DE102019134258A1 - Method for controlling a driving function of a vehicle - Google Patents

Abstract

The invention relates to a method for controlling a driving function of a vehicle, comprising the steps of: reading in at least one driving state of the vehicle, reading in a planned vehicle trajectory, calculating a first control signal for the driving function and parameters that determine a tolerance band of the planned vehicle trajectory in such a way that the Vehicle is kept within the tolerance band of the planned vehicle trajectory by the first control signal and the driving condition of the vehicle is taken into account and a predetermined first safety level is maintained, reading in a second control signal, check whether the second control signal is suitable for the vehicle in the tolerance band of the planned vehicle trajectory hold, outputting the second control signal when the second control signal is suitable for keeping the vehicle within the tolerance band of the planned vehicle trajectory, and outputting the first control signal when the second control signal is not suitable The aim is to keep the vehicle within the tolerance band of the planned vehicle trajectory.

Description

The invention relates to a method for controlling a driving function of a vehicle, a computer program for executing the method, a machine-readable storage medium and a device for controlling a driving function of a vehicle.

State of the art

Driver assistance systems are known from the prior art, wherein the driver assistance systems can take over the control of one or more driving functions of the vehicle. The following degrees of automation can be distinguished. One speaks of assisted driving when the driver continuously performs either the transverse or the longitudinal guidance of a vehicle and the other driver's task is taken over by a system within certain limits. Semi-automated driving includes a system that takes over the lateral and longitudinal guidance for a certain period of time and / or in specific situations, but the driver must permanently monitor the system and be ready at any time to fully take over the vehicle guidance. Highly automated driving includes a system that takes over the lateral and longitudinal guidance for a certain period of time in specific situations, the driver does not have to monitor the system and, if necessary, is asked to take over the driving task with sufficient time reserve. We speak of fully automated driving when the system takes over the transverse and longitudinal guidance completely in a defined application and the driver does not have to monitor the system. It may be that the driver is requested to take over the driving task and, if this does not take place, the system changes to a system state with a minimum of risk.

In addition to these boundary conditions, which essentially affect the safety of the vehicle, it is also known from the prior art to design driver assistance systems in such a way that a vehicle controlled by the driver assistance system has a certain minimum level of driving comfort.

It is sometimes difficult to design a driver assistance system in such a way that, on the one hand, safety criteria for assisted, partially automated, highly automated or fully automated driving are complied with and, on the other hand, a certain minimum driving comfort is achieved. Furthermore, it can be difficult under certain circumstances to provide evidence that such a driver assistance system complies with the safety criteria, although the minimum driving comfort should also be achieved if possible. This is due, in particular, to the fact that control systems which are designed to maximize driving comfort are mostly complex model-based controllers, the formal mathematical proof of which with regard to stability under all possible parameter variations is often difficult.

Disclosure of the invention

One object of the invention is to provide a method for controlling a driving function of a vehicle, in which the driver assistance system outputs control commands, if possible, which are optimized with regard to driving comfort, but in which it is ensured that safety criteria are complied with. Another object of the invention is to specify a computer program for executing the method, a machine-readable storage medium with the computer program and a device for controlling a driving function of a vehicle.

These objects are achieved with the subjects of the independent claims. Advantageous further developments are specified in the dependent claims.

A method for controlling a driving function of a vehicle comprises the steps described below. First of all, at least one driving state of the vehicle is read in, for example in a first read-in step. To do this, you can use those in the publications DE 10 2008 013 102 A1 and WO 2010/009928 A1 disclosed methods and devices are applied. With regard to the determination of the driving condition, the cited documents are incorporated into the present patent application by reference. In addition, a planned vehicle trajectory is read in, for example in a second reading step. The driving status and the vehicle trajectory can be read in one after the other in any order or in parallel.

A first control signal for the driving function parameters that determine a tolerance band of the planned vehicle trajectory are then calculated in such a way that the vehicle is kept within the tolerance band of the planned vehicle trajectory by the first control signal and the driving state of the vehicle is taken into account, for example in a first calculation step . This can be done, for example, in such a way that the first control signal and the tolerance band are calculated in such a way that they can be adhered to based on the current driving state and it is taken into account that the vehicle cannot safely perform all movements based on the current driving state. In addition to determining the driving status used sensor data are used. A specified first security level is maintained during the calculation. A first control signal determined from the vehicle trajectory is therefore calculated, in which only safety criteria of the first safety level are taken into account and driving comfort is irrelevant. The first security level can be maintained in particular when the vehicle is moving within the tolerance band of the planned vehicle trajectory. The tolerance band can indicate which accelerations, driving directions or vehicle movements are classified as safe. For example, the tolerance band can define a lane or a part of a lane in which the vehicle can move without colliding with vehicles in other lanes and / or oncoming vehicles. Furthermore, the tolerance band can include executing transverse movements with a maximum transverse acceleration, the transverse acceleration being defined in such a way that the vehicle does not slip.

In addition, a second control signal is read in, for example in a third read-in step. This second control signal can be optimized with regard to driving comfort.

It is then checked whether the second control signal is suitable for keeping the vehicle within the tolerance band of the planned vehicle trajectory, for example in a checking step. If the second control signal is suitable for keeping the vehicle within the tolerance band of the planned vehicle trajectory, the second control signal is output since a movement within the tolerance band is certain. If the second control signal is not suitable for keeping the vehicle within the tolerance band of the planned vehicle trajectory, the first control signal is output. The output can take place in one output step.

The core idea of the invention is therefore to check whether a second control signal optimized with regard to driving comfort is suitable, the vehicle lies in a tolerance band of the planned vehicle trajectory determined with regard to the safety criteria, a first control signal determined with regard to the safety criteria and, if this is the case to output the control signal optimized in terms of driving comfort and otherwise to output the control signal that complies with the safety criteria. In other words, the invention is based on the idea of designing the driver assistance system in such a way that the optimization of the driving comfort is separated from the optimization with regard to the safety criteria.

The first control signal or the second control signal can include a target steering angle for lateral guidance of the vehicle, a target acceleration, a target torque that is to act on a drive axle of the vehicle, or a target braking force. In particular, the method can be used for lateral guidance of the vehicle, the first control signal or the second control signal including a target steering angle. In particular, the first control signal and the second control signal can also include all of the control options mentioned.

A computer program comprises commands which, when the computer program is executed by a computer, cause the computer to carry out the method according to the invention. The computer program can be stored on a machine-readable storage medium.

A device for controlling a driving function of a vehicle is set up to carry out the method according to the invention. It can be provided that the device has a first input, a second input and a third input as well as an output and a computing unit. The processing unit can also be referred to as a computer. The device is set up to read in at least one driving state of a vehicle via the first input and to read in a planned vehicle trajectory via the second input. The device is also set up to calculate a first control signal and parameters that determine a tolerance band in such a way that the vehicle is kept within the tolerance band of the planned vehicle trajectory by the first control signal, taking into account the driving state of the vehicle and maintaining a predetermined first safety level . Furthermore, the device is set up to read in a second control signal via the third input and to check whether the second control signal is suitable for keeping the vehicle within the tolerance band of the planned vehicle trajectory. Furthermore, the device is set up to output the second control signal when the second control signal is suitable for keeping the vehicle in the tolerance band of the planned vehicle trajectory, or to output the first control signal when the second control signal is not suitable for keeping the vehicle in the tolerance band of the planned vehicle trajectory hold.

In one embodiment of the method, the second control signal is calculated in a second calculation step. It can be provided that the driving state read in in the first read-in step and the planned vehicle trajectory read in in the second read-in step are also used to calculate the second control signal. It can be provided that this is carried out by the computing unit of the device or the device has a further computing unit for performing this computation step. In both cases it can be provided that the third input of the device is omitted and the second control signal is processed internally by the arithmetic unit or passed on from the further arithmetic unit to the arithmetic unit. Alternatively, the computing unit can have the third input.

In one embodiment of the method, the second control signal is calculated by means of a regulator, for example by means of a model-based regulator which is provided for regulating a longitudinal or transverse movement of the vehicle and which is designed to comply with at least one quality criterion. In this way, the second control signal can be optimized in terms of driving comfort without having to provide mathematical proof that safety criteria are being complied with, since this is done using the first control signal and the safety criteria or the first safety level and the comparison of the first control signal with the second control signal can be taken into account. The driving comfort can be one of several possible quality criteria.

In one embodiment of the method, the second control signal is calculated on the basis of a quality criterion. The quality criterion can be driving comfort, a maximum permitted jolt, energy requirement or another quality criterion for a vehicle movement.

In one embodiment of the method, the first control signal is calculated by means of a safety controller, the safety controller being provided for controlling the longitudinal or transverse movement of the vehicle and ensuring compliance with the predetermined first safety level using a mathematical method. The mathematical validation of the safety controller is particularly successful when this can be done exclusively on the basis of the first safety level and driving comfort or a quality criterion does not have to be complied with. If the second control signal, optimized with regard to driving comfort or quality criterion, lies within a tolerance band of the planned vehicle trajectory, it can be assumed that the control of the driving function by means of the second control signal is also safe and thus the second control signal, which is optimized with regard to driving comfort or quality criterion, can be output. Otherwise, the control takes place with regard to the first control signal that complies with the first security level.

In one embodiment of the method, the safety controller is a PID controller. For PID controllers, the strictly formal mathematical proof of the safeguarding with regard to compliance with safety criteria is easy to provide. The PID controller can be designed as a state feedback controller at the same time.

In alternative embodiments, the safety controller can be a PI controller, a PD controller, a state feedback controller or an output feedback controller. For these safety controllers, the strictly formal mathematical proof of the safeguarding with regard to compliance with safety criteria must be carried out well.

In one embodiment of the method, the specified first safety level is specified according to the ASIL standard (Automotive Safety Integrity Level). It can be the case, for example, that the first security level corresponds to the ASIL-D standard. In this case, the second control signal does not have to be optimized with regard to a safety level. If the first control signal does not correspond to the ASIL-D standard, but only to the ASIL-C standard, for example, it can be provided that the second control signal corresponds to a second safety level according to the ASIL standard, for example ASIL-A.

In one embodiment of the method, the first control signal comprises a target steering angle and / or a target acceleration and / or a target torque and / or a target braking force.

In one embodiment of the device, it also has a controller which is set up to calculate the second control signal, the controller being the one for controlling the longitudinal or lateral movement of the vehicle ( 200 ) is provided and which is designed to comply with at least one quality criterion. The device has a safety controller which is set up to calculate the first control signal, the safety controller for controlling the longitudinal or transverse movement of the vehicle ( 200 ) is provided and a mathematical method is used to ensure compliance with the specified first security level.

In this embodiment, the device can thus have two control paths that can be activated alternately, a first control path comprising the safety controller and a second control path comprising the controller, with both the controller and the safety controller for generating control signals for the longitudinal and / or Include lateral control. The safety controller and the controller are therefore designed to meet different requirements, and the controller is more complex in terms of its function than the safety controller. The The device can therefore be set up to activate the control path with the more complex controller when the requirements placed on the safety controller are also met on the second control path.

The method according to the invention or the computer program or the device according to the invention can be used in particular when the device for calculating the first control signal, i.e. the control signal optimized with regard to the first security level, is provided by a different company than the device for calculating the second control signal. For example, an automobile supplier could provide the device for controlling a driving function of a vehicle, while the further computing unit for calculating the second control signal is provided by an automobile manufacturer. The automobile manufacturer could then concentrate on optimizing the driving comfort or the quality criterion, while the automobile supplier checks the second control signals provided by the further processing unit with regard to compliance with the first safety level, thereby providing an overall safe and, as far as possible, comfortable driver assistance system.

• 1 ein Ablaufdiagramm eines Verfahrens zum Steuern einer Fahrfunktion eines Fahrzeugs;
• 2 eine Vorrichtung zum Steuern einer Fahrfunktion eines Fahrzeugs mit weiteren, innerhalb eines Fahrzeugs verbauten Vorrichtungen;
• 3 das Steuern eines Fahrzeugs auf einer Fahrbahn; und
• 4 eine weitere Vorrichtung zum Steuern einer Fahrfunktion eines Fahrzeugs.

Embodiments of the invention are explained with reference to the following drawings. In the schematic drawing show:

• 1 a flowchart of a method for controlling a driving function of a vehicle;
• 2 a device for controlling a driving function of a vehicle with further devices installed inside a vehicle;
• 3 controlling a vehicle on a roadway; and
• 4th another device for controlling a driving function of a vehicle.

1 shows a flow chart 100 a method for controlling a driving function of a vehicle. In a first reading step 101 at least one driving state of the vehicle is read in. In a second reading step 102 a planned vehicle trajectory is read in. The first reading step 101 and the second reading step 102 can be carried out simultaneously or one after the other in any order. Then in a first calculation step 103 a first control signal for the driving function and parameters that determine a tolerance band of the planned vehicle trajectory are calculated in such a way that the vehicle is kept within the planned vehicle trajectory by the first control signal, taking into account the driving state of the vehicle and maintaining a predetermined first safety level. It can be provided that the tolerance band is also secured according to strictly formal mathematical methods, for example by analyzing invariant quantities. In a third reading step 104 a second control signal is read in. In one verification step 105 it is checked whether the second control signal is suitable to keep the vehicle in the tolerance band of the planned vehicle trajectory. In one output step 106 the second control signal is output when the second control signal is suitable to keep the vehicle in the tolerance band of the planned vehicle trajectory, and the first control signal is output when the second control signal is not suitable to keep the vehicle in the tolerance band of the planned vehicle trajectory.

Also in 1 an optional second calculation step is shown 107 . In the optional second calculation step 107 the second control signal is derived from the in the first read-in step 101 read-in driving status and that in the second read-in step 102 read in planned vehicle trajectory is calculated, which is then in the third read-in step 104 is read.

In one embodiment, the second control signal is calculated in the second calculation step 107 by means of a controller, for example a model-based controller. The controller is intended to regulate a longitudinal or transverse movement of the vehicle and is designed to comply with at least one quality criterion. It can be provided that the second control signal in the second calculation step 107 is calculated using the quality criterion such as driving comfort, a maximum transverse acceleration, a maximum longitudinal acceleration, a jolt and / or an energy requirement. The controller is usually complex, so that a formal mathematical proof of the stability of the controller under all possible parameter variations is difficult. Through the verification step 105 however, it is still possible to achieve a control signal corresponding to the first security level in the output step 106 is issued.

In one embodiment, the first control signal is calculated in the first calculation step 103 by means of a safety controller, the safety controller being provided for regulating the longitudinal or transverse movement of the vehicle and ensuring compliance with the specified first safety level using a mathematical method. The mathematical formal validation of the safety controller is easier because the safety controller is not a model-based controller. Desired guarantees with regard to the first safety level of the driving function are ensured within the tolerance range of the first control signal. This desired guarantee can be, for example, a maximum permissible transverse deviation from a target trajectory. Alternatively or additionally, the desired guarantee can include that the vehicle will not skid due to the control signal or that the working range of an electronic stability program will not be left.

In one embodiment, the safety controller is a PID controller. It is particularly easy to provide a desired guarantee for this.

In one embodiment, the specified first security level is specified according to the ASIL standard. The ASIL standard is used to define safety requirements for vehicle components. It can be provided that the first security level corresponds to the ASIL-D standard. ASIL-D encompasses the highest possible safety standard so that the second control signal does not have to comply with any safety level, which is known as ASIL-QM. Alternatively, it can be provided, for example, that the first security level corresponds to ASIL-C, so that certain security risks have to be accepted. In this case it can be provided that the second control signal is calculated according to a second security level, also defined in the ASIL standard, for example according to ASIL-A.

In one embodiment, the first control signal includes a target steering angle and / or a target acceleration and / or a target torque and / or a target braking force.

2 shows an apparatus 120 for controlling a driving function of a vehicle. The device 120 has a first entrance 121 , a second entrance 122 and a third entrance 123 on. Furthermore, the device 120 an exit 124 and an arithmetic unit 125 on, with the arithmetic unit 125 with the entrances 121 , 122 , 123 and the exit 124 connected is. To the device 120 further components are arranged, which can be used to carry out the method, but not part of the device 120 are themselves. A first control unit 130 is with the first entrance 121 connected and set up to determine a driving state of the vehicle. To this end, the first control unit 130 Connections to a first sensor 131 , a second sensor 132 and a third sensor 133 on, it also being possible for more or fewer sensors to be provided. Using the sensor data from the sensors 131 , 132 , 133 the driving status is determined and then sent to the input 121 passed to from the device 120 to be processed. A second control unit 140 is set up to calculate a planned vehicle trajectory and to the second input 122 to spend. The first control unit 130 and the second control unit 140 are also equipped with a convenience control unit 150 connected, the convenience control unit 150 is set up to calculate the second control signal and this second control signal to the third input 123 the device 120 to spend. The arithmetic unit 125 the device 120 is set up to calculate a first control signal for the driving function and parameters for a tolerance band of the planned vehicle trajectory from the driving state and the planned vehicle trajectory in such a way that the vehicle is kept within the tolerance band of the planned vehicle trajectory by the first control signal, and thereby the driving state of the vehicle is taken into account and a specified first security level is observed. The arithmetic unit is also 125 set up to check the second control signal to determine whether it is in the tolerance band of the planned vehicle trajectory. If the second control signal is within the tolerance band of the planned vehicle trajectory, the output 124 the second control signal is output, otherwise the first control signal. The output via the exit 124 takes place on a third control unit 160 , which is set up to control the driving function. The arithmetic unit 125 can have the safety controller, which can be designed as a software application.

In alternative exemplary embodiments, not shown, the first control device 130 and the second control unit 140 be combined and designed as a common control unit or in the device 120 be integrated. In a further exemplary embodiment not shown, the third control device 160 into the device 120 be integrated, the output 124 then the output of a by the third control unit 160 processed control signal is used.

3 shows a vehicle 200 on a street 201 . A planned vehicle trajectory 202 should from the vehicle 200 be driven on. A tolerance band is used when calculating the first control signal 203 the planned vehicle trajectory 202 calculates within which the vehicle is 200 should move. Is that from the comfort control unit 150 calculated second control signal configured such that the vehicle 200 within the tolerance band 203 moves, the second control signal is output. Otherwise, the first control signal is output, in which it is ensured by means of mathematical methods that the vehicle is moving 200 within the tolerance band 203 emotional.

4th shows an alternative embodiment of the device 120 for controlling the driving function of a vehicle 200 , in which another arithmetic unit 126 inside the device 120 is arranged that the calculation of the second control signal by means of the first input 121 read-in driving status and that via the second input 122 read in planned vehicle trajectory 202 carries out and the result to the processing unit 125 passes on. In this case, both the calculation of the first control signal and the calculation of the second control signal are carried out by the device 120 carried out. The other arithmetic unit 126 can have the controller, which can be designed as a software application. In the in 4th The embodiment shown is not a third input 123 provided as the second control signal from the further arithmetic unit 126 directly to the computing unit 125 is passed on.

Both in the embodiment of 2 as well as in the embodiment of 4th can use the inputs 121 , 122 , 123 can be summarized, for example as a common input of a vehicle bus system. The exit 124 can also be connected to a vehicle bus system.

Although the invention has been described in detail by means of the preferred exemplary embodiments, the invention is not restricted to the examples disclosed and other variations can be derived therefrom by the person skilled in the art without departing from the scope of protection of the invention.

List of reference symbols

100

Flowchart

101

first reading step

102

second reading step

103

first calculation step

104

third reading step

105

Verification step

106

Output step

107

(optional) second calculation step

120

contraption

121

first entrance

122

second entrance

123

third entrance

124

Exit

125

Arithmetic unit

126

further arithmetic unit

130

first control unit

131

first sensor

132

second sensor

133

third sensor

140

second control unit

150

Comfort control unit

160

third control unit

200

vehicle

201

road

202

Vehicle trajectory

203

Tolerance band

QUOTES INCLUDED IN THE DESCRIPTION

This list of the documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• DE 102008013102 A1 [0007]
• WO 2010/009928 A1 [0007]

Claims (10)

A method for controlling a driving function of a vehicle, comprising the steps of: - Reading in at least one driving state of the vehicle (200); - Reading in a planned vehicle trajectory (202); - Calculating a first control signal for the driving function and parameters that determine a tolerance band (203) of the planned vehicle trajectory (202) such that the vehicle (200) is kept within the tolerance band (203) of the planned vehicle trajectory (202) by the first control signal is taking into account the driving state of the vehicle (200) and a predetermined first safety level is maintained; - Reading in a second control signal; - Checking whether the second control signal is suitable for keeping the vehicle (202) within the tolerance band (203) of the planned vehicle trajectory; - Outputting the second control signal when the second control signal is suitable for keeping the vehicle (200) in the tolerance band (203) of the planned vehicle trajectory (202), and outputting the first control signal when the second control signal is not suitable for keeping the vehicle in the tolerance band (203) to keep the planned vehicle trajectory (202). Procedure according to Claim 1 , wherein the second control signal is calculated by means of a controller which is provided for regulating a longitudinal or transverse movement of the vehicle (200) and which is designed to comply with at least one quality criterion. Method according to one of the Claims 1 to 2 , the first control signal being calculated by means of a safety controller, the safety controller being provided for controlling the longitudinal or transverse movement of the vehicle (200) and ensuring compliance with the predetermined first safety level using a mathematical method. Procedure according to Claim 3 , whereby the safety controller is a PID controller. Method according to one of the Claims 1 to 4th , whereby the specified first safety level is specified according to the ASIL standard. Method according to one of the Claims 1 to 5 , wherein the first control signal comprises a target steering angle, a target acceleration, a target torque and / or a target braking force. Computer program, comprising instructions which cause the computer program to be executed by a computer, a method according to one of the Claims 1 to 6th to execute. Machine-readable storage medium on which the computer program is based Claim 7 is stored Device (120) for controlling a driving function of a vehicle (200) having a first input (121), a second input (122) and a third input (123), an output (124) and a computing unit (125), wherein the device (120) is set up to read in at least one driving state of a vehicle (200) via the first input (121), to read in a planned vehicle trajectory (202) via the second input (122), a first control signal and parameters that define a tolerance band (203) determine the planned vehicle trajectory (202) in such a way that the vehicle (200) is kept within the tolerance band (203) of the planned vehicle trajectory (202) by the first control signal, taking into account the driving state of the vehicle (200) and a predetermined first safety level is complied with, and is also set up to read in a second control signal via the third input (123) to check whether the second control signal is suitable for the Fah rzeug (202) to keep in the tolerance band (203) of the planned vehicle trajectory (202), and to output the second control signal if the second control signal is suitable to keep the vehicle (200) in the tolerance band (203) of the planned vehicle trajectory, or the first Output control signal when the second control signal is not suitable for keeping the vehicle (200) in the tolerance band (203) of the planned vehicle trajectory. Device (120) after Claim 9 , wherein the device (120) further comprises a controller which is set up to calculate the second control signal, wherein the controller is provided for controlling the longitudinal or transverse movement of the vehicle (200) and which is designed to comply with at least one quality criterion , the device (120) having a safety controller, the safety controller being set up to calculate the first control signal, the safety controller being provided for controlling the longitudinal or transverse movement of the vehicle (200) and according to a mathematical Method is assured of compliance with the specified first security level.

Images