DE102021211667A1 - Method for providing safe control inputs for actuator components of an automated vehicle - Google Patents

Abstract

A method is proposed for providing safe control inputs us for actuator components of an automated vehicle that is moving along a predetermined trajectory. Accordingly, a vehicle state x(k) is determined at a first point in time k. A first set of control inputs is generated based on a comparison between the vehicle state x(k) and predetermined trajectory data. A vehicle state x(k+1) is thus predicted at a later, second point in time k+1 - (step 22). It is checked whether the predicted vehicle state x(k+1) is safe - (step 23) and thus also the first set of control inputs is upsafe - (step 24). According to the invention, the predicted vehicle state x(k+1) is considered safe considered if it flies within a maximally robust, positively invariant MRPI state set X, which has been determined in advance on the basis of a time-invariant system model for vehicle states x, control inputs u and disturbances w. If the vehicle state x(k) lies within the MRPI state set Xflies and if the first set of control inputs up is not considered safe, a new safe set of Control inputs usgenerated - (step 25).

Description

State of the art

The invention relates to a method for providing safe control inputs u _s for actuator components of an automated vehicle that moves with the aid of these actuator components along a trajectory that is specified in the form of trajectory data. In order to generate and provide suitable control data, the vehicle status is monitored and compared with the specified trajectory. For this purpose, the vehicle state x(k) is determined at a first point in time k, in that at least position and movement data and possibly also other state data of the vehicle at point in time k are determined. A first set of control inputs _up is then generated on the basis of a comparison between the vehicle state x(k) at time k and the trajectory data, whereby other parameters are usually also taken into account, such as environmental conditions, traffic rules, driving style specifications, etc.. Before driving the actuator components with this first set of control inputs _up , it is first checked whether the first set of control inputs _up is also safe. For this purpose, based on the vehicle state x(k) at time k and the first set of control inputs _up , a vehicle state x(k+1) is predicted at a subsequent, second point in time k+1 in order to check whether the predicted vehicle state x(k +1) is safe. Only if this is the case is the first set of control inputs _up considered safe.

Ensuring functional safety in driving dynamics control is a central task in autonomous driving in SAE classification levels 2+ to 5. The German disclosure document DE 10 2019 134 258 A1 describes an approach in which a safety controller in a safety path is used to check whether the control signal generated by a given behavior controller (performance controller) can be applied to the system. For the safety path, a simple PID controller is used to have formal proof of ending in a safe state. The safety controller is activated when the control signals generated by the behavior controller would lead to a violation of predefined thresholds. The thresholds are strictly mathematically designed to ensure that the vehicle operates safely. These thresholds only represent physical boundary conditions or limitations of the vehicle condition. Other uncertainties of the underlying system are not taken into account here, which weakens the guarantees provided.

object of the invention

The invention proposes measures that make it possible to systematically take into account other uncertainty factors of the system in addition to the vehicle-related physical boundary conditions when checking whether the control inputs generated by a behavior controller can be considered safe. Furthermore, the invention proposes measures for generating and providing safe control inputs if the control inputs generated by the behavior controller cannot be considered safe because their use would lead to an unsafe vehicle state.

Essence and advantages of the invention

To check whether a first set of control inputs _up is safe, it is checked according to the invention whether the predicted vehicle state x(k+1) lies within a maximally robust, positively invariant MRPI state set X _f of elements x ⁺ , which is based on a temporally invariant system models for vehicle states x, control inputs u and interference w has been determined in advance. If the predicted vehicle state x(k+1) is within this MRPI state set X _f , it is considered safe and so is the first set of control inputs _up . In this case, the first set of control inputs _up can be provided as a safe set of control inputs u _s and can be used to control the vehicle's actuators.

If the vehicle state x(k) at time k is within the MRPI state set X _f and if the first set of control inputs _up is not considered safe, according to the invention, with the aid of a previously specified controller K based on the vehicle state x(k) and the trajectory data generates a new safe set of control inputs u _s that is provided for use in place of the first set of control inputs _up .

According to the invention, a previously determined MRPI state set X _f is required for the security check of the control inputs _up and a previously specified controller K is required for generating a new secure set of control inputs u _s .

The measures according to the invention create an inherently safe system that enables the use of a wide variety of behavior controllers, such as controllers that implement improved driving performance, a special driving feel or a learned control behavior. Advantageously, the invention can be applied to all possible types of vehicle dynamics control, in particular lateral control, longitudinal control and combined approaches in which lateral and longitudinal dynamics are controlled simultaneously. The method according to the invention can be easily implemented on an electronic control unit of the vehicle, since it does not require complex calculations once the MRPI state quantity X _f has been determined and the controller K is specified, which is done before the method according to the invention is carried out.

The MRPI status set X _f lies within a status set X. The status set X includes all vehicle statuses that meet all predefined, in particular vehicle-specific, boundary conditions for the vehicle status.

und im Falle eines zeitlich invarianten linearen Systemmodels $${\text{x}}^{+}=\text{Ax}+\text{Bu}+\text{Ew}$$

wobei $$\text{x}\in \text{X},\text{ u}\in \text{U},\text{ w}\in \text{W}$$

A time-invariant system model, for example for the longitudinal and/or lateral dynamics of a vehicle, is used to calculate the MRPI state set X _f , which takes into account the current vehicle state x, control inputs u and disruptive influences w acting on the system. The following applies in general: $${\text{x}}^{+}=\text{f}\left(\text{x}\text{, u}\text{, w}\right)$$

and in the case of a time-invariant linear system model $${\text{x}}^{+}=\text{axe}+\text{Bu}+\text{Eh}$$

whereby $$\text{x}\in \text{X},\text{and}\in \text{u},\text{w}\in \text{W}$$

The current vehicle state x can easily be determined using sensors. Position data, speed and acceleration data as well as information about the vehicle orientation are suitable for this. The vehicle state in a next time step is denoted by x+. It is x, x ⁺ ∈ R ⁿ with n the number of status data and X is the set of all possible vehicle states within given boundary conditions for the vehicle states. These are mostly physical restrictions, such as speed limits, road limits, etc.

Furthermore, u ∈ R ^m with m the number of inputs and U is the set of all possible sets of control inputs within predetermined, mostly actuator-related boundary conditions for the control inputs, such as maximum steering angle, etc..

The disturbances are defined as w ∈ R ^q with q the number of disturbances and W is the set of all possible sets of disturbances within given boundary conditions for the disturbances, such as maximum assumed disturbance forces due to cross winds, road conditions, etc..

A, B and E denote the constant factor sets of the linear system model.

The selection of the perturbations w and the definition of the corresponding boundary conditions is essential for the design/design of the MRPI state set X _f . In addition to known disturbing forces, unknown parameters can also be taken into account and system uncertainties can be defined as disturbing influences that are caused by non-modeled dynamics, for example by assuming a linear instead of a non-linear system model. Furthermore, a reference signal x _d can be modeled as a disturbance, the reference signal x _d here stands for the positioning error when following the specified trajectory.

Various approaches from the literature can be used to calculate the MRPI state set X _f , for example the MRPI state set X _f can be calculated as a polyhedral or ellipsoidal MRPI state set X _f .

The present invention is based on the idea of using an invariant MRPI state set X _f of safe vehicle states in conjunction with a correspondingly designed controller K for generating safe control inputs in order to ensure that the automated vehicle is always in a vehicle state from the MRPI - State set X _f is located and so that all boundary conditions for the vehicle state are met, provided that the vehicle is once in a safe vehicle state.

In an advantageous variant of the method according to the invention, a controller K is used whose parameters were determined using a linear-quadratic control method (LQR method). The MRPI state quantity X _f used in connection with the controller K was only then calculated using the parameters of the controller K as a basis.

In a preferred variant of the method according to the invention, a controller K and an MRPI state set X _f are used, which have been determined together with the aid of an optimization algorithm. In this case, the parameters of the controller K can advantageously be specified in such a way that the size of the MRPI state set X _f is maximized.

character list

• 1 veranschaulicht das erfindungsgemäße Verfahren anhand eines Blockschaltbilds.
• 2 zeigt ein Flussdiagramm einer Ausführungsform des erfindungsgemäßen Verfahrens
• 3 veranschaulicht die Variablen eines Single Track Modells.

Advantageous embodiments and developments of the invention are discussed below with reference to the figures.

• 1 illustrates the inventive method using a block diagram.
• 2 shows a flow chart of an embodiment of the method according to the invention
• 3 illustrates the variables of a single track model.

Description of exemplary embodiments

Block 1 of the in 1 The block diagram shown includes all components of an automated vehicle that are required to determine the vehicle state x(k) at time k, ie in particular a corresponding sensor system and a signal processing device for the sensor signals. Furthermore, block 1 includes a driver assistance system that is responsible for determining and specifying a vehicle trajectory. And finally, block 1 also includes actuator components which, when actuated appropriately, cause the vehicle to move along the specified trajectory. For this purpose, a behavior controller 2 generates a first set of control inputs _up (k) on the basis of a comparison between the current vehicle state x(k) at time k and the trajectory data.

A safety controller 3 receives the current vehicle status x(k) together with the proposed control inputs _up (k) - 2 , step 21 - and based on this data predicts the vehicle state x(k+1) at a next point in time (k+1) - 2 , Step 22. The safety controller 3 then checks whether the predicted vehicle state x(k+1) lies within a maximally robust, positively invariant MRPI state set X _f and whether the control inputs _up (k) are permissible - 2 , step 23.

If yes - 2 , step 24 - _up (k) is considered safe - _up (k) = u _s (k) - and is applied to the actuator components of 1 .

If the first set of control inputs _up (k) is not considered safe, i.e. the application of the control inputs _up (k) would lead to a vehicle state outside the MRPI state set X _f , it is discarded - 2 , step 25 - and a new safe set of control inputs u _s (k) is generated. A controller K is used for this purpose, it being ensured according to the invention by the specification of the controller K and the MRPI state quantity X _f that the vehicle state x(k+1) thus achieved remains within the MRPI state quantity X _f when the initial state of the vehicle x ₀ is an element of the MRPI state set X _f . In the exemplary embodiment described here, the controller K is specified as: u(k)=Kx(k). Accordingly, the following applies: Kx(k) = u _s (k).

$$u=\mathrm{\delta }$$

$$\dot{x}=\left[\begin{array}{c}vsin\left(e_{\mathrm{\Psi }}+\beta \right)\\ \dot{\Psi }-{\dot{\Psi }}_d\\ a_{11}\dot{\Psi }+a_{12}\beta +b_1\mathrm{\delta }\\ a_{21}\dot{\Psi }+a_{22}\beta +b_2\mathrm{\delta }\end{array}\right]$$

3 illustrates how non-linearities can be included in the perturbation vector w. A single-track model of a vehicle is shown, ie only the wheels 31, 32 on the right or left side of the vehicle. The task is the lateral control of the vehicle, the corresponding single-track model can be described by the following equations: $$x={\left[e_{\mathrm{i.e}},e_{\mathrm{\Psi }},\dot{\Psi }\mathrm{,}\beta \right]}^T$$

$$\mathrm{and}=\mathrm{\delta }$$

$$\dot{x}=\left[\begin{array}{c}vsin\left(e_{\mathrm{\Psi }}+\beta \right)\\ \dot{\Psi }-{\dot{\Psi }}_{\mathrm{i.e}}\\ a_{11}\dot{\Psi }+a_{12}\beta +{\mathrm{<figure-callout\; id="1"\; label="b"\; filenames="DE102021211667A1\_0009.png,DE102021211667A1\_0010.png"\; state="\{\{state\}\}">b</figure-callout>}}_1\mathrm{\delta }\\ a_{21}\dot{\Psi }+a_{22}\beta +{\mathrm{<figure-callout\; id="2"\; label="b"\; filenames="DE102021211667A1\_0009.png"\; state="\{\{state\}\}">b</figure-callout>}}_2\mathrm{\delta }\end{array}\right]$$

Where _ed describes the lateral error, Ψ the yaw angle and e _Ψ = Ψ - Ψ _d , β the slip angle, δ the steering angle, v the speed and a and b parameters.

To reformulate the problem described by Equations (4) to (6) in the form of Equation (2), the following Equation (7) is inserted: $$\text{sin}\left(e_{\mathrm{\Psi }}+\mathrm{\beta }\right)=\left(e_{\mathrm{\Psi }}+\mathrm{\beta }\right)+e_{\text{lin}}$$

This results in a linearization error e _lin . The error limits e _lin,min <= e _lin <= e _lin,max can be calculated with minimum and maximum values for e _Ψ and β.

In this way, the linearization error e _lin can be taken into account as an entry in the perturbation vector w ∈ W. Apparently other disturbances and non-linearities in w can also be taken into account.

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• DE 102019134258 A1 [0002]

Claims (7)

Method for providing safe control inputs u _s for actuator components of an automated vehicle that is moving along a trajectory specified in the form of trajectory data, a. in which a vehicle state x(k) is determined at a first point in time k by determining at least position and movement data of the vehicle at point in time k, b. in which a first set of control inputs _up is generated on the basis of a comparison between the vehicle state x(k) and the trajectory data, c. wherein based on the vehicle state x(k) and the first set of control inputs up _p a vehicle state x(k+1) is predicted at a later second time k+1 - (step 22), d. in which it is checked whether the predicted vehicle state x(k+1) is safe - (step 23), and e. wherein the first set of control inputs _up is deemed safe if the vehicle state x(k+1) predicted thereby is safe - (step 24); characterized in that the predicted vehicle state x(k+1) is considered safe if it lies within a maximally robust, positively invariant MRPI state set X _f of elements x ⁺ , which is calculated using a time-invariant system model for vehicle states x, control inputs u and disturbances w has been determined in advance, and that if the vehicle state x(k) is within the MRPI state set X _f and if the first set of control inputs up _p is not considered safe, using a previously specified controller K Based on the vehicle state x(k) and the trajectory data, a new secure set of control inputs u _s is generated - (step 25). procedure after claim 1 , characterized in that the calculation of the elements x ⁺ the MRPI state set X _f is based on a time-invariant, linear system model for vehicle states x, control inputs u and interference w, which can be described by $$\begin{array}{l}{\text{x}}^{+}=\text{axe}+\text{Bu}+\text{Eh}\hfill \\ \text{x}\in \text{X},\text{and}\in \text{u},\text{w}\in \text{W}\hfill \end{array}$$

where x ∈ R ⁿ and X describes the set of all possible vehicle states within given boundary conditions for the vehicle states, where u ∈ R ^m and U describes the set of all possible sets of control inputs within given boundary conditions for the control inputs, where w ∈ R ^q and W the Describes the set of all possible sets of disturbing influences within predetermined boundary conditions for the disturbing influences and where A, B and E denote the constant factor sets of the linear system model. procedure after claim 2 , characterized in that infrastructure-related disruptions and uncertainties and/or system model-related errors and/or deviations of the vehicle position from the specified trajectory are taken into account as disruptive influences in the time-invariant, linear system model. Procedure according to one of claims 2 or 3 , characterized in that the elements x ⁺ are calculated as elements of a polyhedral or ellipsoidal MRPI state set X _f . Procedure according to one of Claims 1 until 4 , characterized in that the parameters of the controller K are determined using a linear-quadratic control method (LQR method) and that the parameters of the controller K determined in this way are then used as a basis for calculating the MRPI state quantity X _f . Procedure according to one of Claims 1 until 4 , characterized in that the parameters of the controller K and the MRPI state set X _f are determined together using an optimization algorithm, with the size of the MRPI state set X _f in particular being maximized. Procedure according to one of Claims 1 until 6 , characterized in that the first set of control inputs u _p is provided as a safe set of control inputs u _s if the predicted vehicle state x(k+1) is deemed safe.

Images