The method according to claim 11.

13. XL Stage 3 is, If steering the vehicle is impossible, the process includes determining the straight-ahead stopping type to the minimal risk maneuver type. The method according to claim 12.

14. XL Stage 3 is, If the vehicle is capable of steering and cannot detect a lateral lane, the process includes determining the current lane stopping type to a minimal risk maneuver type. The method according to claim 13.

15. The aforementioned multiple types are, This also includes lane change plus stop types, XL Stage 3 is, If the vehicle is capable of steering and can sense the adjacent lane, the step includes determining the lane-out stopping type to the minimal risk maneuver type. The method according to claim 12.

16. The aforementioned lane-out stopping type is, The method according to claim 15, including a lane change plus road-withdrawal stop type, a shoulder stop type, and a parking line stop type.

17. The process further includes the step of generating information about potential stopping regions, XL Stage 3 is, The step includes determining the minimal risk maneuver type based on the aforementioned potential stop region, The method according to claim 16.

18. XL Stage 3 is, If it is determined that there is no potential stopping area or that the vehicle is unable to move to the potential stopping area, the further step includes determining the lane change plus road-withdrawal stopping type to a minimal risk maneuver type. The method according to claim 17.

19. XL Stage 3 is, If it is determined that the vehicle is in a state where it can move to a parking space within the potential stopping area, the parking line stopping type is determined to be a minimal risk maneuver type, including the step of determining the parking line stopping type to a minimal risk maneuver type. The method according to claim 18.

20. XL Stage 3 is, The process includes determining the shoulder stopping type to a minimal risk maneuver type if it is determined that there are no parking spaces within the potential stopping area, or that the vehicle is unable to move to a parking space within the potential stopping area, and if it is determined that the vehicle can move to the shoulder within the potential stopping area, The method according to claim 19.

Images