DE102015001971A1 - Method and monitoring device for monitoring driver assistance systems - Google Patents

Abstract

Method and device for monitoring a driver assistance system (2), which ensure the safe operation of different driver assistance systems (2), especially in situations in which by the driver assistance systems (2) functions are not defined functions to accidents, ie damage to the vehicle or persons involved, or functions are not executable due to faulty components. A monitoring and fallback level is specified which can identify and eliminate all error sources of driver assistance systems (2) by three independent layers (3, 4, 5).

Description

The invention relates to a method for monitoring a driver assistance system for vehicles according to independent claim 1 and to a monitoring device for monitoring a driver assistance system according to independent independent claim 5.

State of the art

Driver assistance systems have been known for some time. These take over partial functions of the vehicle guidance or the entire vehicle guidance fully automatically and independently of the driver. Since malfunction of these driver assistance systems can lead to property damage and / or personal injury, a so-called fallback level is required, which can transfer the vehicle to a safe state in the event of a malfunction. This fallback level is either taken over by the vehicle driver, ie the driver himself, or implemented by means of action plans which purposefully bring the vehicle to a standstill.

The publication DE 10 2009 050 399 A1 discloses a method for controlling the operation of a fully automatic driver assistance system of a vehicle designed for independent vehicle guidance. Upon the occurrence of a takeover condition, a driver takeover request is issued. When completed by the driver, z. B. by actuation of the steering wheel, the driver assistance system is deactivated. If the driver is not ready to take the vehicle and falls away as a fallback level, a driving intervention serving to transfer the vehicle to a safe state, in particular the standstill, is carried out as part of an action plan which contains a schedule of control commands for vehicle systems. A takeover condition is generated when system limits of the driver assistance system are exceeded. These may be functional limits, ie the area of application to be taken from the specification, system failures / system errors as well as external influences of driver assistance-system-independent vehicle components.

The publication DE 10 2010 021 591 A1 describes a method for controlling the operation of a fully automatic driver assistance system of a vehicle designed for independent vehicle guidance. A plausibility monitoring module checks under exclusive consideration of ego data (vehicle state data) and environment data, which were determined by at least one sensor and / or vehicle system, whether at least one is excluded in terms of the function of the driver assistance system error case. In the event of an error case, a driving engagement for the transfer of the motor vehicle to a safe state, in particular the standstill, is carried out as part of an action plan which contains a time sequence of control commands for vehicle systems.

In the published patent application DE 102 31 556 A1 For example, a method and apparatus for predicting motion trajectories of a vehicle to prevent or mitigate an impending collision are proposed. For prediction of the movement trajectories, only the trajectories are taken into account, in which, as a result of a combination of steering and braking intervention, the forces occurring at the wheels of the vehicle are in the range which corresponds to the maximum force that can be transmitted from the wheel to the road. In particular, in systems that provide an automatic braking and / or steering intervention to avoid a collision or reduce the severity of an accident with another object, there is an automatic braking and / or steering intervention depending on the predicted Bewegungsstrajektorien.

The patent EP 0 788 581 B1 discloses a control unit for controlling the drive unit of a vehicle, wherein two levels, a functional and a monitoring level, are created on outside of the error case mutually in their function not influencing channels within a computing element. The computing element is organized in three levels. The first level (function level) performs the calculations for performing the power control. The second level monitors this level of functionality. The third level forms a control level, which controls the monitoring level and thus the calculation element itself on the basis of a flow control. An almost arbitrary number of question / answer pairs is conceivable for the sequence control. Furthermore, a watchdog is provided, which is connected to the computing element and communicates there with the third control level.

An output line of the watchdog leads to the reset input of the computing element and, for example, to the output stage of an air supply setting or the fuel metering for stopping the drive unit in the event of a fault.

The publication DE 10 2004 056 027 A1 discloses a method for preventing collisions or for avoiding the collision strength of a vehicle, in which the speed and direction of movement of the vehicle are detected, the position of objects in the environment as well as their speed and direction of movement relative to the vehicle is detected future position of the objects is calculated and evaluated in advance and a warning is issued to a driver. Alternatively or additionally, the implementation of an automatic steering and / or braking intervention by an assistance system of the vehicle, if a collision with the object according to the evaluation without system intervention is inevitable.

Object of the invention

In contrast, it is the object of the invention to provide a method and a device, which ensure the safe operation of different driver assistance systems, especially in situations where functions are not defined by the driver assistance systems, functions to accidents, so to damage the vehicle or people involved , perform or functions are not executable due to faulty components.

Advantages of the invention

The solution to this problem is made possible by a method for monitoring at least one trained for partial or complete vehicle guidance driver assistance system according to the main claim 1 and a monitoring device for monitoring at least one trained for partial or complete vehicle guidance driver assistance system according to the independent claim 6.

Driver assistance systems are subsystems of vehicles that assist the driver in driving the vehicle by partially or entirely taking over the longitudinal and / or transverse guidance of the vehicle. From this a definition of a driver assistance system can be derived that relates to the function provided or to be achieved by the driver assistance system. Examples of such driver assistance systems are longitudinal guidance systems, such as ACC (adaptive cruise control) and stop-and-go (restricted congestion assist) systems, and lateral guidance systems, such as lane departure warning systems. These driver assistance systems are becoming increasingly complex because more and more input data has to be processed, the integrated vehicle guidance systems, such as steering, brakes or drive, are increasing in number and because the tasks of the driver assistance systems are being defined more and more comprehensively. Until recently, the traffic jam assistant was regarded as a fully automatic driver assistance system because (within defined limits) the vehicle guidance, ie longitudinal and lateral guidance, was completely taken over, the tendency is to extend the defined limits more and more and to create fully autonomous driver assistance systems, which are always on Can control the vehicle without intervention of the driver to a destination. Due to a large number of different traffic situations that have to be managed (motorway, country road, residential area), these driver assistance systems are developed step by step and implemented in the vehicle. On the one hand, during the development system errors may arise that only become noticeable in the vehicle and, on the other hand, individual driver assistance systems generate mutually contradictory commands for the longitudinal and transverse guidance, which can lead to property damage and personal injury during practical driving. Driver assistance systems must therefore be monitored.

The monitoring of driver assistance systems in the context of the present invention means both the control that all components are functional and the results or the effects of the interventions of the driver assistance systems targeted, as well as the regulation of the requirements of the driver assistance systems such that no harmful or unattractive effects of Interventions arise.

The driver assistance systems to be monitored, of which at least one of several is monitored, are designed for partial or complete vehicle guidance. Basically, the vehicle guidance consists only of a longitudinal and a transverse guidance component. The characteristics of both the amount and the direction, the resulting combinations as well as their different modes of action depending on the environment and the vehicle condition make the partial or complete vehicle guidance so complex. A partial vehicle guidance acts only on one component or only on parts of the components. For example, a brake assist can affect only the negative range (deceleration), a cruise control can affect the entire range (deceleration and acceleration) of the longitudinal guidance component. Under complete vehicle management is accordingly to understand the possibility of the action of the driver assistance system on all areas of both guide components.

Interventions in longitudinal and transverse guidance systems of the vehicle take place depending on the specifications of the driver (driver request) or independently of the driver, ie without involving the driver of the vehicle in these interventions. A simple example is the ESP (Electronic Stability Program), which has been used in vehicles for years, and selectively brakes individual wheels as a function of detected vehicle state parameters in order to prevent the vehicle from breaking away in driving-dynamic boundary situations. This takes place without the involvement of the driver, ie independently. Of course, the driver can provoke such an intervention, The procedure itself, however, runs without the driver's intervention. Usually such interventions are not even noticed by the driver. The method according to the invention can also be referred to as a method for monitoring at least one driver assistance system designed for dependent or independent vehicle guidance.

The at least one driver assistance system determines at least one vehicle guidance command in dependence on surrounding parameters detected by the vehicle associated environment sensing means and / or vehicle state parameters acquired as a function of vehicle assigned sensing means, wherein the at least one vehicle command command is formed from a target value for a longitudinal guidance or lateral guidance of the vehicle.

The vehicle guidance command determined by the driver assistance system consists of a setpoint value for a longitudinal guidance or transverse guidance. Various possibilities of practical implementation are known. The longitudinal guidance may be predetermined by a target speed and the transverse guidance may be predetermined by a target yaw angle. The specification of an acceleration and a steering angle has proven itself. These may be formed directly or indirectly by other sizes. Ultimately, these setpoints for the affected vehicle system, including actuators, z. As brakes, drive and steering, called, relevant, implement the requirements of the driver assistance system. The control-technical difference between a target speed and a (temporally limited) acceleration or a Ziellenkwinkel and a differential steering angle is familiar to the expert. He thus recognizes all dependent variables that allow a longitudinal guide and a transverse guide, as a possible setpoint. In addition, a vehicle command command, at least in principle, assigned to exactly one target value. The longitudinal and transverse guidance therefore consists of a plurality of vehicle guidance commands. Of course, a vehicle guidance command can also have a combination of a setpoint value for the longitudinal guidance and a desired value for the transverse guidance in the sense of a value pair. The skilled person will adapt the best control engineering design for the practical implementation of the respective application.

The vehicle guidance commands are determined in response to environmental parameters detected by environment detection means and vehicle condition parameters detected by vehicle condition detection means. Among the environmental parameters known as such in the prior art are both immobile environmental properties, e.g. As the road surface, the curvature of the road, the roadside development and possible infrastructure elements, such as traffic signs or traffic lights, as well as properties of the mobile environment, such as speed and direction of objects in the environment, such as other vehicles or people. The detection of the environmental parameters by means of appropriate sensors, ie by means of environment detection means, is also known. In this case, especially optical detection means, such as mono or stereo cameras, in the visible and invisible spectrum of light, but also means that measure the duration of emitted and reflected electromagnetic or acoustic radiation, such as radar, lidar and ultrasonic sensors are used. As environment detection means in a broader sense, the detection or reception of messages from other road users or infrastructure elements (car-to-X communication) as well as the determination of the current location can be counted using a navigation system. The detection of vehicle state parameters, such as speed, acceleration, yaw angle, steering angle, etc. by means of corresponding sensors associated with the vehicle, that is to say vehicle state detection means, is known to the person skilled in the art. The environment parameters and the vehicle state parameters are available in principle to each vehicle system, including the driver assistance systems, as input parameters. These can be distributed, for example, via a data bus system in the vehicle to the vehicle systems or tapped from them.

The determination of the vehicle guidance commands themselves, ie the algorithmic or heuristic combination of all relevant input parameters, the derivation of necessary reactions and the determination of the vehicle guidance commands to implement the necessary reactions, is part of the respective driver assistance system and will be considered only insofar as for the method for Monitoring the driver assistance system is necessary.

The method according to the invention for monitoring the at least one driver assistance system carries out three independent monitoring steps, namely a plausibility test, an accident test and a functionality test. Each test monitors a different perspective of the driver assistance system. The word test is to be understood as synonymous with the word monitoring. The monitoring and testing of the functionality thus means the same in the context of the present disclosure.

The plausibility test monitors the plausibility of the at least one vehicle command command by comparison with a predetermined plausible situation-dependent limit value. Not at For reasons of plausibility, the at least one vehicle guidance command is replaced by at least one adapted vehicle guidance command formed by means of a plausible target value, or the at least one vehicle command command is transmitted to actuators not assigned to the vehicle. The plausibility test monitors the function of the driver assistance system as such, ie the results it generates in the form of the vehicle guidance commands. The plausibility can, as is known in the art, be checked on the basis of defined error cases. Alternatively or additionally, the plausibility can be checked using tables, maps, functional relationships, look-up tables or the like. For this purpose, the vehicle guidance commands can be very easily compared with predetermined limit values as a function of vehicle state parameters, that is, depending on the situation. If these lie outside a defined interval, the vehicle command commands are classified as not plausible. Advantageously, the functional limits of the driver assistance system can thus additionally be monitored since, for vehicle condition parameters outside the functional limits (eg maximum speed for congestion assistant), no values are predefined for comparison and the plausibility test is necessarily negative. In the case of implausibility, the at least one vehicle command command is either replaced by the at least one adapted vehicle command command, which was formed by means of a plausible target value, or the at least one vehicle command command is not forwarded to the corresponding actuators. Of course, both can be done. The formation of the adapted vehicle guidance command by means of the plausible desired value can be carried out in such a way that fixed default standard setpoint values are used or a limit of a defined interval is used as the adjusted setpoint value. It may be a feedback to the driver assistance system, which then determines a new vehicle command command or the least one vehicle command. In the case of deactivation of the driver assistance system, a hint, a warning and / or a driver takeover request can be issued. If no driver pickup, the vehicle can be transferred to a safe state. The transfer to the safe state can trigger the activation of another driver assistance system, which continues the vehicle according to a predetermined route or spends to a standstill. In the latter case, as known in the art, a warning to the driver and to other road users, for example by car-to-car communication or by activating an optical and / or acoustic warning unit, such as hazard warning lights and horn.

The accident test generally assesses or monitors the current accident risk or probability of accident and its future development in accordance with the vehicle command instructions. The evaluation or monitoring can be done in different ways. One possibility is the monitoring or updating of the vehicle trajectory. Another possibility is the simple determination of the probability of an accident on the basis of current vehicle condition parameters. In addition to these options, a variety of other ways to monitor the risk of accidents is conceivable.

On the one hand, the accident test monitors the effects of the at least one vehicle command command implemented by at least one actuator assigned to the vehicle by matching a change in an own trajectory of the vehicle caused by the at least one vehicle command command with obstacles in the surroundings with regard to an accident risk. In the event that the predicted accident risk is above a predetermined threshold, measures to avoid accidents or to reduce the severity of accidents by appropriately corrected or replaced vehicle command instructions are initiated. The term accident test and risk of accident is to be understood in the broader sense in the context of the present disclosure. An accident can be a collision with other road users, such as other vehicles or people, but also with infrastructure elements. Furthermore, leaving the lane is also classified as an accident. Generally speaking, an accident is a situation in which the vehicle causes property damage and / or personal injury.

The monitoring of the effect of the vehicle command command, ie the effect of the vehicle command command implementing actuators that cause a change in the own trajectory, is done by adjusting the changed property trajectory with obstacles in the environment of the vehicle. This is usually achieved by the prediction of driving hoses of the vehicle and other road users and subsequent overlapping of the driving hoses. The other vehicle is a moving obstacle in that case. Immovable obstacles are determined analogously. The monitoring of the effect of the actuators preferably takes place permanently, that is to say even when no driver assistance system is active, and in this respect functions similarly to the electronic stability program. That is, regardless of other vehicle systems, the trajectory of the vehicle is regularly determined and, in relation to a model of the environment, which includes trajectories of other objects in the environment and locations of infrastructure elements or infrastructure boundaries, predicts whether there is an accident risk. With others Words, the effect of the at least one actuator ( 6 ) is monitored by adjusting a caused by the at least one vehicle command command relative change of an own trajectory of the vehicle in relation to surrounding obstacles in terms of risk of accidents. The term of the own trajectory is not to be understood in the sense of a specific technical implementation. Rather, it describes the further movement of the vehicle in space and time, regardless of a calculation or prognosis method or the type of mathematical or geometric representation. Thus, even a stationary vehicle has an own trajectory in which only spatial coordinates and temporal vehicle state parameters, such as speed and acceleration, do not change. For example, since the risk of an accident is determined as an accident probability, a simple comparison with a threshold, which is then a probability threshold, can be used to decide whether the risk of an accident is high enough to take action. Alternatively, an expected value of the accident can be predicted as an accident risk, which represents the probability of an accident with the expected damage. Finally, a criticality of the respective situation can be determined and the initiation of measures based on one or more criticality thresholds can be initiated.

On the other hand, the accident test monitors the effects of the at least one vehicle command command implemented by the at least one actuator associated with the vehicle by adjusting a change in the vehicle state parameter caused by the at least one vehicle command command with an accident risk calculated as a function of the vehicle state parameter. This can be done alternatively or in addition to the first option (trajectory monitoring). One possibility of calculating an accident risk (collision probability) as a function of the vehicle condition parameters (movement and position parameters) is described in the document which has not been previously published DE 10 2014 008 413.2 described, the content of which is hereby explicitly included in the disclosure of the present application.

In the prior art measures are still known that contribute to avoiding accidents or to reducing the severity of accidents. It is also known to stagger them, ie to escalate depending on the situation and criticality or risk of accidents. Usually, in such situations, the brakes are first brought into operative position by applying a brake pressure which does not yet produce a significant braking effect. This shortens the dead time between the command for braking and the execution. Other measures include short-term braking, so-called brake jerks to warn the driver and the like. Finally, the transition to a safe state, for example, by heavy braking and / or evasion, measure one of the highest levels of criticality. One skilled in the art will find sufficient suggestion to select the measures for avoiding accidents or reducing the severity of the accident in the context of the present invention.

The functional test monitors the functionality of vehicle components involved in determining the at least one vehicle command command. Involved vehicle components are in addition to the detection means for environment and vehicle condition parameters also involved computing units of control units and algorithms of the driver assistance system itself. In non-existent functionality of one of the vehicle components whose function is replaced by another vehicle component, so practically substituted, or disabled. Of course, both can be done. The replacement of the vehicle components can only be done if an adequate replacement component is available. Vehicle components can also be emulated or simulated by determining the input parameters of the non-functioning vehicle component from data of other vehicle components. Thus, a radar device can be classified as non-functional and the distance to an object located in front of the vehicle can be determined via a stereo camera or a defective module of a control unit can be replaced by a redundant or similar module. The driver assistance system thus continues to be supplied with distance parameters or can continue to be processed by it. In the event of deactivation of the non-functioning vehicle component, an indication, a warning and / or, if necessary, a driver acceptance request can be issued. If no driver pickup, the vehicle can be transferred to a safe state. The transfer to the safe state can trigger the activation of another driver assistance system, which continues the vehicle according to a predetermined route or spends to a standstill. In the latter case, as known in the art, a warning to the driver and to other road users, for example by car-to-car communication or by activating optical and / or acoustic warning units, such as hazard warning lights and horn.

The monitoring steps are carried out permanently. Thus, a monitoring level consisting of three layers is formed, the permanently monitor active driver assistance systems. The monitoring method can be performed on the same control unit on which the driver assistance system is performed, or on a different control unit. Also, the same or other processors may be involved in the calculation of the monitoring and vehicle guidance commands. The individual layers can be prioritized differently. Thus a passed plausibility test does not make a functional test superfluous, because the validity of the plausibility test can be correspondingly low if its statements are based on faulty vehicle condition parameters. If an accident risk is detected, however, the plausibility check is not relevant. Therefore, the monitoring level is organized in different layers, which do not run sequentially but permanently. To approve an action, however, the approval of all three layers is required in principle.

The advantage of this procedure is the provision of the monitoring and fallback levels, which recognize and eliminate all error sources of driver assistance systems by the three independent layers. This level of surveillance can be systematically developed and tested according to the requirements of functional safety. A parameterized design for adapting the monitoring level to a plurality of vehicle types is particularly advantageous. Thus, the relatively large effort and the resulting costs can be distributed to a variety of vehicles. The individual applied driver assistance systems can be heuristically developed or trained since any system errors, such as faulty algorithms, undefined driving states or contradictory interactions with vehicle guidance commands of other driver assistance systems, do not have any hazard-relevant effects on the vehicle and its surroundings. It does not require extensive testing of the driver assistance systems themselves and they do not need to know their own limits, which in turn reduces or eliminates the implementation effort driver assistance system-own plausibility value tables. This fact is also particularly advantageous because a driver assistance system can not know the plausibility values for each platform, ie not for each vehicle type. It would have had to be extensively tested on every platform. With future advancing standardization of the interfaces of sensor data, Aktorstelleingriffen and driver assistance systems, the present invention can help to develop and deploy driver assistance systems platform-independent.

The invention provides a permanent fallback level that affects the entire vehicle and not just individual driver assistance systems. Another advantage is that driver assistance systems can be tested in a simple and above all secure manner, for example in the development phase of driver assistance systems. Finally, a big advantage is that the driver assistance systems can be retrofitted. This is most easily done by a software update of the or the affected ECUs. This can also be done by third parties without jeopardizing the safety of the vehicle or the environment.

In an advantageous embodiment of the invention, all of the vehicle components accessing this vehicle component are deactivated if one of the vehicle components does not function properly. This has the advantage that other vehicle components do not make decisions or commands that would be based on wrong sensor signals or wrong calculations. This prevents future incorrect decisions or commands and saves correspondingly required capacities, such as computing power.

In a further advantageous refinement of the method according to the invention, if one of the vehicle components does not exist, and if the function of the non-functional vehicle component is replaced by another vehicle component, then this is assigned a confidence value of less than 100%. Advantageously, even further vehicle components and future monitoring tests are thereby communicated in a very simple way that a less precise component detects a condition, monitors it and / or implements measures to increase the safety. The still further vehicle components and future monitoring tests can determine safety margins on the basis of the trustworthiness. This increases the security of the overall system.

In a further advantageous embodiment of the method according to the invention is carried out in the absence of plausibility of at least one vehicle command command feedback to the driver assistance system. As a result, the driver assistance system is given the opportunity, depending on its configuration, to form the vehicle command again. Incidentally, the driver assistance system is not deactivated, since the invention advantageously advantageous embodiment of the permanent fallback level from the three layers can not be implausible vehicle control commands. This situation-based failures of the driver assistance system can be secured and the correct operation in other situations are allowed.

The object of the present invention is likewise achieved by a monitoring device for monitoring at least one driver assistance system designed for partial or complete vehicle guidance. In this context, the vehicle is assigned surroundings detection means for detecting environmental parameters, vehicle state detection means for detecting vehicle state parameters and a unit for calculating at least one vehicle guidance command as a function of the environmental parameters and the vehicle state parameters. The unit for calculating at least one vehicle command command is a control unit or a part of a control unit that determines the functions that the driver assistance system is to fulfill. It is thus the hardware part of the driver assistance system. The monitoring device of the at least one driver assistance system comprises inputs for receiving the environment parameters, the vehicle state parameters and the at least one vehicle guidance command. The monitoring device is preferably designed as a control unit which is connected to an in-vehicle control and information transmission data network, for. B. a CAN bus is connected. On the bus system, messages are distributed to all components in the vehicle. Thus, by connecting the monitoring device to the CAN bus, inputs are provided to receive the environment parameters, the vehicle state parameters, and the vehicle guidance commands because the surroundings sensing means, the vehicle state sensing means, and the at least one vehicle command commanding unit are also connected to the bus system.

The monitoring device further has a plausibility module for testing the plausibility of the at least one vehicle command command and outputting a plausibility signal. The plausibility module is part of an existing control unit, but may also represent an independent control unit and is designed to compare the at least one vehicle command command with a predetermined plausible situation-dependent limit value. The plausibility module can test the plausibility of the vehicle control commands received from the unit for calculating the at least one vehicle command command based on algorithms stored in a volatile or fixed memory system. For this purpose, the plausibility module can be associated with further volatile or non-volatile memory containing tables, maps, functional relationships, look-up tables or the like, based on which the vehicle control commands are checked by comparison for plausibility. The plausibility module outputs a plausibility signal. This is available to the monitoring device, since the plausibility module is part of this monitoring device.

In addition, the monitoring device has an accident hazard monitoring module for monitoring the accident risk of the vehicle and for outputting an accident signal. The accident hazard monitoring module is part of an existing control device, but may also represent an independent control device and is designed to compensate for a caused by the at least one vehicle command command change an auto-trajectory of the vehicle with surrounding obstacles. Based on the vehicle condition parameters and the environmental parameters, the accident hazard monitoring module can predict an accident probability for an imminent accident at any time. This predicted probability of an accident can be compared with a threshold stored in the accident hazard monitoring module itself or in a volatile or nonvolatile memory associated with the accident hazard monitoring module. As a result of this comparison, an accident signal is output by the accident hazard monitoring module, which is available to the monitoring device, since the accident hazard monitoring module is part of the monitoring device.

In addition, the monitoring device has a function monitoring module for monitoring the functionality of vehicle components and for outputting a function signal. The feature monitor module is part of an existing controller, but can also be a stand-alone controller. The function monitoring module can monitor the functionality, ie the functionality of the vehicle components associated with the vehicle, based on algorithms stored in a volatile or non-volatile memory system. As vehicle components, in addition to the monitoring apparatus and its parts, the unit for calculating the at least one vehicle guidance command, the in-vehicle control and information transmission data network, actuators for implementing the vehicle command commands, and the surroundings detection means and the vehicle condition detection means are also monitored. This monitoring is based on the given hardware-related functionality of the vehicle components and also includes connected to the vehicle components other units, such as volatile and non-volatile memory. As a result of the monitoring of the vehicle components by the function monitoring module, a function signal is output to each monitored vehicle component. This is also available to the monitoring device since the function monitoring module is part of the monitoring device.

The monitoring device further comprises a vehicle guidance command adjustment module for adapting the at least one vehicle command command in dependence on the plausibility signal and / or the accident signal and / or the function signal and for outputting at least one adapted vehicle command command. The vehicle command command adjustment module is part of an existing controller, but may also be a stand-alone controller. Based on the plausibility signal and / or the function signal and / or the accident signal, the vehicle guidance command adaptation module preferably evaluates the necessity for adapting the vehicle command command in several stages. Each level of need may be associated with an action plan that may be stored on a volatile or nonvolatile memory associated with the vehicle guidance command adjustment module. An action plan consists of one or more fixed or variable, that is, depending on the environment parameters and / or vehicle state parameters, predetermined vehicle guidance commands. Each action plan causes a different degree of interference in the vehicle control. Further details can be found in the exemplary embodiment. If necessary, the vehicle command command adjustment module outputs at least one adapted vehicle command command, which is available to the monitoring device, as the vehicle command command adjustment module is part of the monitoring device.

Finally, the monitoring device still has outputs for transmitting the at least one vehicle command command and / or the at least one adapted vehicle command command to actuators of the vehicle. The actuators serve to influence the movement of the vehicle, ie the longitudinal and / or transverse guidance. Exemplary actuators are the brakes, the drive and the steering.

Advantageously, an architecture can be created with the aid of the monitoring device, which makes it possible to identify and eliminate all possible causes of a driver assistance system in a cause-specific manner. This makes it possible to operate driver assistance systems, the use of which would lead to safety concerns in vehicles without the monitoring device according to the invention, because the fallback level is present by the monitoring device, regardless of the used or active driver assistance system. Finally, another great advantage is that, in addition to the monitoring of driver assistance systems, the monitoring device also enables the permanent monitoring of vehicle components and vehicle guidance commands given by the driver of the vehicle and carries out the corresponding action plans if recognized functional errors or a risk of an accident.

embodiment

Other features, applications and advantages of the invention will become apparent from the following description of embodiments of the invention, which are shown schematically in the figure. All described or illustrated features, alone or in any combination form the subject matter of the invention, regardless of their summary in the claims or their dependency and regardless of their formulation or representation in the description or in the drawing.

1 shows a schematic representation of the fallback level with the individual layers. On the basis of this schematic illustration, the solution according to the invention of the task of monitoring and securing driver assistance systems will be explained with the aid of several scenarios of an inner-city drive of a motor vehicle, which is equipped with the monitoring system according to the invention.

The motor vehicle has a navigation system which accesses a global positioning system and a digital map, which is stored on a motor vehicle associated memory or in a central office, wherein the navigation system in the latter case accesses the data of the digital map via a remote data transmission connection. Even if the navigation system does not route, the characteristics of the currently traveled route are read from the digital map. These include the category of the road, here in the city, the curvature of the road, the road gradient, the valid traffic rules, such as speed limits or priority rules, as well as the arrangement of infrastructure elements, such as traffic lights. In addition to the navigation system, the motor vehicle has a communication interface for communication with other road users and infrastructure elements (car-to-X communication). Furthermore, the motor vehicle is equipped with one or more radar systems, at least one camera, ultrasonic sensors and other conventional environment detection means. These partially detect the vehicle environment in a redundant manner. This allows a plausibility check of the environmental data, which will be discussed later.

Of course, the motor vehicle also has vehicle state detection means, such as wheel speed sensors, acceleration sensors for longitudinal, lateral and yaw accelerations, as well as detection means for determining the functional state of individual vehicle components, for example the Motor vehicle doors, the headlight, the direction indicator or the driver request detection means accelerator and brake pedal and other necessary for the operation of the motor vehicle and well-known sensors.

Both the environment and the vehicle condition detection means ( 1 ) present their data, namely the environment and vehicle condition parameters ( 11 ) via a data bus, preferably via a CAN data bus, all the components of the vehicle available. These, in the further course sensor data ( 11 ) data may be nominally scaled state data, such as on or off, or cardinal scaled measurements, such as specific speeds.

On the basis of the definition of a driver assistance system set out above, which aims at fulfilling the function of the driver assistance system, the person skilled in the art recognizes that it is no longer expedient to regard a driver assistance system as a closed system. This perspective, which can be justified from the development history of driver assistance systems, is outdated. Were previously individual sensors, z. B. radars, for exactly one driver assistance system, z. B. Adaptive cruise control, developed and tuned, is more and more the sensor data fusion in the focus of development. The monitoring system according to the invention consequently enables holistic, function-oriented monitoring. This means that in the simplest case, the function "driving" is monitored, regardless of whether a driver prescribes all vehicle guidance commands or whether a driver assistance system automatically autonomously guides the motor vehicle.

If the motor vehicle now travels on an inner-city road that turns into a curve, for example, the function of a lane-keeping assistant is to be executed. This function can be implemented by a function algorithm ( 2 ) are implemented. This receives the sensor data ( 11 ), by a recording means ( 1 ) and sent out via the data bus. The functional algorithm ( 2 ) now determines the exact course of the roadway based on the images recorded by a camera. This determination can be made very differently by a variety of different conditions and targets. Thus, as economical as possible or as sporty as possible a curve passage may be desired. The prior art discloses a variety of possible turn-by-turn controllers. Depending on the premise of the functional algorithm ( 2 ) are vehicle guidance commands ( 12 ) generated. These consist of a longitudinal and a transverse guidance component, in the simplest case of an acceleration signal and a steering angle.

These vehicle guidance commands ( 12 ) are fed to a plausibility check. The plausibility monitoring module knows the curve radius of the curve and the speed limit from the digital map, the road condition from the signal of a rain sensor or a communication message of another vehicle, and the intrinsic speed of the motor vehicle. From these sensor data ( 11 ), the plausibility module determines whether the curve transit with the of the functional algorithm ( 2 ) predetermined vehicle guidance commands ( 12 ) is possible or plausible. Such a determination can be made relatively easily on the basis of the curve radius, the current speed and an estimate of the friction coefficient influencing conditions. In doing so, plausible vehicle guidance commands are determined, which are appropriate in the given circumstances. Do the plausible vehicle control commands determined in this way deviate by a predetermined amount from the vehicle control commands determined by the functional algorithm ( 12 ), these are replaced by the plausible vehicle control commands determined by the plausibility monitoring module. It should be noted that the deviation can be defined as a one- or two-sided interval. When cornering, too high a steering angle would be just as implausible as one too low. Are the vehicle control commands ( 12 ) are replaced by the plausible vehicle control commands, these are the valid from then on and passed on to the actuators vehicle control commands ( 13 ). Are the vehicle control commands ( 12 ) are not replaced by the plausible vehicle command commands, are those of the functional algorithm ( 2 ) determined vehicle guidance commands ( 12 ) the vehicle control commands valid from then on and to be passed on to the actuators ( 13 ).

Alternatively, in the case of implausible vehicle control commands ( 12 ) are waived their replacement. In this case, only the disclosure of these vehicle control commands is prevented. It may be a message to the driver and / or the vehicle to be placed in a safe state, which will be explained later.

In addition to the plausibility check ( 3 ) of the functional algorithm ( 2 ) determined vehicle guidance commands ( 12 ), an accident hazard monitoring ( 4 ) carried out. This can be done by predicting the impact of an actor ( 6 ) unattended vehicle guidance commands ( 12 . 13 . 14 . 15 ) or by determining an accident probability based on an analysis of the actual situation. Of course, if the motor vehicle approaches a preceding vehicle in the course of cornering, the motor vehicle must not drive onto the vehicle in front. Even if those of the functional algorithm ( 2 ) determined vehicle guidance commands ( 12 ) to an optimal Curve transit are suitable and of the plausibility monitoring ( 3 ) are considered to be plausible, at least one vehicle command ( 12 . 13 ), in the above-described case of approaching a preceding vehicle, preferably the longitudinal guide component, are adapted. The prediction of a risk of an accident, for example, by adjusting the by the vehicle control commands ( 12 . 13 ) Trajectory with (relative) trajectories of moving and non-moving objects in the vehicle environment. At an intersection of these trajectories or driving hoses a measure of the risk of accidents is determined, preferably an accident probability. If this measure is above a predetermined threshold, measures are taken to avoid accidents or to reduce the severity of the accident. These measures have the goal to put the vehicle in a safe state. This will be discussed in detail below, as already announced. It should be noted at this point that with the initiation of the measures for accident prevention the vehicle control commands ( 12 . 13 ) or completely replaced by pre-defined action plans, which in turn 14 ).

Finally, a function monitor ( 5 ) all in the determination of the vehicle command ( 12 . 13 . 14 . 15 ) carried out vehicle components. In the present example, the cameras, the navigation system including the access to the digital map, and the vehicle components involved in the function generation and monitoring would be a functional test or a function monitoring ( 5 ) to undergo. The functional algorithms ( 2 ), Plausibility monitoring ( 3 ) and accident hazard monitoring ( 4 ) must be checked for functional hardware and software. In the absence of functionality, if possible, a substitute component is selected which takes over the task of the non-functioning vehicle component. Often redundant components are provided in motor vehicles. By fusion of the sensor data ( 11 ), a slight malfunction in the detection means ( 1 ) are compensated. Thus, in the event of a camera failure, lane information, preferably the lane course, can be determined based on combined data from the digital map, the positioning system, and communication messages from a car-to-X communication network, if there is no redundant camera. This combination of data is meaningful enough by the combination of suitable data to provide a plausibility check ( 3 ). In connection with a radar system, the significance, so the level of confidence could be high enough to within certain limits, for. B. a maximum speed of 60 km / h, an accident hazard monitoring ( 4 ). Should a compensation of the function of individual vehicle components not be possible or not provided, the affected vehicle component is deactivated. This can be done next to built-in sensors ( 1 ) and actuators ( 6 ) also the functional algorithm ( 2 ) as well as the plausibility check ( 3 ) and accident hazard monitoring ( 5 ) yourself. If a vehicle component is deactivated, it can be separated from the communication connection within the vehicle data bus system on the hardware side. Alternatively or additionally, the vehicle component can be deactivated by markers on the software side. If further vehicle components, which are not involved in the function currently to be implemented, also access the non-functioning vehicle component, these further vehicle components can be partially or completely deactivated.

Depending on the severity of the deviation of the plausibility check ( 3 ), the accident hazard monitoring ( 4 ) and the functionality monitoring ( 5 ) the vehicle control commands ( 12 . 13 . 14 . 15 ), vehicle components compensated or deactivated and / or executed predetermined action plans for the transfer of the motor vehicle in a safe state. Each deviation is stored according to their criticality in a log file and / or signaled to the driver. In the case of initiating an action plan, a warning is sent to the driver and / or a takeover request. If the situation is particularly critical, the transfer of the motor vehicle to a safe state can be initiated directly in accordance with an action plan.

The safe state depends on the type and criticality of the deviation of the plausibility check ( 3 ), the accident hazard monitoring ( 4 ) and the functionality monitoring ( 5 ). With a low criticality, the safe state is due to compensation or adaptation of a sensor signal ( 11 ), a vehicle component or a vehicle command ( 12 . 13 . 14 . 15 ) reached. With a medium criticality, the safe state is achieved by a takeover by the driver. At high criticality, the safe state is achieved by automatically stopping the vehicle outside the danger zone. Action plans necessary for this include vehicle guidance commands, such as activating hazard warning lights, searching for a suitable stopping location by means of surroundings sensing means, delaying the vehicle, and actuating the steering to come to a stop at the appropriate location. These action plans need to be flexible, as simple braking and steering to the right may further increase the hazard. Therefore, these action plans are also part of the monitoring system according to the invention and are in contrast to the monitored functional algorithms of driver assistance systems implemented according to the principles of functional safety.

1 schematically shows the nesting of the individual security or monitoring layers ( 3 . 4 . 5 ) around the function algorithm ( 2 ), ie the driver assistance system. The representation of the vehicle guidance commands ( 12 . 13 . 14 . 15 ) in arrow form schematizes the necessity of running through all three security or monitoring layers ( 3 . 4 . 5 ). The invention is by no means limited to serially the individual security or monitoring layers ( 3 . 4 . 5 ) to go through. Rather, the individual monitoring tests are carried out independently of each other. Each layer must release the generated vehicle guidance commands. A prioritization of the individual layers may be provided in order to avoid safety-critical situations. Thus, after a detected failure of a significant vehicle component autonomous driving can be completely disabled. This is a plausibility check ( 3 ) obsolete. Also, through the plausibility check ( 3 ) corrected vehicle control commands ( 13 ) if the accident risk monitoring ( 4 ) detects a critical situation and the longitudinal guidance component of the vehicle command ( 12 . 13 ) such that a brake ( 6 ) is triggered. At the end, all vehicle control commands ( 12 . 13 . 14 . 15 ) and the lowest common denominator that is not critical can be selected.

LIST OF REFERENCE NUMBERS

1

detection means

2

Functional algorithm driver assistance system

3

plausibility check

4

Accident risk monitoring

5

Operability monitoring

6

actuators

11

sensor data

12-15

Vehicle guidance commands

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102009050399 A1 [0003]
• DE 102010021591 A1 [0004]
• DE 10231556 A1 [0005]
• EP 0788581 B1 [0006]
• DE 102004056027 A1 [0008]
• DE 102014008413 [0024]

Claims (6)

Method for monitoring at least one driver assistance system designed for partial or complete vehicle guidance ( 2 ), wherein the at least one driver assistance system ( 2 ) at least one vehicle command ( 12 . 13 . 14 . 15 ) as a function of surroundings detection means assigned by the vehicle ( 1 ) recorded environmental parameters ( 11 ) and / or in dependence on the vehicle condition detection means assigned by the vehicle ( 1 ) recorded vehicle condition parameters ( 11 ), wherein the at least one vehicle command command ( 12 . 13 . 14 . 15 ) is formed from a desired value for a longitudinal guide or transverse guidance of the vehicle, wherein - the plausibility of the at least one vehicle command command ( 12 . 13 . 14 . 15 ) is monitored by comparison with a predetermined plausible limit value and, if there is no plausibility, the at least one vehicle command command ( 12 . 13 . 14 . 15 ) by at least one vehicle control command adapted by means of a plausible desired value ( 12 . 13 . 14 . 15 ) and / or the at least one vehicle command command ( 12 . 13 . 14 . 15 ) not assigned to the vehicle actuators ( 6 ) and - the effect of the at least one by at least one actuator associated with the vehicle ( 6 ) implemented vehicle command command ( 12 . 13 . 14 . 15 ) is monitored with regard to an accident risk and, in the event that the predicted risk of an accident is above a predetermined threshold, measures to avoid accidents or to reduce the severity of the accident are initiated and - the functionality of when determining the at least one vehicle command ( 12 . 13 . 14 . 15 ) vehicle components involved and in the absence of functionality of one of the vehicle components whose function is replaced by another vehicle component and / or this vehicle component is deactivated. Method according to claim 1, wherein the effect of the at least one actuator ( 6 ) implemented vehicle command command ( 12 . 13 . 14 . 15 ) by adjusting one by the at least one vehicle command command ( 12 . 13 . 14 . 15 ) is monitored with respect to a risk of an accident and / or by adjusting one by the at least one vehicle command command ( 12 . 13 . 14 . 15 ) change the vehicle condition parameters ( 11 ) with a function of the vehicle condition parameters ( 11 ) calculated accident risk is monitored. Method according to claim 1 or 2, wherein, if one of the vehicle components does not function, all further vehicle components accessing this vehicle component are deactivated. The method of claim 1 or 2, wherein in the absence of functionality of one of the vehicle components and when replacing the function of the non-functional vehicle component by another vehicle component, a confidence value less than 100% is assigned. Method according to one of the preceding claims, wherein in the absence of plausibility of the at least one vehicle command command ( 12 . 13 . 14 . 15 ) a feedback to the driver assistance system ( 2 ) he follows. Monitoring device for monitoring at least one driver assistance system designed for partial or complete vehicle guidance ( 2 ), wherein the vehicle surroundings detection means ( 1 ) for acquiring environmental parameters ( 11 ) and vehicle condition detection means ( 1 ) for detecting vehicle condition parameters ( 11 ) and a unit for calculating at least one vehicle command ( 12 . 13 . 14 . 15 ) depending on the environmental parameters ( 11 ) and vehicle condition parameters ( 11 ), wherein the monitoring device - inputs for receiving the environmental parameters ( 11 ) and vehicle condition parameters ( 11 ) and the at least one vehicle command command ( 12 . 13 . 14 . 15 ), - a plausibility module for testing the plausibility of the at least one vehicle command command ( 12 . 13 . 14 . 15 ) configured to compare the at least one vehicle command command ( 12 . 13 . 14 . 15 ) with a predetermined plausible limit value and for outputting a plausibility signal, - an accident hazard monitoring module for monitoring the risk of an accident of the vehicle, designed to match one by the at least one vehicle command command ( 12 . 13 . 14 . 15 ) caused change in an own trajectory of the vehicle with obstacles located in the surrounding area and / or adapted to compensate for a by the at least one vehicle command command ( 12 . 13 . 14 . 15 ) change the vehicle condition parameters ( 11 ) with a function of the vehicle condition parameters ( 11 ) calculated accident risk and configured to output an accident signal and - a function monitoring module for monitoring the functionality of vehicle components and for outputting a function signal, wherein the monitoring device further comprises A vehicle guidance command adjustment module for adapting the at least one vehicle command command ( 12 . 13 . 14 . 15 ) in dependence on the plausibility signal and / or the function signal and / or the accident signal and for outputting at least one adapted vehicle command command ( 12 . 13 . 14 . 15 ) and outputs for transmitting the at least one vehicle command command ( 12 . 13 . 14 . 15 ) and / or the at least one adapted vehicle command command ( 12 . 13 . 14 . 15 ) on actuators ( 6 ) of the vehicle.

Images