DE102018220752B3 - METHOD, COMPUTER PROGRAM AND DEVICE FOR EVALUATING THE CRITICALITY OF A HUMAN CONTROL POSSIBILITY OF A VEHICLE THAT HAS AN AUTOMATED CONTROL SYSTEM - Google Patents

Abstract

A method and a device are described in order to assess the criticality of a human control possibility of a vehicle which has an automated control system and which is in a current state (z) at a current point in time (T0). The method comprises determining (102) a first state space (Z ') from one or more first states, into which the vehicle during a first time interval (T1) following the current time (T0) by a human controller starting from the current state ( z) can be transferred, the determination (104) of a second state space (Z ") from one or more second states into which the vehicle (200) emanates from the automated control system during a second time interval (T2) following the first time interval (T1) can be transferred from the first states of the first state space (Z '), determining (106) whether at least one criterion (K) is met, based on the second state space (Z ") and / or the first state space (Z'), if the criterion (K) is met, the non-prohibition (108) of human control of the vehicle at least for the first time interval (T1), and if the criterion (K) is not met, the prohibition en (110) the human control of the vehicle at least for the first time interval (T1). Furthermore, a vehicle with the criticality evaluation device is described.

Description

The present invention relates to the field of automated control of vehicles. Embodiments of the present invention provide a method, a computer program and a device for evaluating the criticality of a human control possibility of a vehicle, which is controlled by an automated control system ( AST ), and that at a current time ( T0 ) in a current state ( e.g. ) is located. Further embodiments of the invention provide an approach to enable manual control of a vehicle under the safety guarantees of fully automated driving.

Currently known approaches to operating a vehicle use driver assistance systems and enable so-called assisted driving, which can be seen as a precursor to autonomous or fully automated driving. Assisted driving is merely an extension of manual or human driving to support the driver in certain driving situations and thus to improve safety or comfort. However, this is not fully automated or autonomous driving, rather assisted driving serves to support the driver. The aim here is not to fulfill binding security guarantees, e.g. go beyond the assets of the human driver per se, or to take full responsibility for driving errors of the human driver through assisted driving. In fact, currently known systems assume that the human driver must recognize malfunctions in the system and possibly override them.

The DE 10 2016 202 590 A1 describes an approach for implementing a so-called driving school mode in a fully automated motor vehicle, according to which a learner driver controls the automated motor vehicle manually during driver training. During manual control, the automated driving parameters continue to be calculated in the background, and manual control of the vehicle by the learner driver alone is permitted as long as there are no critical situations. If, on the other hand, a critical situation arises, control of the motor vehicle is withdrawn from the learner driver and the motor vehicle is then automated, ie partially autonomously or autonomously operated, until the critical situation has been overcome without the driver's intervention being necessary. This approach thus offers a user of a fully automated vehicle the possibility to control the vehicle itself, ie manually, using the automated system in critical situations. However, it is only rudimentary how the critical situation could actually be recognized.

However, this approach is disadvantageous in that the motor vehicle then takes control, i.e. ends manual steering, if it is determined on the basis of the parameters calculated in the background that a critical driving situation is present without taking into account the actual behavior of the manual driver that the fully automated control system interrupts the manual control system too often due to the safety regulations to be fulfilled and / or also in situations in which the driver's behavior can still prevent a critical situation. It is also assumed that a critical driving situation is identified either by existing driver assistance systems or by a deviation between driver input and the maneuver calculated by the automated control system. On the one hand, this only allows operation in which the driver should clearly imitate the planned behavior of the automated control system, in contrast to a free driving behavior in which a wide variety of maneuvers can be safe and permitted. On the other hand, this nevertheless does not allow any direct derivation of safety guarantees for the overall system, since the criticality of the situation itself is used as a yardstick, but not the options for action of the human driver and their consequences. For example, it is possible that even in a fundamentally safe situation (such as driving close to oncoming traffic) human control must be critically assessed because problematic inputs (such as steering towards oncoming traffic) may not be prevented in time. At the same time, human control can also be permitted in critical situations if the system finds a safe resolution for every conceivable human intervention.

The DE 10 2016 117 743 A1 describes a method for evaluating a driving behavior of a driver of a motor vehicle, in which sensor data are determined using sensors of a driver assistance system of the motor vehicle during a manual driving maneuver that is carried out by the driver. On the basis of the sensor data, a movement of the motor vehicle is determined during the manual driving maneuver and the driver is provided with an output for evaluating the driving behavior as a function of the determined movement, with a driver assistance system during a parking maneuver which is carried out by the driver as the manual driving maneuver a reference movement for the parking maneuver is determined to assist the driver during parking and is compared with the determined movement during the parking maneuver and the output is provided as a function of the comparison.

The DE 10 2007 007 640 A1 describes a method for recognizing accident-critical situations and a collision avoidance system using this method, in which the surroundings of a vehicle are detected in order to recognize a vehicle-accessible space and objects, and in which a situation assessment is carried out by using a virtual lane on the basis of a few virtual support points is determined in such a way that it lies in the trafficable area, and it is judged whether and if so when the recognized objects will assume a position lying in the virtual lane. Based on this assessment, an acceleration required to avoid collisions is determined and from this and from the curvature of the virtual lane an evaluation of the criticality for vehicle guidance along the virtual lane is carried out. The virtual lane is optimized by shifting the virtual support points with regard to minimizing the criticality, and the situation is assessed as critical to the accident if the criticality after the optimization exceeds a predetermined threshold value.

The DE 10 2016 210 560 A1 describes a method for controlling a motor vehicle comprising the steps of determining an upcoming driving maneuver; sensing driver controlled control intervention in the movement of the motor vehicle; and determining automatic control intervention to perform the driving maneuver. A driver's vitality parameter is scanned; and the driver-controlled control intervention is superimposed on the automatic control intervention depending on the determined vitality parameter.

The DE 10 2016 205 508 A1 describes a longitudinal driver assistance system in a motor vehicle for controlling or regulating a drive and / or braking unit taking into account a predefined maximum permissible maximum speed, with a detection system for recognizing preceding relevant events that require an adaptation of the predefined maximum permissible maximum speed, a functional unit that is set up is to determine a first location or first point in time when a relevant event ahead is detected, based on the location of the relevant event, upon reaching which an indication of the upcoming automatic adaptation of the maximum permissible maximum speed is output to the driver, and one after the first location or to determine the first point in time to be reached or the point in time at which an intervention in the longitudinal guidance of the motor vehicle in the direction of the new maximum permissible maximum speed at the location of the relevant event ahead if there is no rejection of the automatic adaptation of the maximum permissible maximum speed initiated by the driver.

Starting from the prior art described above, the present invention seeks to provide an approach in which the takeover of control of a vehicle by an automated control system is improved in the case of manual control by a driver.

Exemplary embodiments create a principle according to which, on the one hand, several different actions by the driver can be allowed to be equivalent, and at the same time lower bounds can be defined for the safety of the overall system, which can be functionally secured under all possible actions of the driver identified as relevant. A system is thus implemented that allows flexible and direct human control, but at the same time can offer binding security guarantees that correspond to those of a purely automated system without the possibility of human control.

This object is achieved by the subject matter of the independent patent claims, and preferred refinements are defined in the subclaims.

• 1 zeigt ein Flussdiagramm, welches ein erstes Ausführungsbeispiel des erfindungsgemäßen Verfahrens darstellt;
• 2 ist eine abstrakte Darstellung eines Zustandsraums eines Fahrzeugs zur Veranschaulichung des erfindungsgemäßen Ansatzes;
• 3 illustriert Beispiele für eine kritische (3(a)) bzw. für eine unkritische (3(b)) Situation;
• 4 zeigt ein Beispiel für den Einsatz des erfindungsgemäßen Ansatzes in einer ersten Verkehrssituation;
• 5 zeigt ein Beispiel für den Einsatz des erfindungsgemäßen Ansatzes in einer zweiten Verkehrssituation;
• 6 zeigt ein Beispiel für den Einsatz des erfindungsgemäßen Ansatzes in einer dritten Verkehrssituation; und
• 7 zeigt ein schematisches Blockdiagramm eines Ausführungsbeispiels der erfindungsgemäßen Vorrichtung zur Erzeugung von Steuersignalen zum Ansteuern von Aktoren eines Fahrzeugs zum Steuern des Fahrzeugs
• 8 zeigt eine schematische Darstellung eines Fahrzeugs, welches die erfindungsgemäße Vorrichtung aus 2 umfasst;
• 9 zeigt ein Beispiel eines Computersystems, um die in den verschiedenen Ausführungsbeispielen beschriebenen Einheiten oder Module zu implementieren und um die durch diese Einheiten/Module durchgeführten Verfahrensschritte auszuführen.

Exemplary embodiments of the present invention are explained in more detail below with reference to the accompanying drawings:

• 1 shows a flow diagram illustrating a first embodiment of the method according to the invention;
• 2nd is an abstract representation of a state space of a vehicle to illustrate the approach according to the invention;
• 3rd illustrates examples of a critical ( 3 (a) ) or for an uncritical ( 3 (b) ) Situation;
• 4th shows an example of the use of the approach according to the invention in a first traffic situation;
• 5 shows an example of the use of the approach according to the invention in a second traffic situation;
• 6 shows an example of the use of the approach according to the invention in a third traffic situation; and
• 7 shows a schematic block diagram of an embodiment of the inventive device for generating control signals for actuating actuators of a vehicle for controlling the vehicle
• 8th shows a schematic representation of a vehicle, which the device according to the invention 2nd includes;
• 9 shows an example of a computer system to implement the units or modules described in the various exemplary embodiments and to carry out the method steps carried out by these units / modules.

In the following description of the preferred exemplary embodiments of the present invention, elements which are the same or have the same effect are provided with the same reference symbols.

The present invention provides, in accordance with embodiments, an approach to enabling manual control of a vehicle under the safety guarantees of fully automated driving, where the vehicle can take responsibility for safety and intervene when there is a risk of human error or critical error could come into a critical situation at a later or later moment due to your own options for action. According to the invention, the fully automated control system of the vehicle ensures that at least some of the actions of the human driver are prevented which put the vehicle into a state, e.g. could bring or transfer an impermissible or unsafe condition, hereinafter also referred to as the driving situation. The actions mentioned include, in particular, actions carried out or omitted by the human driver which would lead to the vehicle being e.g. within the reaction time of the automated control system or computer system would be transferred to a state or a driving situation that could no longer be resolved in time by the automated system in such a way that a safe state is guaranteed. However, the system not only prevents unsafe conditions, but also those states into which a vehicle can be brought by the driver and on the basis of which unsafe conditions can be reached in the event of further intervention by the driver, which are no longer resolved by the automated control system or computer system can be. For example, the system could only allow the human driver to drive into the opposite lane at 50 cm, because otherwise, e.g. From 49 cm, if the driver accidentally turns left, he could drive into oncoming traffic before the system can intervene. The distance of 49 cm from the opposite lane is therefore not per se an unsafe / impermissible condition, but a condition based on which further intervention by the driver could lead to an unsafe condition.

Embodiments of the present invention are based on a vehicle, a human driver, and an automated control system for the vehicle. Also known is a state z of the vehicle relevant to the driving task, possibly including its environment, which is in a state space Z; a model M of how the human driver can influence this state space, e.g. in the form of a probability distribution via control commands, which can also be caused by environmental perception or interior observation of the vehicle; and a model A of how the automated control system can affect vehicle condition. Finally, there is a model G which can be used to evaluate the quality of states or state spaces in Z, for example in the form of accident risks, based on other features, such as the perception of the environment. During the journey, but possibly not necessarily with the human driver in the driving task, the system according to the invention always monitors the current state z of the vehicle and uses the human behavior model M to determine a subsequent state z 'or a number of subsequent states Z', into which the human driver can bring the vehicle in the next time step or cycle or the next time steps or cycles. The system according to the invention now looks at the state space (s) "which the automated system according to model A of z 'or one or more states in Z' could achieve. According to the quality model G, the state space Z" is not of sufficient quality, e.g. Because a reliable resolution of the situation is unlikely, the system according to the invention judges that control of the vehicle should be taken over by the automated control system. In a conceivable implementation, the control of the vehicle is then technically withdrawn from the driver and transferred to the automated control system. Also conceivable, but less advantageous, is a warning to the human driver to voluntarily relinquish control of the vehicle.

According to further exemplary embodiments, the system according to the invention can also be used while the automated system is in the driving task. It applies here that the system according to the invention allows the human driver to take over the driving task if the described quality requirement for Z "is fulfilled. In other words, the responsibility remains, according to exemplary embodiments of the invention, with the vehicle, although the person controls - that is to say that Vehicle assumes responsibility to overrule people if necessary.

According to exemplary embodiments of the present invention, the automated system checks a current situation at fixed times. The system can work with a defined cycle, and cycle, for example during or after one or more cycles or cycle cycles, check the situation. If the check shows that manual control is not possible, the automated control is maintained and any actions by the human driver are overridden. If the vehicle is controlled manually at the time of the test, the manual control is ended and the automated system takes control of the vehicle and overrides the human driver. The human driver can, for example, leave a safe state space, that is, a state space that includes safe driving situations, by prolonged action or inaction. In this case, the vehicle takes control. In contrast to known approaches, according to the teachings of the present application, in addition to the parameters recorded by the vehicle, the behavior of the driver, who could drive the vehicle manually, is also taken into account, and based on actions or non-actions by the driver, it is estimated whether one critical driving situation is reached, ie whether a safe state space is left that requires the intervention of the system. The system according to the invention can also be used to inform the driver while the vehicle is driving automatically that he is currently allowed to drive himself.

According to exemplary embodiments of the present invention, it is provided that in situations in which the currently safe driving situation or the current safe state changes suddenly, the fully automated system takes over control immediately or immediately, for example in situations in which obstacles in front of the vehicle suddenly occur occur, for example in the form of people walking on the road or the like.

1 is a flowchart illustrating a first embodiment of the method according to the invention. The method serves to evaluate the criticality of a human control possibility of a vehicle that has an automated control system, i.e. the evaluation of the human control capacity of the vehicle to the extent to which human control of the vehicle endangers the human driver, possibly other persons in the vehicle Vehicle, the vehicle or objects / people in the vicinity of the vehicle. The process is based on a situation 100 in which the vehicle which has the autonomous control system is in a current state z. The situation 100 is also called the current time T0 referred to, in which the vehicle is in the current state z.

According to exemplary embodiments, the vehicle is at the point in time T0 controlled by the automated control system, at the time T0 and in state z an intervention by the human driver for manual control of the vehicle is permitted or enabled. If the human driver makes use of this possibility, the steps of the method described below are carried out in response to the detection of an intervention by the human driver. The driver interventions just mentioned, which are detected in order to initiate the steps described below, can be one or more interventions that are part of a plurality of possible interventions that are available to a driver to intervene in the control . According to exemplary embodiments, it can be provided that out of the total number of interventions that would be available to the driver to intervene in the control of the vehicle, only a subset is included in the list of possible interventions, so that in response to the detection of an intervention, part of this list is the method according to the invention is carried out.

According to other exemplary embodiments, the vehicle is at the current time T0 controlled by the human driver and the steps explained in more detail below determine whether control of the vehicle by the human driver is still permitted or is to be prevented.

At the current time T0 is in the block 102 in 1 a state space Z '(first state space) determines the one or more states z ' (first state) can have. The conditions z ' in the first state space Z ' are those states that the vehicle controls by human control based on the current state z during a time interval T1 that is the current time T0 follows, can achieve. Furthermore, as in block 104 a state space is shown Z " (second state space) determines the one or more states z " (second state) can have. The second states z " are those states that the vehicle is based on a state z ' , that is, starting from a first state, during a time interval T2 that the time interval T1 follows, can be achieved if the vehicle is controlled by an automated control system. In the block 106 is determined based on the second state space Z " and / or the first state space Z ' whether at least one criterion K is satisfied. Is the criterion K the human control of the vehicle is fulfilled at least for the first time interval T1 not forbidden, as with 108 is shown. If the criterion K is not satisfied, as in the block 110 is shown, the human control of the vehicle at least for the time interval T1 forbidden.

According to embodiments of the present invention, the first state space is determined Z ' a first model M used, which indicates the possibilities that a human driver has to the vehicle state based on the current state e.g. to influence. In the block 104 becomes a model A used the second state space Z " to determine, wherein the second model indicates the possibilities that the automated control system has to determine the vehicle state based on the first states z ' to influence. In other words, the above-mentioned models describe the possibilities of the human driver or the automated control system in order to act on the vehicle to control the same, for example to enable the vehicle to be steered in a first direction or a second direction.

• (a) Die Güte und/oder die Wahrscheinlichkeit eines oder mehrerer der Zustände des ersten und zweiten Zustandsraums, wobei die Zustände im zweiten Zustandsraum beispielsweise im Hinblick auf Sicherheit, z. B. Kollisionsfreiheit, Verkehrsregelkonformität und Ähnlichem bewertet werden können. Die Wahrscheinlichkeit der Zustände basiert darauf, mit welcher Wahrscheinlichkeit eine Situation herbeigeführt wird. Bei der herbeigeführten Situationen handelt es sich z.B. um eine unerwünschte oder kritische Situation oder um eine. erwünschte oder unkritische Situation. Betrachtet man beispielsweise eine Situation, in der ein Fahrer mit einer Grundwahrscheinlichkeit x nach rechts lenkt, und ausgehend von dort das Fahrzeug mit einer Wahrscheinlichkeit von 80% unaufhaltsam in einen Graben fährt, so ergäbe sich für den zweiten Zustand eine Wahrscheinlichkeit von nur 20%., dass das automatisierte Steuerungssystem die Situation erfolgreich auflösen kann, also die Fahrt in den Graben verhindert. In diesem Fall besteht zwar grundsätzlich die Möglichkeit, die Situation durch das automatisierte System aufzulösen, nämlich die Fahrt in den Graben zu verhindern, wofür eine hohe Güte gegeben ist, allerdings nur mit einer relativ geringen Wahrscheinlichkeit von 20%. Mit überwiegender Wahrscheinlichkeit wird auch das automatisierte System, aufgrund der anfänglichen Steuerung durch den Fahrer, nicht verhindern können, dass das Fahrzeug in den Graben fährt. Die Gesamtwahrscheinlichkeit für einen entsprechenden Unfall ergibt sich aus x multipliziert mit 80%.
• (b) Die Verkehrskonformität der Zustände gibt an, ob aktuell geltende Verkehrsregeln im Umfeld, in dem sich das Fahrzeug bewegt, eingehalten werden oder nicht. Wird ein Fahrzeug beispielsweise bereits am Tempolimit bewegt und beträgt die Wahrscheinlichkeit, dass der Fahrzeugführer das Fahrzeug weiter beschleunigt z.B. 5%, so hat bereits der erste Zustand z' eine geringe Güte, da die Verkehrsregel verletzt wird, obwohl das automatisierte Steuersystem in der Lage ist, das Fahrzeug wieder abzubremsen. Aufgrund der bereits im ersten Zustand festgestellten Regelverletzung wird das erfindungsgemäße Verfahren die Steuerung dem manuellen Fahrer entziehen, um die Beschleunigung über das Tempolimit hinaus zu unterbinden. Bei anderen Ausführungsbeispielen kann aber auch vorgesehen sein, eine kurze Tempoüberschreitung zu tolerieren.
• (c) Die Sicherheit der Zustände der ersten und zweiten Zustandsräume bedeutet, dass von dem Fahrzeug in diesen Zuständen keine Gefährdung ausgeht, so dass beispielsweise eine Unversehrtheit von Personen, Tieren und Objekten in der Umgebung des Fahrzeugs sichergestellt ist.
• (d) Die Vorhersagbarkeit der Güte der Zustände beschreibt die Erkennbarkeit bestimmter Situationen. Betrachtet man nochmals das oben erwähnte Beispiel betreffend die Fahrt in Richtung des Grabens, und nimmt an, dass der Straßenrand nicht klar erkennbar ist, so ist schwer vorhersagbar, wie ungünstig der Zustand z' nach dem anfänglichen Rechts-Lenken des Fahrers ist. Auch das automatisierte Steuersystem kann nicht erkennen, ob der bei einer weiteren Lenkung nach rechts erreichbare Zustand z" ein ungünstiger Zustand oder ein günstiger Zustand ist, der Straßenrand nicht klar erkennbar ist.
• (e) Die minimale Güte der Zustände der Zustandsräume ist die kleinste Güte aller Zustände in dem jeweiligen Zustandsraum. Beispielsweise wird die manuelle Steuerung oder Kontrolle unterbunden, sobald ein möglicher erster Zustand z' anzeigt, dass eine Person angefahren wird, was auch dann gilt, wenn andere mögliche Zustände im ersten Zustandsraum existieren, in denen niemand zu Schaden kommt. Mit anderen Worten wird gemäß Ausführungsbeispielen der Fahrereingriff nur dann erlaubt, wenn unter allen möglichen Eingriffsfolgen, also unter allen möglichen Zuständen im ersten oder zweiten Zustandsraum, auch der schlimmste Zustand hinreichend unkritisch ist, wobei Zustände mit den schlimmsten Folgen eine minimale Güte aufweisen.
• (f) Die Eignung oder Unterschiedlichkeit der ersten Zustände hinsichtlich ihrer Behandlung aus Ausgangspunkt für die automatisierte Steuerung. Die Eignung oder Unterschiedlichkeit der Zustände bedeutet, dass unterschiedliche Zustände im ersten Zustandsraum unterschiedlich gut für die Planung der weiteren Schritte geeignet sein können. Falls bestimmte Zustände ungeeignet sind, wird eine Planung ab bzw. ausgehend von diesem Zustand gar nicht erst versucht. Beispielsweise eignet sich im Fall des oben dargelegten Graben-Beispiels der Straßenrand, der nicht klar erkennbar ist, nicht gut für die nachfolgende Planung, aber ein anderer Parameter, der besser erkennbar ist, ist gut geeignet. Ferner können unterschiedliche aber ähnliche Zustände z' zu unterschiedlichen Reaktionen führen. Beispielsweise kann vor einer gelben Ampel ein Bremsen oder ein Beschleunigen bewirkt werden. Wenn das Fahrzeug erkennt, dass je nach menschlichem Verhalten zwei Zustände möglich sind, die völlig anders aufgelöst werden müssten, und die Unterscheidung zwischen den zwei Zuständen kompliziert ist, kann das Fahrzeug rechtzeitig, zum Beispiel bei Ampel-Gelb, die Steuerung übernehmen und bremsen, um zu vermeiden, sich mit der Differenzierung der Zustände beschäftigen zu müssen.

According to exemplary embodiments, this can be done in the block 106 mentioned predetermined criterion K comprise one or more criteria, and the one or more criteria may be selected from a group comprising:

• (a) The quality and / or the probability of one or more of the states of the first and second state space, the states in the second state space, for example with regard to security, e.g. B. Freedom of collision, conformity with traffic regulations and the like can be assessed. The probability of the states is based on the probability with which a situation is brought about. The situations created are, for example, an undesirable or critical situation or one. desired or uncritical situation. For example, consider a situation in which a driver has a basic probability x turns to the right, and from there the vehicle has an 80% probability of inexorably entering a ditch, the second state would have a probability of only 20% that the automated control system can successfully resolve the situation, i.e. the journey prevented in the trench. In this case, there is basically the possibility of resolving the situation by means of the automated system, namely preventing the trip into the ditch, for which there is a high quality, but only with a relatively low probability of 20%. Most likely, due to the driver's initial control, the automated system will not be able to prevent the vehicle from driving into the trench. The overall probability of a corresponding accident results from x multiplied by 80%.
• (b) The traffic conformity of the states indicates whether currently applicable traffic rules in the environment in which the vehicle is moving are observed or not. If, for example, a vehicle is already moving at the speed limit and there is a probability that the vehicle driver will accelerate the vehicle further, for example 5%, the first state already exists z ' a poor quality as the traffic rule is violated even though the automated control system is able to brake the vehicle again. On the basis of the rule violation already detected in the first state, the method according to the invention will remove the control from the manual driver in order to prevent acceleration beyond the speed limit. In other exemplary embodiments, however, provision can also be made to tolerate a brief overspeed.
• (c) The safety of the states of the first and second state spaces means that the vehicle poses no hazard in these states, so that, for example, the integrity of people, animals and objects in the vicinity of the vehicle is ensured.
• (d) The predictability of the quality of the states describes the recognizability of certain situations. If you look again at the example mentioned above regarding the drive towards the trench and assume that the roadside is not clearly recognizable, it is difficult to predict how unfavorable the condition z ' after the driver is initially turning right. Even the automated control system cannot recognize whether the state that can be reached if the steering is steered to the right z " is an unfavorable condition or a favorable condition, the roadside is not clearly recognizable.
• (e) The minimum quality of the states of the state spaces is the smallest quality of all states in the respective state space. For example, manual control or control is prevented as soon as a possible first state z ' indicates that a person is hit, which also applies if there are other possible states in the first state space in which nobody is harmed. In other words, according to exemplary embodiments, driver intervention is only permitted if all possible Interference sequences, that is, under all possible states in the first or second state space, even the worst state is sufficiently uncritical, states with the worst consequences being of minimal quality.
• (f) The suitability or difference of the first states with regard to their treatment from the starting point for the automated control. The suitability or diversity of the states means that different states in the first state space can be suitable for planning the further steps to different extents. If certain states are unsuitable, planning from or based on this state is not even attempted. For example, in the case of the ditch example set out above, the roadside that is not clearly recognizable is not well suited for subsequent planning, but another parameter that is more recognizable is well suited. Furthermore, different but similar states can occur z ' lead to different reactions. For example, braking or acceleration can be effected in front of a yellow traffic light. If the vehicle recognizes that, depending on human behavior, two states are possible that would have to be resolved completely differently and the distinction between the two states is complicated, the vehicle can take control and brake in good time, for example when the traffic light is yellow, to avoid having to deal with the differentiation of states.

According to exemplary embodiments, a quality model can be used to determine the quality as explained above, and depending on the quality obtained by the quality model, it is determined whether human control is permitted or prohibited.

According to exemplary embodiments, the second state space is considered to be sufficiently safe if the criterion is met and as critical if the criterion is not met. In the event of a critical situation, the block 108 be provided forbidding the human control of the vehicle over a time interval which extends beyond the first time interval, namely until the critical driving situation is resolved by the automated control system. In accordance with exemplary embodiments, this means that the critical driving situation has been finally or finally resolved by the automated control system. The system only returns control to the driver, for example, when the driving situation has normalized. For example, assume a situation in which the system according to the invention avoids a rear-end collision by switching to the opposite lane. In this case, the immediate cause, the collision with the vehicle in front, is resolved, but now the vehicle is in the opposite lane, so that the human driver may be confused and therefore all the more prone to making wrong decisions, and therefore the system remains in that for so long Check until it is assessed that there is now a normal driving situation again, for example if the vehicle has been stopped or has assumed another defined driving situation.

According to other exemplary embodiments, it can be provided that the automated control basically takes place over the first period T1 to maintain the period beyond, and only to allow human control again after an extended period of time, for example to avoid short-term, theoretically possible control effects by the driver, so that either manual control or automated control is permitted over defined periods.

Based on 1 was regarding the block 106 described that the determination of whether the criterion is met is based on the second state space and / or the first state space. In other words, this means that according to the first exemplary embodiments of the invention in the block 106 it is only determined on the basis of the first state space whether or not the at least one criterion is met, in accordance with second exemplary embodiments the determination as to whether the criterion is met or not is made exclusively on the basis of the second state space, and in accordance with third exemplary embodiments it is determined whether that Criterion is met or not, on the first state space and on the second state space. The exemplary embodiments just mentioned are explained in more detail below with the aid of examples.

Assessment only based on the first state space

According to the first exemplary embodiments, the assessment as to whether the criterion is met or not is made exclusively as a function of the first state space Z ' . This can occur, for example, if the damage is caused directly by the action of the human driver at the time T0 can arise even if this damage could then be resolved by the automated control system.

If one considers a scenario a follow-up drive, according to which another vehicle F is the vehicle according to the invention E follows closely, so is in the state space Z ' include the possibility that a human driver brakes. Due to the distance of the following vehicle F can the intervention be banned because the driver of the following vehicle F could scare and therefore have an accident. Although there was no real risk of a rear-end collision, because the automated control system and the vehicle react quickly enough even in the event of braking E could accelerate again, is already the possibility that the driver in the vehicle behind F frightened and involved in accidents, sufficient to classify braking as unacceptable, regardless of what the resolution options of the automated control system are.

Another scenario is a speed limit and it is assumed that the vehicle according to the invention E driving at the current speed limit of 50 km / h. Is there a possibility that the human driver can accelerate to 55 km / h if e.g. B. no acceleration-preventing mechanism (limit switch) is activated, exists in the first state space Z ' a condition z ' , which represents a speed limit violation. In such a scenario, the driver can be deprived of control, regardless of whether the automated control system is able to brake again to 50 km / h by the next point in time or in the next cycle. The damage is already in the first violation of the speed limit.

Furthermore, the criterion can be assessed in such situations solely on the basis of the states in the first state space, in which damage caused by the action is trivially recognizable inevitably, without it being necessary to check the options for action of the automated control system. In one scenario, the vehicle according to the invention drives E eg close to the right edge of the road. There is a ditch directly behind the edge of the road. Contains the state space Z ' a state z ' , in which the vehicle is appropriately steered by the driver to the right in the direction of the trench, this fact already means that further human intervention is prohibited. Due to the circumstances, for example the distance to the trench, it is immediately clear that this intervention, the possible strong steering to the right, would be fatal without it being necessary to run through the resolution options of the automated control system and so to determine, for example, that none There is a possibility of resolution.

Another scenario relates to oncoming traffic, for example when the vehicle according to the invention E drives close to the dense and fast oncoming traffic. If there is a possibility that the driver can steer oncoming traffic before the automated control system can intervene (e.g. if the reaction time of the automated system is not sufficient to prevent or resolve the situation because the distance to the oncoming traffic is too short), the steering intervention banned to the left because an accident is extremely likely and the likelihood that the automated control system could even resolve the situation would be extremely unlikely.

Assessment only based on the second state space

According to the second exemplary embodiments, the assessment is made as to whether the criterion K is satisfied, based solely on the states in the second state space Z ".

The assessment can only be carried out depending on the second state space if, for example, an intervention option cannot be resolved sufficiently well. Again, consider the scenario of a follow-up drive in which the vehicle according to the invention E a fully automated vehicle F follows at a short distance, in which, for example, no human driver is sitting, the first state space contains the possibility that the driver of E suddenly brakes, but in this case the vehicle calculates the attainable states in the second state space in order to determine whether it could accelerate vehicle E in due time taking into account all possible braking strengths and braking times in order to avoid a rear-end collision.

This assessment can show that at least one state in the second state space indicates a rear-end collision, so that the situation may not be resolved. Therefore human intervention is prohibited. In other words, it is recognized that at least one state in the second state space means a worst-case scenario (rear-end collision), so that human control is prevented. According to other exemplary embodiments, human intervention can be prohibited if the at least one state in the second state space is associated with a risk that exceeds a predetermined limit value. The risk can be determined, for example, based on the product of accident costs and the probability of occurrence. If there are no signs that the vehicle is slowing down, the potential intervention is considered extremely improbable and a ban will not be imposed, although the possibility has been recognized.

Another example scenario, in which only the states in the second state space are considered, relates to the behavior at a stop line to which a vehicle according to the invention is based E approaches. While the vehicle is on the If the stop line approaches at an intersection, the system checks at all times whether, taking into account all possible actions by the human driver, a stop in front of / on the stop line can still be achieved. The following then applies to the worst-case scenario: Is there an action that the human driver could take, e.g. B. a renewed acceleration, which can not be resolved to a stop in front of / on the stop line, ie there is the best possible resolution in the second state space in which the vehicle E nevertheless has passed the stop line, human intervention is prohibited and the automated control system takes over the stopping.

Assessment based on the first state space and the second state space

According to the third exemplary embodiments, the assessment is made as to whether the criterion is met or not depending on the first state space and on the second state space.

For example, the states in the two state spaces, viewed individually, can be unproblematic and only have a critical consequence in combination. If one again considers a speed limit as an example scenario and assumes that the vehicle according to the invention E driving at the current speed limit of 50 km / h, for example, exceeding the limit may be acceptable for a time interval or a cycle, but not for two cycles or two time intervals in succession. Should there be a state in the first state space z ' are in which the human driver can accelerate to 51 km / h, but there is no state in the second state space in which the automated control system can brake the vehicle again to 50 km / h, e.g. B. because there is a gradient, the intervention is prevented, although the respective limit violations in the two condition rooms would be individually justifiable.

In another example scenario, there is again a follow-up drive, now with a critical coefficient of friction between the vehicle and the road, for example due to a wet road. Again it is assumed that the vehicle according to the invention E a vehicle F closely follows, but now on wet roads. Contains the first state space Z ' the possibility that the driver of E suddenly brakes, the automated control system must take control and accelerate quickly in the next point in time or cycle in order to restore the safety distance. The state in the first state space Z ' is not critical because it does not result in an accident, and in the second state room Z " an uncritical condition can be reached in which the safety distance has been restored, however the combination of sudden braking and acceleration on a wet road increases the risk that the tires lose grip on the wet road, so that in the status area Z " the acceleration cannot achieve a state with a sufficient safety margin, at least not within the desired cycle or time interval.

According to exemplary embodiments, the second state space Z " also information about the previous state in the first state space Z ' include, so that, for example, in the example just mentioned regarding the follow-up drive with a critical coefficient of friction in the second state space, it could already be noted that the wheels may lose their grip.

According to further exemplary embodiments, the combination of the two state spaces can be used if the states in the individual state spaces are possibly problematic, but are still below a predetermined limit value, but the combination leads to the predetermined limit value being exceeded. If you again consider the above-mentioned example of a follow-up drive with a critical coefficient of friction, modeling using expected damage values can be used. Furthermore, the possibility of loss of liability of the wheels may already be included in the second state space. The first state space contains a state in which the driver brakes and the human driver in the following vehicle has an accident, which, for example, damages the following vehicle from e.g. Could cause 20,000 euros, but with an assumed or modeled probability of 1 / 40,000 (fright accident). The expected cost is 50 cents. Furthermore, in order to avoid the actual rear-end collision, the automated control system would have to accelerate again, with the risk of a loss of liability and, in turn, the risk of an accident. The damage to the vehicle according to the invention would be e.g. 50,000 euros, with an assumed or modeled probability but 1 / 100,000 (liability loss accident). The expected cost is also 50 cents. As a security criterion, it is envisaged that risks from a loss expectation value of 1 euro must be prevented. The risks of the frightful accident and the liability loss accident would each be below the 1 euro threshold, so that human intervention would be permitted if there was an accident risk in only one of the two places. However, the maneuver is prohibited because both in the first step and in the second step there are accident risks that exceed the total limit (the expected costs are 1 euro).

According to exemplary embodiments, it is provided that, in contrast to known, assisted or automated driving, in which the Responsibility changes between people and the assistance system, the responsibility lies with the automated system of the vehicle, so the human driver no longer has to intercept a malfunction of the assistance system. According to the invention, this enables the human driver to control the vehicle under the safety guarantees of fully automated driving, and the system is able to intercept human errors in the short term, due to the actions performed or the actions not performed, thereby enabling an average driver to perform human driver can drive almost without system interference.

According to exemplary embodiments, it is provided that the interventions of the automated control system of the vehicle are logged so that the interventions can be presented directly to the driver, for example after the journey has been completed. Furthermore, the logging can serve to issue a driver's license, depending on his current driving practice and depending on the number of system interventions, and, if necessary, to limit this to a predetermined time, for example to a shorter period of time for drivers who have a high number of System interventions, or for a longer time for drivers who cause a small number of system interventions. Thus, according to the invention, a possibility is created that the human driver can collect driving experience even in fully automated driving.

According to further exemplary embodiments, it is provided that the fully automated system cannot be overridden by the human driver.

2nd illustrates the approach according to the invention based on an abstract representation of a state space of a vehicle. The striped area C. is the area of the status area with impermissible or unsafe conditions or driving situations. The area D shows the possible actions of the human driver before the control system of the vehicle may have to react to the action due to its reaction time and must intervene accordingly. The white area A shows the area in which the human driver can still freely control the vehicle. The black area B indicates the area when the fully automated system takes the control off the human driver.

In 2nd are two example states D1 , D2 of the vehicle specified, the states D1 , D2 are represented by corresponding circles with a center. The vehicle is at the center of the conditions D1 , D2 , this is a position within the range A , The vehicle is therefore in a currently safe driving state or a currently safe driving situation and is controlled by the driver. The radius of the circle illustrates how a driver's behavior, for example a driver's reaction in a current, safe driving situation, could change the state of the vehicle. If you look at the state D1 , the system recognizes that the behavior of the driver, for example every possible reaction, changes the vehicle from the current, safe driving state to a new driving state that is in area A, that is to say is also a safe driving state, so that in the case of Condition D1 irrespective of the driver's reaction, no critical state is reached and therefore no intervention by the automated system is required. On the other hand, the condition shows D2 that one or more of the possible reactions or actions or non-actions by the driver of the vehicle in the state B can transfer in which a mistake of the human driver may not be intercepted in time, so that an intervention of the automated system is required.

Thus, according to embodiments of the invention when the situation is recognized D1 a continuation of manual control permitted, but when the situation is recognized D2 the manual control by the human driver is ended and the vehicle takes over the control or more precisely, the automated control system of the vehicle takes over the control, so that the new situation is safe in the area of the states A is in a safe state. According to exemplary embodiments, it can be provided that after the manual control has ended and after the automated control has been carried out and a new, safe position has been reached, the driver is again able to control manually.

Based on 3rd Examples of a critical (see 3 (a) ) or for an uncritical (see 3 (b) ) Situation explained. 3rd shows the range of possible states, with the dark area representing an unsafe area and the white area representing a safe area. A current state at the time T0 is shown as well as a first state space Z ' with a plurality of first states z ' that can be reached from the current state z by human control of the vehicle. In 3rd the conditions are exemplary z ₁ , z ₂ and z ₃ as the first states z ' shown. Further examples are from the first states z ₁ , z ₂ and z ₃ accessible second state spaces Z ₁ " , Z ₂ " and Z ₃ " with the respective second states z " shown.

In 3 (a) a critical situation is shown. In the current state e.g. the vehicle is in the safe area and based on the model M for human control, those in the first state space Z ' attainable states z ₁ , z ₂ and z ₃ certainly. Based on the conditions z ₁ , z ₂ and z ₃ are using the model A the accessible second status spaces for automated control Z ₁ " , Z ₂ " and Z ₃ " certainly. In the 3 (a) situation shown is critical because the human driver in the current state z a state z ₁ could drive in the first state space Z ', on the basis of which the automated system is not able, in each of the second state spaces Z ₁ " , Z ₂ " and Z ₃ " to achieve at least a safe state. This is only based on the states z ₂ ' and z ₃ 'possible. Based on the condition z ₁ are only states of the second state space lying in the unsafe area Z ₁ " reachable. Consequently, in a situation like that in 3 (a) is shown, the human driver is out of control and the automated control system takes over at the time T0 starting from the state z, the control of the vehicle or the takeover of control by the human driver is prevented. It is therefore essential that the control in state z is removed from the person, although at this point in time there are certainly human and automatic options for keeping the vehicle in the safe area the next time.

3 (b) shows an uncritical situation, since starting from every state in the first state space Z ' at least one condition a * in the second state rooms Z ₁ " to Z ₃ " accessible that is within the safe range. So the situation is not critical since all states are in the first state space Z ' can be safely resolved by the automated system. The human driver can therefore in the 3 (b) the situation shown can be left to control of the vehicle or the takeover of control by the human driver can be permitted.

4th shows an example of the use of the approach according to the invention in a situation in which the vehicle equipped with the system according to the invention 200 , which is currently controlled manually by a driver, is approaching an end of a traffic jam, wherein in 4th schematically the approaching vehicle 200 as well as the vehicles at the steering end 202 to 206 are shown. 4th shows a typical scenario in which a rear-end collision threatens at the end of a traffic jam. In 4th shows the white area A the area in which the human driver would typically brake. The vehicle 200 recognizes by means of the sensors 200a to 200d the surroundings and the vehicle at the end of the traffic jam 202 . These parameters, together with the current vehicle parameters, are the device of the invention 150 entered like this in 3rd is shown schematically. The manually controlled driver brakes the vehicle 200 ab, this is recognized via the corresponding vehicle parameters, and the system according to the invention can determine whether the braking action initiated by the driver causes the vehicle to move out of the position shown in FIG 4th presented situation in a new, uncritical driving situation within the area A is moved or transferred into it, more precisely comes to a standstill there. If this is the case, the system according to the invention allows manual control to continue. However, the system recognizes that the human driver is not responding or is insufficient, for example due to the fact that no parameters relating to the initiation of a braking action are recorded, so that the vehicle goes into the black area B would occur, the vehicle takes over control according to the invention in order to bring the vehicle to a standstill in good time. This area represents the latest opportunity in which the fully automated control system can bring the vehicle to a standstill in good time. The approach according to the invention thus ensures that the vehicle takes over control before the vehicle enters the striped area C. reached, in which the fully automated system would no longer be able to drive the vehicle 200 bring it to a standstill in time. In other words, it is relevant whether the AST can still stop, even if the person may be in C. could still stop, which would be speculative at best - the system according to the invention always plans according to exemplary embodiments in such a way that it only uses its own resolution options, which may even be worse than the best human driver imaginable.

5 shows another example of a situation in which the inventive approach can end and take over manual control of the driver. In 5 is shown a situation in which the vehicle 200 at a certain speed along a street 208 that is moving in the area 210 kinks sharply, reducing the speed of the vehicle 200 is required to prevent the vehicle from turning 210 is carried out. According to the invention, the system monitors the surroundings of the vehicle, for example the course of the road based on sensor data, for example optically recognized road signs or electronically read information from units on the roadside, or based on map information. It is also monitored whether the manual driver is driving the vehicle 200 brakes sufficiently. Unless it is determined that braking the vehicle 200 leads to a sufficient speed reduction, i.e. in the state A continuation of manual control is permitted. However, it is found that the driver has none initiates sufficient or no braking, so that a new situation in the area B manual control is ended before state B is reached, and the vehicle or its fully automated control system takes over the control and brakes the vehicle before reaching the area C. off and, if necessary, a corresponding steering, so the curve safely 210 to drive through.

6 shows yet another example of an application of the approach according to the invention at a junction, which is the vehicle 200 for example approaching at a certain speed, the in 6 shown situation is assessed as a safe driving situation. The confluence 212 can not be signposted, for example, so that the right before the left applies, i.e. in 6 shown vehicle 202 Takes precedence. Alternatively, the right-of-way regulation can be made using a corresponding traffic sign 214 , for example a stop sign, or a traffic light system 216 , a traffic light, be regulated. The vehicle 200 detects the vehicle in the case of a right-to-left regulation 202 , which is on the right of way in the direction of the confluence 212 moved, for example by V2V communication (vehicle-to-vehicle communication) with the vehicle 202 or by appropriate sensors. The vehicle also determines 200 whether the driver is responding so that the vehicle is still in the safe area due to the reaction A located. If so, for example when the driver drives the vehicle 200 slowed sufficiently so that the vehicle 202 the confluence 212 manual control can be maintained safely. However, it is recognized that the driver's reaction or non-reaction leads to the area B is achieved in which neither human behavior nor the automated system reaching the area C. and thus a collision with the vehicle 202 can prevent manual control is ended, and the vehicle 202 is moved by means of its automated control system, so that the critical situation, i.e. a collision with the vehicle 202 is avoided. Is the confluence 212 signposted, can additionally or alternatively to record the presence of the vehicle 202 the controller includes the detected traffic signs in the check, for example in the case of a stop sign 214 or a red light 216 make sure the vehicle 200 before the confluence 212 is stopped, either by the manual control of the driver who reacts accordingly, or by ending the manual control and stopping the vehicle by the autonomous or automated control of the vehicle.

According to embodiments of the present invention, prohibiting human control in the block 108 in 1 be designed differently, depending on whether the vehicle is in the current time, i.e. in the situation 100 is controlled by a human driver or by the automated control system. Will the vehicle be at the current time 100 controlled by the human driver, the control of the vehicle can be withdrawn from the human driver and at least for the first time interval T1 or longer to be transferred to the automated control system. According to other exemplary embodiments, in such a situation, at least for the first time period T1 or beyond, one or more control commands given by the human driver are not performed and control is transferred to the automated control system. According to another embodiment, the human driver can be informed that control of the vehicle is to be surrendered, and control is subsequently used for notification at least for the duration of the first time interval T1 or transferred to the automated control system for longer. According to exemplary embodiments, the above-mentioned notification of the driver can include the output of an audible, visible and / or tactile warning to the human driver, for example an acoustic signal, a display or head-up display or a vibration of the steering wheel.

If the vehicle is already in automated mode at the current time, that is to say is controlled by the automated control system, then in the block 108 maintain this automated control.

1. (a) Beschleunigung des Fahrzeugs, Abbremsung des Fahrzeugs, Lenkung des Fahrzeugs, Betätigung der Kupplung oder Gangwechsel, Aussendung von Signalen, beispielsweise Lichtsignalen, wie Blinker, Lichthupe, oder Funknachrichten, Geschwindigkeit des Fahrzeugs, Stellung des Lenkrads, Motoreinstellungen , Vorhersage der Position des Fahrzeugs in der Umgebung, Fahrstabilität des Fahrzeugs, Raddrehgeschwindigkeiten des Fahrzeugs, Beschleunigung des Fahrzeugs, Lenkraddrehgeschwindigkeit des Fahrzeugs, Gierrate des Fahrzeugs,
2. (b) Pose des Fahrers, Blickrichtung des Fahrers, Gesten oder Mimik des Fahrers, Verhalten oder Tätigkeiten des Fahrers, physiologische oder psychologische Daten des Fahrers (bspw. Konzentration, Müdigkeit, Nervosität basierend auf bspw. Elektrokardiogramm, Elektromyogramm und/oder Hautleitwert), Gesten und Mimik anderer Fahrzeuginsassen, Verhalten oder Tätigkeiten anderer Fahrzeuginsassen, Zustand der Innenraumelektronik des Fahrzeugs (bspw. Kommunikations- oder Unterhaltungselektron ik), Fahrzeuginnentemperatur,
3. (c) eine Abschätzung der Genauigkeit der genannten Parameter.

According to further exemplary embodiments, in the block 102 one or more vehicle parameters and / or the vehicle interior are monitored in order to determine one or more actions performed and / or omitted by the human driver. The following parameters can be monitored:

1. (a) Acceleration of the vehicle, braking of the vehicle, steering of the vehicle, actuation of the clutch or gear change, transmission of signals, for example light signals such as indicators, flashing lights, or radio messages, speed of the vehicle, position of the steering wheel, engine settings, prediction of the position of the Vehicle in the area, driving stability of the vehicle, Vehicle wheel rotation speeds, vehicle acceleration, vehicle steering wheel rotation speed, vehicle yaw rate,
2. (b) driver's pose, driver's line of sight, driver's gestures or facial expressions, driver's behavior or activities, physiological or psychological data of the driver (e.g. concentration, fatigue, nervousness based on e.g. electrocardiogram, electromyogram and / or skin conductance), Gestures and facial expressions of other vehicle occupants, behavior or activities of other vehicle occupants, state of the interior electronics of the vehicle (e.g. communication or entertainment electronics), vehicle interior temperature,
3. (c) an estimate of the accuracy of the parameters mentioned.

1. (a) Position eines oder mehrerer stationärer oder sich bewegender Objekte in der Umgebung des Fahrzeugs, Geschwindigkeit und Bewegungsrichtung eines sich bewegenden Objekts in der Umgebung des Fahrzeugs, Vorhersage der Position des sich bewegenden Objekts in der Umgebung des Fahrzeugs, Vorhersage der Geschwindigkeit des sich bewegenden Objekts in der Umgebung des Fahrzeugs, Vorhersage der Orientierung des sich bewegenden Objekts in der Umgebung des Fahrzeugs, geltende Verkehrsregeln, Beschaffenheit der Straßenoberfläche, Sichtverhältnisse,
2. (b) eine Abschätzung der Genauigkeit der genannten Parameter.

In further exemplary embodiments, the vehicle environment is monitored and the following parameters can be recorded, for example:

1. (a) Position of one or more stationary or moving objects in the vicinity of the vehicle, speed and direction of movement of a moving object in the surroundings of the vehicle, prediction of the position of the moving object in the surroundings of the vehicle, prediction of the speed of the moving Object in the vicinity of the vehicle, prediction of the orientation of the moving object in the vicinity of the vehicle, applicable traffic rules, condition of the road surface, visibility,
2. (b) an estimate of the accuracy of said parameters.

7 shows a schematic block diagram of an embodiment of the device according to the invention for evaluating the criticality of a human control possibility of a vehicle, which has an automated control system and which can generate control signals for actuating actuators of a vehicle for controlling the vehicle. The device 150 comprises a signal processing device 152 , which in turn comprises a plurality of modules. A first module 154 the signal processing device 152 determines whether one or more criteria for manual control of the vehicle by the driver are met, based on the second state space ( Z " ) and / or the first state space ( Z ' ), as it is based on the 1 was explained. If it is determined that manual control is possible, the module 156 manual control of the vehicle by the driver is permitted. On the other hand, in the module 154 the module determines that manual control is not possible 158 the control of the vehicle by the automated control and corresponding control signals 160 for automated control of the vehicle are generated. The device 150 gives the control signals 160 off, for example to certain actuators 162 of the vehicle, for example to bring about an acceleration or braking or steering of the vehicle, for example to move the vehicle along a specific trajectory that prevents a critical driving situation.

8th shows a schematic representation of a vehicle, for example a motor vehicle 200 which the device according to the invention 150 and which, according to the teachings according to the invention, permits manual control by a human driver which, if a critical driving situation occurs, is ended in accordance with the teachings of the present application. Further control is then carried out by the automated control system 201 of the motor vehicle 200 . The car 200 includes a plurality of sensors, of which in 8th schematically only four sensors 200a to 200d are shown at different positions of the vehicle 200 are arranged. The sensors 200a - 200d serve, for example, the vehicle and the surroundings of the vehicle 200 to detect, for example, objects in the area and their movement, speed and direction of movement. The control 150 determined based on the ambient conditions and the driving parameters of the vehicle 200 whether a specific action / non-action by the driver who is currently manually driving the vehicle is the vehicle 200 transferred from a current situation to a critical situation or to an uncritical situation.

A person skilled in the art will readily recognize many other possible applications for the approach according to the invention based on the above descriptions of the various situations, and the present invention is therefore not restricted to the exemplary embodiments described in detail above.

Exemplary embodiments were explained above using a car. However, the present invention is not limited to this, rather the approach according to the invention described above can be used in accordance with further exemplary embodiments with any other land vehicles. Furthermore, the present invention is also not based on Limited land vehicles, but can also be used in accordance with further exemplary embodiments also for water vehicles or aircraft.

Although some aspects have been described in connection with a device, it goes without saying that these aspects also represent a description of the corresponding method, so that a block or a component of a device is also to be understood as a corresponding method step or as a feature of a method step. Analogously, aspects that have been described in connection with or as a method step also represent a description of a corresponding block or details or features of a corresponding device.

The 9 shows an example of a computer system 300 , and the units or modules described above in connection with the various exemplary embodiments and the method steps carried out by these units / modules can be implemented using one or more such computer systems 300 be carried out. The computer system 300 includes one or more processors 302 , for example a special or general digital signal processor, DSP who with a communication infrastructure 304 , for example a bus or a network. The computer system 300 includes a main memory 306 , for example a random access memory, R.A.M. , and a secondary storage 308 , for example a hard drive and / or removable storage. The secondary memory can be provided to enable computer programs or other commands to be loaded into the computer system. The computer system 300 can also be a communication interface 310 have to transfer software and data between the computer system 300 and external devices. The communication can be in the form of electrical, electronic, electromagnetic, optical or other signals that can be processed by the communication interface. The communication can be wired or wireless, for example via a wire, a cable, an optical fiber or a telephone line, or wireless, for example via a radio connection, an RF connection or another communication channel 312 .

The terms “computer program medium” and “computer readable medium” are used to refer to a storage medium, for example a removable storage unit or a hard disk. The computer program product serves software to the system 300 to provide. The computer program, which is also referred to as computer logic, is in the main memory 306 and / or in secondary storage 308 saved. The computer program can also use the communication interface 310 be received. The computer program, when executed, causes the computer system 300 the present invention implements. In particular, the computer program, when executed, enables the processor 302 the processes described here, such as implementing the method according to the invention. Consequently, such a computer program can act as a controller of the computer system 300 be designated. If the approach according to the invention is implemented in the form of software, this software can be stored in a computer program product and in the computer system 300 be loaded, for example using a removable storage medium or an interface, such as the communication interface 310 .

Depending on the specific implementation requirements, exemplary embodiments of the invention can be implemented in hardware or in software. The implementation can be performed using a digital storage medium, such as a floppy disk, DVD, Blu-ray disc, CD, ROM, PROM, EPROM, EEPROM or FLASH memory, hard drive, or other magnetic or optical memory are carried out, on which electronically readable control signals are stored, which can cooperate with a programmable computer system or cooperate in such a way that the respective method is carried out. The digital storage medium can therefore be computer-readable. Some exemplary embodiments according to the invention thus comprise a data carrier which has electronically readable control signals which are able to interact with a programmable computer system in such a way that one of the methods described herein is carried out.

In general, exemplary embodiments of the present invention can be implemented as a computer program product with a program code, the program code being effective to carry out one of the methods when the computer program product runs on a computer. The program code can, for example, also be stored on a machine-readable carrier.

Other embodiments include the computer program for performing one of the methods described herein, the computer program being stored on a machine readable medium.

In other words, an exemplary embodiment of the method according to the invention is thus a computer program which has a program code for performing one of the methods described here when the computer program runs on a computer. Another exemplary embodiment of the method according to the invention is thus a data carrier (or a digital storage medium or a computer-readable medium) on which the computer program for carrying out one of the methods described herein is recorded.

A further exemplary embodiment of the method according to the invention is thus a data stream or a sequence of signals which represents the computer program for performing one of the methods described herein. The data stream or the sequence of signals can, for example, be configured to be transferred via a data communication connection, for example via the Internet.

A further exemplary embodiment comprises a processing device, for example a computer or a programmable logic component, which is configured or adapted to carry out one of the methods described herein.

Another embodiment includes a computer on which the computer program for performing one of the methods described herein is installed.

In some embodiments, a programmable logic device (e.g., a field programmable gate array, an FPGA) can be used to perform some or all of the functionality of the methods described herein. In some embodiments, a field programmable gate array may cooperate with a microprocessor to perform one of the methods described herein. In general, in some embodiments, the methods are performed by any hardware device. This can be a universally usable hardware such as a computer processor (CPU) or hardware specific to the method, such as an ASIC.

The above-described embodiments are merely illustrative of the principles of the present invention. It is to be understood that modifications and variations in the arrangements and details described herein will be apparent to those skilled in the art. Therefore, it is intended that the invention be limited only by the scope of the following claims and not by the specific details presented based on the description and explanation of the exemplary embodiments herein.

Claims (21)

Method for evaluating the criticality of a human control possibility of a vehicle (200) which has an automated control system (201), AST, and which is in a current state (z) at a current time (T0), the method following Steps comprises: (a) determining (102) a first state space (Z ') from one or more first states into which the vehicle (200) during a first time interval (T1) following the current time (T0) by a human controller starting from the current one Condition (z) is transferable, (b) determining (104) a second state space (Z ") from one or more second states into which the vehicle (200) emanates from the automated control system (201) during a second time interval (T2) following the first time interval (T1) can be transferred from the first states of the first state space (Z '), (c) determining (106) whether at least one criterion (K) is met based on the second state space (Z ") and / or the first state space (Z '), (d) if the criterion (K) is met, non-prohibiting (108) human control of the vehicle (200) at least for the first time interval (T1), and (e) if the criterion (K) is not met, prohibit (110) human control of the vehicle (200) at least for the first time interval (T1). Procedure according to Claim 1 , wherein - step (a) comprises determining the first state space (Z ') using a first model (M), the first model (M) indicating the possibilities that the human driver has to determine a vehicle state from to influence the current state (z), and - step (b) comprises determining the second state space (Z ") using a second model (A), the second model (A) indicating the possibilities offered by the automated control system (201) in order to influence a vehicle state based on the first states (z '). Method according to one of the preceding claims, in which the criterion (K) comprises one or more criteria selected from a group comprising: a quality of one or more of the second states (z ") of the second state space (Z"); - a probability of one or more of the second states (z ") of the second state space (Z"); - a quality of one or more of the states (z ') of the first state space (Z'); - a probability of one or more of the states (z ') of the first state space (Z'); - a traffic regulation conformity of one or more of the states (z ', z ") of the first or second state space (Z', Z"); - Security of one or more of the states (z ', z ") of the first or second state space (Z', Z"); a predictability of the quality of the states (z ', z ") of the first or second state space (Z', Z"); - a minimum quality of one or more of the first states (z ') of the first state space (Z'); - a minimum quality of one or more of the second states (z ") of the second state space (Z"); - A suitability or difference of one or more of the first states (z ') of the first state space (Z') with regard to their treatment as a starting point for the automated control. Method according to one of the preceding claims, in which the criterion (K) comprises a quality of the state (z ") of the second state space (Z"), wherein - Step (c) uses a quality model (G) to determine the quality of at least one state of the first and / or second state space (Z ', Z "), wherein - in step (d) human control of the vehicle (200) is not prohibited if this assessment according to the quality model (G) is of sufficient quality, and - in step (e) the human control of the vehicle (200) is prohibited if this evaluation according to the quality model (G) is not of sufficient quality. Method according to one of the preceding claims, in which in step (e) prohibiting human control of the vehicle (200) comprises: if the vehicle (200) is controlled by a human driver at the current time (T0), - removing control of the vehicle (200) from the human driver and transferring control to the automated control system (201) for the first time interval (T1), or - Not performing the control commands entered by the human driver and transferring the control to the automated control system (201) for the first time interval (T1), or Notifying the human driver that control of the vehicle (200) is to be relinquished and transferring control to the automated control system (201) for the first time interval (T1), and if the vehicle (200) is controlled by the automated control system (201) at the current time (T0), maintaining the automated control. Procedure according to Claim 5 , in which the notification of the driver comprises the output of an audible, visible and / or tactile warning to the human driver. Method according to one of the preceding claims, in which - if the criterion (K) is met, the second state space (Z ") represents sufficiently safe driving situations, and - If the criterion (K) is not met, the second state space (Z ") represents critical driving situations. Procedure according to Claim 7 , in which in step (e) human control of the vehicle (200) is prohibited for a time interval beyond the first time interval (T1) until the critical driving situation is resolved by the automated control system (201). Method according to one of the preceding claims, wherein step (a) comprises monitoring one or more vehicle parameters and / or monitoring the vehicle interior in order to determine one or more actions performed and / or omitted by the human driver. Procedure according to Claim 9 , in which the vehicle parameter and / or the parameter of the vehicle interior comprises one or more of the following parameters: - acceleration of the vehicle (200), braking of the vehicle (200), steering of the vehicle (200), actuation of the clutch or gear change, transmission of Signals, for example light signals, such as turn signals, flasher, or radio messages, speed of the vehicle (200), position of the steering wheel, or several engine settings, prediction of the position of the vehicle (200) in the vicinity, driving stability of the vehicle (200), wheel rotation speed of the vehicle (200), acceleration of the vehicle (200), steering wheel rotation speed of the vehicle (200), yaw rate of the vehicle (200), and / or - driver's pose, driver's line of sight, driver's gestures or facial expressions, driver's behavior or activities, physiological or psychological data of the driver (e.g. concentration, fatigue, nervousness based on e.g. electrocardiogram, electromyog ram and / or skin conductance), gestures and facial expressions of other vehicle occupants (200), behavior or activities of other vehicle occupants (200), state of the interior electronics of the vehicle (200), for example communication or entertainment electronics, vehicle interior temperature, and / or - an estimate of the accuracy of said parameters. The method of any preceding claim, wherein step (a) comprises monitoring one or more vehicle environment parameters. Procedure according to Claim 11 , wherein the vehicle environment parameter comprises one or more of the following parameters: - position of one or more stationary or moving objects in the surroundings of the vehicle (200), speed and direction of movement of a moving object in the surroundings of the vehicle (200), prediction of the Position of the moving object in the vicinity of the vehicle (200), prediction of the speed of the moving object in the vicinity of the vehicle (200), prediction of the orientation of the moving object in the vicinity of the vehicle (200), applicable traffic rules, nature the road surface, visibility, and / or - an estimate of the accuracy of the parameters mentioned. Method according to one of the preceding claims, in which the first state space (Z ') comprises a plurality of first states (z') and / or the second state space (Z ") comprises a plurality of second states (z"). Method according to one of the preceding claims, in which the vehicle (200) is controlled at the current time (T0) by the automated control system (201) and intervention by the human driver is permitted for manual control of the vehicle (200), in response to the To detect an intervention from a plurality of possible interventions by the human driver, steps (a) to (e) are carried out. Procedure according to one of the Claims 1 to 13 , in which the vehicle (200) is controlled by the human driver at the current time (T0). Method according to one of the preceding claims, with the following step: Log the interventions of the automated control system (201) of the vehicle (200). Computer program, comprising instructions which cause the computer to execute the program, the method according to one of the Claims 1 to 16 to execute. Device (150) for evaluating the criticality of a human control possibility of a vehicle (200), which has an automated control system (201), AST, and which is in a state (z) at a current time (T0), with: a signal processing device (152) configured to to determine (102) a first state space (Z ') into which the vehicle (200) can be transferred based on the state (z) during a first time interval (T1) following the current point in time (T0), to determine (104) a second state space (Z ") into which the vehicle (200) during a first time interval (T2) following the first time interval (T1) by the automated control system (201) starting from at least one state (z ') the first state space (Z ') can be transferred, to determine (106, 154), based on the second state space (Z ") and / or the first state space (Z '), whether at least one criterion (K) is met, if the criterion (K) is met, the human control of the vehicle (200) is not prohibited (108, 156) at least for the first time interval (T1), and if the criterion (K) is not met, prohibit (110, 158) human control of the vehicle (200) at least for the first time interval (T1). Device (150) after Claim 18 , in which the signal processing device (152) is configured to generate control signals (160) for actuating actuators (162) of the vehicle (200), for controlling the vehicle (200) by the automated control system (201). Vehicle (200), with an automated control system (201), AST; and a device (150) according to Claim 18 or 19th . Vehicle (200) after Claim 20 , in which the vehicle comprises a land vehicle, a watercraft or an aircraft.

Images