Method and vehicle system for detecting and handling over-braking in cooperative operation, and correspondingly designed motor vehicle

Abstract

The invention relates to a method (11) for controlling a motor vehicle (1) which can be longitudinally guided both manually and automatically. In the method, when a driver-assistance system (3) configured for longitudinal vehicle guidance requests a target deceleration, a deceleration fault is detected if an actual deceleration of the motor vehicle (1) is greater than a predetermined deceleration threshold value for longer than a predetermined tolerance period. However, if, at the same time, a driver-requested deceleration results from actuation of a brake operating element (5) of the motor vehicle (1) by a driver (2), this deceleration threshold value used for detecting deceleration faults is automatically adapted to a higher level of deceleration by an amount equal to the current driver-requested deceleration. The invention also relates to a vehicle system (7) designed to perform the method and to a motor vehicle (1) equipped with such a vehicle system.

Description

[0001] 24.1747

[0002] 1

[0003] Method and vehicle system for detecting and handling overbraking in a cooperative operation and appropriately equipped motor vehicle

[0004] The present invention lies in the field of safety and vehicle engineering and relates to a method for controlling a motor vehicle. The invention also relates to a correspondingly configured vehicle system and a motor vehicle equipped therewith.

[0005] Modern vehicles are increasingly equipped with functions and systems to improve user comfort or automate driving. This also increases complexity and, at least potentially, the susceptibility to errors or the risk of undesirable effects or behaviors in the respective vehicle. For example, unintentionally or erroneously excessive acceleration or deceleration can be problematic for both the driver and driver assistance systems. Approaches and rules already exist, for example, regarding functional safety or ensuring the correct control of hydraulic brakes or similar systems. However, such implementations can become more difficult with increasing complexity, for example, in cooperative operation where both the driver and a driver assistance system are actively involved in longitudinal control.

[0006] For example, EP 2 986 866 B1 describes a method for actuating an electrically operated friction brake driven by an electric motor. In this method, the actuation energy of the electric motor is determined for a braking process and this is used as the actual actuation energy at a predetermined target position of the friction brake 24.1747.

[0007] 2. Next, a target actuation energy is determined for the target position or braking effect based on known data for the friction brake. Any deviation between the actual actuation energy and the target actuation energy is then compensated for by actuating the friction brake.

[0008] DE 10 2017 205209 A1 describes a method for compensating for low actuator dynamics of a mechanical brake in a motor vehicle. A distribution device receives a target total deceleration for the vehicle and, based on this target, determines a corresponding mechanical braking torque and signals it to the mechanical brake. The brake then uses a brake actuator to adjust the actual mechanical braking torque to match the target mechanical braking torque. The distribution device predicts the actual mechanical braking torque using a model of the brake actuator, taking into account its current operating state and a gradient of the target mechanical braking torque. Depending on the predicted actual mechanical braking torque, a compensating torque is generated by actuating a vehicle component other than the mechanical brake. This compensating torque then achieves the target total deceleration for the vehicle.

[0009] However, even with these approaches, not all situations and errors can be handled optimally.

[0010] The object of the present invention is to enable or support safe cooperative control or guidance of a motor vehicle by a driver and a driver assistance system.

[0011] This problem is solved by the subject matter of the main claim and the dependent claims or independent claims. Further possible embodiments of the invention are disclosed in the subclaims, the description, and the figures. Features, advantages, and possible embodiments set forth in the description for one of the subject matter of the independent claims are to be regarded, at least analogously, as features, advantages, and possible embodiments of the respective subject matter of the other independent claims and of any possible combination of the subject matter of the independent claims, optionally in conjunction with one or more of the dependent claims. 24.1747

[0012] 3

[0013] The method according to the invention can be used for or in the control of a motor vehicle that is equipped for manual longitudinal control by a driver, i.e., for a manual operating mode, and for at least assisted or at least partially automated longitudinal control by a driver assistance system, i.e., for at least assisted or at least partially automated operating mode, which is also referred to here for simplicity as automated operating mode. In particular, a drive system of the motor vehicle can be controlled. The motor vehicle or its drive system can, for example, include at least one brake actuator for generating a braking torque, i.e., a decelerating or negative torque. Such a brake actuator can, in particular, be or include a hydraulic friction brake. Likewise, corresponding braking torques or negative drive torques can be generated by means of an electric drive motor.Similarly, the motor vehicle or its drive system can include an electric drive motor as a drive actuator to generate accelerating, i.e., positive drive torques.

[0014] The method according to the invention can be applied automatically or continuously during operation, i.e., while the motor vehicle is in motion. In the method according to the invention, continuous monitoring is carried out for a target deceleration requested by the driver assistance system, i.e., a target braking acceleration, and for the actuation of a brake control element, in particular a brake pedal of the motor vehicle. The latter can, in particular, mean that it is monitored whether the driver of the motor vehicle manually acts or operates the brake control element. Monitoring can also be carried out for the actuation of an acceleration control element, i.e., in particular an accelerator pedal, and any resulting driver-requested acceleration torque can be taken into account. A driver-requested brake pedal torque can result from the actuation of the brake control element.Without simultaneous activation of the acceleration control, a driver-requested braking torque, i.e., a decelerating or negative driver-requested torque, can be generated. This can then be converted into a driver-requested acceleration. Similarly, a balance can be calculated from the activations of the brake control and the acceleration control, and from this the corresponding driver-requested torque or the corresponding acceleration torque can be determined.

[0015] 4

[0016] The driver's desired acceleration must be determined. In this context, the case where the driver's desired torque or acceleration is negative, i.e., a driver's desired braking torque or deceleration, can be considered in particular – for example, because the driver only operates the brake control but not the accelerator control, or because the driver operates the brake control more strongly than the accelerator control. For example, it can be stipulated that the procedure is only applied or only fully executed if the driver's desired torque or acceleration is negative, i.e., decelerating.

[0017] In the method according to the invention, when a target deceleration requested by the driver assistance system is detected—that is, when and as long as the driver assistance system is active—continuous monitoring for incorrect deceleration is carried out, or a monitoring device or mechanism specified for this case is activated or used to detect incorrect deceleration. For this purpose, the current actual deceleration of the vehicle is determined. An incorrect deceleration, in this case unintentional overbraking, is detected when the actual deceleration is more pronounced for more than, or at least for, a specified maximum or tolerance period, i.e., when its value is lower and therefore greater in magnitude than, or greater than, a specified deceleration threshold. The deceleration threshold can thus be a specific braking acceleration.There are various ways to determine the current actual acceleration. For example, the actual deceleration can be determined using a suitable acceleration sensor, based on a measured change in engine or wheel speed, or calculated from an actual actuator torque, or similar methods.

[0018] The target deceleration can be requested by the driver assistance system, for example, by means of a corresponding electronic signal, which can be sent, for instance, to the aforementioned drive system or an actuator of the drive system, or the like. Based on such a signal, monitoring for requested target decelerations can be carried out and the magnitude or strength of each requested target deceleration can be determined. A monitoring device or a 24.1747

[0019] 5

[0020] The monitoring mechanism for the aforementioned monitoring functions or for the detection of faulty delays can be implemented wholly or partially in hardware and / or software. For example, the monitoring devices or mechanisms can be separate control units or separate program or software modules within a control unit, a vehicle system, the drive system, or the like.

[0021] In the method according to the invention, if, or at least as long as, an actuation of the brake pedal is detected simultaneously with the requested target deceleration, the driver-requested braking torque or the corresponding driver-requested deceleration is determined, at least also based on this. The driver-requested braking torque can, for example, be additively composed of a brake pedal torque corresponding solely to the current brake pedal actuation or position, which is zero without brake pedal actuation, and a predetermined offset or foot point torque, which is different from zero without brake pedal actuation. The offset or foot point torque can, in particular, be independent of the brake pedal actuation or position. For example, the offset or foot point torque can be or include a creep torque or a recuperation torque.

[0022] The deceleration threshold is then adjusted by the amount of the corresponding driver-requested deceleration when a target deceleration requested by the driver assistance system is simultaneously present and the brake control is applied. This adjustment increases the deceleration by the amount of the corresponding driver-requested deceleration. The deceleration threshold can be a negative acceleration value, to which, for example, the negative driver-requested deceleration can be added, resulting in a new, smaller, and therefore even more negative, deceleration threshold. This adjusted deceleration threshold can then be used for monitoring and detecting incorrect deceleration based on the original deceleration threshold.This means that if the driver assistance system requests a target deceleration and the driver simultaneously operates the brake control, thus requesting or setting a driver-defined deceleration, a greater deceleration is permissible before an incorrect deceleration is detected than if only the driver assistance system is active. 24.1747.

[0023] 6

[0024] In the method according to the invention, when a false delay is detected, at least one predetermined safety measure is triggered or executed. Such a safety measure can, for example, include a specific activation of the driver assistance system and / or the drive system, or the like.

[0025] With previous approaches, simultaneous activity of the driver assistance system and the driver could ultimately lead to the erroneous or unnecessary detection of a false deceleration within a very short time. The present invention avoids this. Thus, by applying the present invention, situation-adapted, robust, reliable, and safe detection and handling of false decelerations can be enabled and implemented even in such situations. The present invention takes into account that a driver-initiated deceleration determined by actuating the brake control element is generally secured with integrity, i.e., for example, according to ASIL C or ASIL D, and is therefore known. A corresponding portion of the actual deceleration, i.e., the total deceleration of the vehicle, can therefore be classified as normal and thus not considered a false deceleration.Therefore, this component must not and should not consume a safety buffer defined by the unchanged deceleration threshold used when the driver assistance system is the sole active entity. By adjusting the deceleration threshold accordingly, by precisely the driver-requested deceleration signaled by the driver via the brake control, the system's ability to reliably monitor for errors in setting the desired deceleration, even when both the driver assistance system and the driver are active simultaneously.

[0026] In a possible further development of the present invention, the safety measure deactivates the influence of the driver assistance system on the actual deceleration of the motor vehicle. In other words, the safety measure can ensure that the driver assistance system can no longer request target decelerations or that target decelerations requested by the driver assistance system are no longer implemented, i.e., no longer set, for example, by means of the drive system or a corresponding actuator. (See 24.1747)

[0027] 7. For example, the driver assistance system can be at least partially deactivated. Similarly, a signal or data connection or torque path from the driver assistance system to the drive system, the corresponding actuator, an actuator control unit, or the like can be interrupted. Likewise, the drive system or the actuator control unit can be controlled or configured by or as a safety measure to ignore or reject deceleration requests from the driver assistance system. However, driver-requested decelerations requested by the driver via the brake control can still be implemented, if necessary. It can also be provided that the drive system is completely or partially deactivated by or as a safety measure, and, for example, the vehicle is automatically brought to a standstill.This allows for the handling of a particularly large number of different errors and their causes. Overall, the embodiment of the present invention proposed here enables the reliable handling of errors that lead to delays.

[0028] In a further possible embodiment of the present invention, the deceleration threshold is changed only in a cooperative or additive operating mode of the motor vehicle. In this cooperative or additive operating mode, both the target deceleration requested by the driver assistance system and the driver-initiated deceleration indicated by the driver through actuation of the brake control contribute to the actual deceleration set – for example, by means of the drive system or a corresponding actuator of the motor vehicle. This can mean, in particular, that even if a target deceleration requested by the driver assistance system is currently being set, actuation of the brake control by the driver leads directly to a greater actual deceleration, especially regardless of the force or extent of the actuation of the brake control.The brake control element therefore does not, for example, first have to bridge or traverse a free travel distance until the driver-requested deceleration matches the target deceleration requested by the driver assistance system before the driver-requested deceleration has an influence on the actual total or actual deceleration. 24.1747.

[0029] 8

[0030] Such a cooperative or additive operating mode can be useful in various situations and, for example, allow the driver to control or influence the actual deceleration more quickly by avoiding the learning path.

[0031] The present invention can be particularly effective in this cooperative or additive operating mode. In other operating modes, where, for example, only the target deceleration requested by the driver assistance system or only the driver-requested deceleration is applied, either always or only during transition phases, other criteria for detecting incorrect decelerations, and thus a different monitoring device or mechanism, can be used. Overall, this allows for the implementation of a detection and handling of incorrect decelerations or incorrect accelerations that is tailored and optimized for the respective operating mode, and therefore, for example, particularly robust, accurate, and reliable.

[0032] In a possible further development of the present invention, the cooperative or additive operating mode is detected based on a corresponding request from the driver assistance system. In other words, the driver assistance system can signal that this additive operating mode should be used. For this purpose, the driver assistance system can, for example, send a corresponding control signal to the drive system or actuator control unit mentioned elsewhere and / or to a vehicle system configured to execute the method according to the invention. This allows the additive operating mode and the corresponding detection of false delays to be used particularly reliably and as needed.For example, the driver assistance system or driver assistance functions implemented by it for longitudinal guidance of the vehicle may be designed for specific operating modes or may include potentially elaborate and complex logic for deciding which operating mode to use. In the further development of the present invention proposed here, this need not be replicated outside the driver assistance system.

[0033] In another possible embodiment of the present invention, the deceleration threshold is predetermined as a function of speed. In other words, the deceleration threshold can change with the speed of the motor vehicle relative to its surroundings. For example, the 24.1747

[0034] 9

[0035] The deceleration threshold can be defined by a speed-dependent formula or function, or a corresponding characteristic curve, map, or table assigning different values ​​or magnitudes of the deceleration threshold to different speeds can be defined. This allows for consideration of the fact that the same deceleration, i.e., the same braking acceleration, can have different effects at different speeds. For example, relatively strong deceleration at relatively high speeds can pose a greater risk of rear-end collisions than at lower speeds. The proposed embodiment of the present invention thus enables a particularly robust and situation-appropriate, or practically relevant, classification of decelerations as inappropriate decelerations.

[0036] In a possible further development of the present invention, the deceleration threshold for a higher vehicle speed relative to the environment is greater in magnitude than for a lower vehicle speed relative to the environment. At a higher vehicle speed, an inappropriate deceleration can therefore be detected even with a less pronounced actual deceleration than at a lower speed. Thus, at lower vehicle speeds, larger decelerations, i.e., stronger decelerations, may be permissible and therefore not be recognized or classified as inappropriate deceleration compared to higher speeds. This can apply at least outside of emergency braking maneuvers.With the further development of the present invention proposed here, correspondingly strong braking maneuvers can be permitted, for example, in urban traffic, where sudden stops are often necessary due to the greater lack of visibility compared to highways. This is possible without compromising safety due to the comparatively low absolute and relative speeds of road users in such situations.

[0037] In another possible embodiment of the present invention, the driver request delay is determined in a manner that ensures compliance with at least ASIL C, and in particular with ASIL D. For example, the actuation of the brake control element 24.1747

[0038] 10. First, a driver-requested braking torque can be displayed or set, from which the corresponding driver-requested deceleration can then be calculated in a correspondingly secure or redundant manner. The correspondingly secure or safe determination of the driver-requested deceleration can be implemented particularly easily and with minimal effort, since the driver himself serves as both the cause and controller of the driver-requested deceleration. It can be assumed that the driver's actuation of the brake control element is correct, i.e., desirable. Accordingly, the embodiment of the present invention proposed here allows the corresponding change in the deceleration threshold value to be carried out or permitted without reducing the integrity or the safety level of the monitoring or detection of erroneous decelerations.This allows for a particularly high level of security while simultaneously enabling situation-adapted and robust detection of false delays in a comparatively simple and cost-effective manner.

[0039] In a further possible embodiment of the present invention, the target deceleration requested by the driver assistance system is detected with a lower level of functional safety, i.e., less robustly or reliably, than the driver-initiated deceleration. In particular, the target deceleration requested by the driver assistance system can be detected with a level of reliability equivalent to ASIL QM. Accordingly, the deceleration threshold can then also be referred to as the QM threshold. By predefining the deceleration threshold and, if necessary, adjusting it based on the driver-initiated deceleration, which is easier to verify, it is still possible to achieve monitoring and detection of erroneous decelerations that is, for example, at least as reliable as ASIL C or ASIL D.This is relatively easy and inexpensive to achieve here, as it is possible to forego the requirement of the driver assistance system for a specific target deceleration, for example according to at least ASIL C.

[0040] The present invention also relates to a vehicle system for a motor vehicle. The vehicle system according to the invention has an input interface for acquiring input data. This input data can include target accelerations requested by a driver assistance system for longitudinal vehicle guidance and the actuation of a brake control element, in particular a brake pedal of the respective vehicle equipped with the vehicle system.

[0041] 11

[0042] The vehicle system according to the invention further comprises a data processing unit for processing the input data and generating corresponding control signals for triggering at least one predetermined or predefined safety measure, and an output interface for outputting the control signals. If the input data specifies driver-requested braking torques, the data processing unit can, for example, also be configured to calculate corresponding driver-requested decelerations. The vehicle system according to the invention is configured for the automatic execution of the method according to the invention.The vehicle system, in particular its data processing unit, can, for example, comprise a processor unit, such as a microprocessor, microchip, microcontroller, or the like, and a computer-readable data storage device coupled thereto. This data storage device can then, for example, contain a corresponding operating or computer program that encodes or implements the process steps, measures, or sequences described in connection with the method according to the invention, or corresponding control instructions. This operating or computer program can then be executed by means of the processor unit in order to carry out the corresponding method or to effect its execution. The vehicle system according to the invention can, in particular, be the vehicle system mentioned in connection with the method according to the invention or correspond to it.The vehicle system can therefore be, for example, a separate or independent safety or assistance system, control unit, or the like. Likewise, the vehicle system can be, for example, part of the aforementioned driver assistance system and / or part of the aforementioned drive system, or combined with or integrated into it.

[0043] The present invention also relates to a motor vehicle that is equipped both for manual longitudinal control by a driver, i.e., for the manual operating mode, and for at least assisted or at least partially automated longitudinal control by a driver assistance system, i.e., for the corresponding automated operating mode. The motor vehicle according to the invention is equipped with the vehicle system according to the invention. Accordingly, the motor vehicle according to the invention can, in particular, perform the function described in connection with the vehicle system according to the invention (24.1747).

[0044] 12

[0045] The method and / or the motor vehicle mentioned in connection with the vehicle system according to the invention, or the motor vehicle itself.

[0046] Further features of the invention may become apparent from the claims, the figures, and the description of the figures. The features and combinations of features mentioned above in the description, as well as the features and combinations of features shown below in the description of the figures and / or in the figures themselves, can be used not only in the combinations specified, but also in other combinations or individually, without departing from the scope of the invention.

[0047] The drawing shows in:

[0048] Fig. 1 shows a partial schematic representation of a motor vehicle equipped for manual and automated operation, as well as for the detection and handling of false delays; and

[0049] Fig. 2 shows an exemplary schematic flow chart for a corresponding procedure for the detection and handling of incorrect accelerations in the motor vehicle.

[0050] Unintentional or erroneous excessive acceleration and deceleration are problematic in both manual and driver assistance systems and must therefore be prevented. It should be noted that in addition to purely manual and purely driver assistance situations, cooperative operation is also possible.

[0051] Figure 1 shows a partial schematic representation of a motor vehicle 1, which can be driven longitudinally by a driver 2 in a manual operating mode and by a driver assistance system 3 in an automated operating mode. For manual driving, the motor vehicle 1 is shown here as an example with an accelerator pedal 4 and a brake pedal 5, which can be operated by the driver 2. When the accelerator pedal 4 and / or the brake pedal 5 is pressed, a corresponding signal can be sent to a drive system 6 to implement the driver's command. Likewise, the driver assistance system 3 can send signals to the drive system 6 for automated longitudinal control. The 24.1747

[0052] 13

[0053] Drive system 6 can then control the corresponding actuators to set the appropriate torques.

[0054] In principle, errors could occur, which could, for example, lead to incorrect deceleration. Incorrect deceleration can, in particular, be overbraking, i.e., the application or generation of an unintentionally or erroneously excessive deceleration. To detect and manage this, the vehicle 1 has an additional vehicle system, referred to here as safety system 7. Safety system 7 is shown separately here as an example, but it can also be integrated, for example, into the driver assistance system 3 and / or the drive system 6.

[0055] In this case, the safety system 7 can acquire or receive data or signals via an interface 8. These data or signals include or describe longitudinal control requirements signaled by the driver 2 through the actuation of the accelerator pedal 4 and / or the brake pedal 5, as well as longitudinal control requirements originating from the driver assistance system 3. Depending on the implementation, the longitudinal control requirements generated by the driver 2 can, for example, be or specify driver-requested torques corresponding to pedal actuations or driver-requested accelerations calculated from them. In the former case, the safety system 7 can, for example, convert the driver-requested torques into driver-requested accelerations. Similarly, the safety system 7 can, for example, receive data or signals from sensors such as an acceleration sensor and / or an engine or wheel speed sensor, and / or the like.

[0056] To process the data or signals, the safety system 7 also schematically includes a processor 9 and a computer-readable data storage device 10 coupled to it. The safety system 7 is configured to detect incorrect decelerations based on the acquired or received data or signals and to execute a corresponding predefined safety measure in the event of an incorrect acceleration. This may, for example, involve deactivating or passivating the driver assistance system 3 and / or the drive system 6. If necessary, the safety system 7 may also be configured, for example, to issue a corresponding warning or notification to the driver 2 in the event of an incorrect acceleration, or to perform a 24.1747

[0057] 14. To initiate the corresponding output, for example, to control a corresponding output device.

[0058] In a cooperative or additive operating mode of the motor vehicle 1 or the drive system 6, a driver-requested braking torque or a driver-requested deceleration calculated therefrom, requested by the driver 2 by actuating the brake pedal 5, and a target braking torque or a target deceleration requested by the driver assistance system 3 can be added together in whole or in part to determine a total braking torque or a total deceleration to be provided.

[0059] In automated operating mode, safety system 7 can perform automatic acceleration-based monitoring for and detection of false decelerations. This allows, for example, a comparison of the actual deceleration of vehicle 1 with a predefined deceleration threshold, which is particularly speed-dependent.

[0060] The basic idea here is to modify the monitoring and detection of incorrect deceleration intended for automated operating mode in situations where both the driver 2 and the driver assistance system 3 are active and the driver's desired deceleration interacts additively with the target deceleration, so that it also covers the corresponding additive operating mode, thus enabling robust and safe detection and handling of incorrect deceleration.

[0061] For this purpose, the deceleration threshold, i.e., a lower QM threshold (that is, the deceleration threshold which the actual deceleration must not fall below for longer than a specified maximum or tolerance time), is shifted towards a more negative value, i.e., towards greater deceleration, by the driver's desired deceleration, which is determined with integrity from the driver's actuation of at least the brake pedal 5. This allows a QM deceleration range, which includes decelerations that may be set indefinitely without error detection, to be extended to include the driver's desired deceleration. 24.1747

[0062] 15

[0063] To further illustrate the operation of the safety system 7, Fig. 2 shows a schematic exemplary flow chart 11 for a corresponding procedure.

[0064] In a process step S1, for example, the motor vehicle 1 or the driver assistance system 3 and the safety system 7 can be put into operation.

[0065] In process steps S2 and S3, for example, continuous monitoring can be activated or carried out in parallel on the one hand for target decelerations requested by the driver assistance system 3 and on the other hand for driver pedal operations, in particular operations of the brake pedal 5, i.e. for driver-requested decelerations.

[0066] In process step S4, it can be continuously checked, or for example, whenever a requested target deceleration and a driver-requested deceleration are present simultaneously in process steps S2 and S3, whether an additive operating mode is activated or requested. If this is not the case, the system can, for example, jump to process step S5, in which monitoring for or detection of incorrect decelerations, intended for other, non-additive operating modes, can be selected or activated.

[0067] If, however, the additive mode is active or requested, the deceleration threshold specified for the detection of erroneous decelerations, i.e., a corresponding error detection threshold, can be lowered by the driver's requested deceleration in a process step S6, thus changing it towards a stronger deceleration. For this purpose, the current speed of the vehicle 1 relative to its surroundings or in a fixed coordinate system can first be determined, and the deceleration threshold to be used as the initial value can then be determined or selected accordingly.

[0068] In process step S7, monitoring for and detection of erroneous decelerations can then be carried out using the adjusted deceleration threshold. For example, the current total or actual deceleration of vehicle 1 can be compared with the correspondingly modified deceleration threshold. 24.1747

[0069] 16

[0070] If a false delay is detected in process step S7, then in a

[0071] In process step S8, a corresponding predefined safety measure is automatically triggered or carried out by the safety system 7. This can, for example, interrupt or switch off a signal or torque path from the driver assistance system 3 to the drive system 6 or to the actuators, or at least to the brake actuators.

[0072] Overall, the examples described show how deceleration monitoring in a vehicle can be implemented in additive operation.

[0073] 24.1747

[0074] 17

[0075] Reference symbol list

[0076] 1 motor vehicle, 2 drivers

[0077] 3 Driver assistance systems

[0078] 4 Accelerator pedal

[0079] 5 Brake pedal

[0080] 6 Drive system 7 Safety system

[0081] 8 Interface

[0082] 9 processor

[0083] 10 Data storage

[0084] 11. Flowchart S1 - S8 Procedural steps

Claims

24. 1747 18 Patent claims 1. Method (11) for controlling a motor vehicle (1) which is equipped for manual longitudinal control by a driver (2) and for at least assisted longitudinal control by a driver assistance system (3), wherein during the operation of the motor vehicle (1) automatically - continuous monitoring is carried out to check for a target deceleration requested by the driver assistance system (3) and for an actuation of a brake control element (5) of the motor vehicle (1), - when a target deceleration requested by the driver assistance system (3) is detected, continuous monitoring for incorrect decelerations is carried out, for which a current actual deceleration of the motor vehicle (1) is determined and an incorrect deceleration is detected if the actual deceleration is more decelerating than a specified deceleration threshold for more than a specified tolerance time, wherein - as long as an actuation of the brake control element (5) is detected simultaneously with a requested target deceleration, a driver request deceleration is determined from this and the deceleration threshold is changed by the amount of this driver request deceleration in the direction of stronger deceleration, - if a false delay is detected, a predefined safety measure is triggered.

2. Method (11) according to claim 1 , characterized in that the safety measure deactivates the influence of the driver assistance system (3) on the actual deceleration of the motor vehicle (1).

3. Method (11) according to one of the preceding claims, characterized in that Delay threshold only in an additive operating mode of the motor vehicle (1) is modified in which both the target deceleration and the driver-requested deceleration indicated by the actuation of the brake control element (5) contribute to the actual deceleration set. 24.1747 19 4. Method (11) according to claim 3, characterized in that the additive operating mode is recognized on the basis of a corresponding request from the driver assistance system (3).

5. Method (11) according to one of the preceding claims, characterized in that the deceleration threshold is predetermined depending on the speed.

6. Method (11) according to claim 5, characterized in that the deceleration threshold for a higher speed of the motor vehicle (1) relative to the environment is greater in magnitude than for a lower speed.

7. Method (11) according to one of the preceding claims, characterized in that the driver request delay is determined in a manner that ensures compliance with at least ASIL C, in particular with ASIL D.

8. Method (11) according to one of the preceding claims, characterized in that the target deceleration requested by the driver assistance system (3) is recognized with a lower level of functional safety than the driver-requested deceleration, in particular according to ASIL QM.

9. Vehicle system (7) for a motor vehicle (1), comprising an input interface (8) for acquiring input data specifying target accelerations requested by a driver assistance system (3) for longitudinal vehicle guidance and corresponding driver-requested braking torques or driver-requested decelerations for actuation of a brake control element (5), a data processing device (9, 10) for processing the input data and generating corresponding control signals for triggering a predetermined safety measure, and a 24.1747 20 Output interface (8) for outputting the control signal, wherein the vehicle system (7) is configured to automatically execute the method (11) according to one of the preceding claims.

10. Motor vehicle (1) configured for manual longitudinal control by a driver (2) and for at least assisted longitudinal control by a driver assistance system (3) and comprising a vehicle system (7) according to claim 9.

Images