DE102021213077A1 - Method for monitoring signal processing for an automated driving system and control unit for an automated driving system - Google Patents

Abstract

A method for monitoring signal processing for an automated driving system, the signal processing comprising at least one logic which determines a digital scene understanding from signals from at least one environment detection sensor of the driving system (SEE), predicts traffic scenes based on the scene understanding (PREDICT), plans driving maneuvers (PLAN), Determines control and/or regulation signals for collision-free execution of the driving maneuver (THINK) and provides the control and/or regulation signals to at least one control unit (ACT) that executes the driving maneuver; at least part of the data processing in at least two signal processing paths (S1, S2) of the logic is monitored in accordance with ASIL safety requirements and the signal processing paths (S1, S2) each meet safety requirements less than or equal to ASIL-D; a safety requirement according to ASIL-D is met by selecting and/or combining (VOTE, ARBITER) signals from the signal processing paths (S1, S2) for executing the driving maneuver (ACT).

Description

The invention relates to a method for monitoring signal processing for an automated driving system and a control unit for an automated driving system.

The EP 2 622 870 B1 discloses a method and an arrangement for monitoring at least one battery, a battery with such an arrangement and a motor vehicle with a corresponding battery, which can be used in particular for reliable monitoring of the battery condition with reduced hardware complexity. In this case, redundant monitoring of at least some of the measured variables of the battery takes place. The redundant monitoring at least implements safety requirements according to ASIL-A and ASIL-B.

One object of the present invention was to provide functional safety architectures for an automated driving system. The subjects of the independent and subordinate claim each solve this problem.

According to one aspect, the invention provides a method for monitoring signal processing for an automated driving system. The signal processing includes at least one logic. The logic determines a digital understanding of the scene from signals from at least one environment detection sensor of the driving system. Based on the understanding of the scene, the logic predicts traffic scenes, plans driving maneuvers, determines control and/or regulation signals for carrying out the driving maneuver without a collision, and provides the control and/or regulation signals to at least one control unit that executes the driving maneuvers. At least part of the data processing is monitored in at least two signal processing paths of the logic according to ASIL safety requirements. The signal processing paths each meet safety requirements less than or equal to ASIL-D. By selecting and/or combining signals from the signal processing paths, a safety requirement according to ASIL-D is met for executing the driving maneuver.

According to a further aspect, the invention provides a control device for an automated driving system. The control unit includes logic for signal processing, which determines a digital understanding of the scene from signals from at least one environment detection sensor of the driving system, predicts traffic scenes based on the understanding of the scene, plans driving maneuvers, determines control and/or regulation signals for collision-free execution of the driving maneuver and determines the control and/or Provides control signals to the control unit, the control unit executing the driving maneuvers. The signal processing is monitored according to a method according to the invention.

Advantageous refinements of the invention result from the definitions, the dependent claims, the drawing and the description of preferred exemplary embodiments.

Signal processing generally relates to logical processing blocks of an automated driving system for information processing in the automated guidance of driving systems. In particular, the signal processing includes in the article DIETMAYER, K.: Prediction of machine perception performance in automated driving., in MAURER M et al. (Ed.): Autonomous driving. DOI 10.1007/978-3-662-45854-9_20 disclosed modules, namely: A perception module, also called perception module or SEE module, which determines the digital understanding of the scene based on a sensory perception of an environment of the driving system. According to one aspect, the digital understanding of the scene includes an environment model in which the ego driving system and other road users are represented by movement models and infrastructure elements. Based on this, a prediction module, also called a prediction module, calculates various temporal developments in a traffic scene. The prediction module can also be part of the SEE module. Based on this, an action planning module, also known as a THINK module, determines driving maneuvers including driving around an object and/or overtaking an object including trajectories for executing the planned driving maneuvers. According to one aspect, the trajectories are precalculated in a typical time horizon of a few seconds and optionally evaluated with comfort. The prediction module can also be part of the think module. The optimal trajectory based on specified criteria, ie the driving maneuver, is executed by a control module, also known as an ACT module. In one aspect, the logic includes the perception module, prediction module, action planning module, and control module.

The logic and/or the perception module, prediction module, action planning module and control module can be implemented as software and/or in the form of hardware modules. The hardware modules can be central processors (CPUs), graphics processors (GPUs), multi-core processors, application-specific integrated circuits (ASICs), integrated circuits into which a logic circuit can be loaded (FPGAs), embedded systems, for example control units, microcontrollers, including domain and/or zone controllers, and/or systems on chip (SoC).

The environment detection sensor delivers the respective raw data. The perception module analyzes the raw data and provides it as information that is converted into electromagnetic signals and transmitted as such. The environment detection sensor can be a camera, radar, lidar, ultrasound, acoustic, smell and/or inertial sensor. According to one aspect, signals from a number of these surroundings detection sensors are merged, according to a further aspect based on diverse sensor technologies, diverse algorithms and/or based on different maximum detection ranges. According to a further aspect, the logic for determining the digital scene understanding executes data-driven algorithms, for example artificial neural networks, for example convolution networks for semantic image segmentation.

The prediction module predicts states, for example using Bayesian estimation, Kalman filters, Markov chains or data-driven algorithms.

According to one aspect, the perception module, prediction module and action planning module are assigned to a first control unit and the control module is assigned to a second control unit which is independent of the first and which is operatively connected to vehicle actuators. According to one aspect, the first control device comprises a supercomputer platform for information processing. The second control device is operatively connected, for example, to actuators for longitudinal and/or lateral control of the vehicle, for example brake actuators, engine valve actuators, steering actuators.

Driving system relates to components of a vehicle and/or the vehicle as such. Automated driving systems carry out the driving action automatically. The SAE J3016 standard, for example, determines an automation level of the driving systems that can be operated automatically. The invention particularly relates to SAE J3016 Level 4 or 5 AD systems. An example of an automated driving system according to the invention is a Level 4 passenger/goods shuttle or robot shuttle.

ASIL means Automotive Safety Integrity Level and is defined in the ISO 26262 safety standard. The levels ASIL-A to ASIL-D classify safety requirements for safety-related functions, with ASIL-D having the highest requirements. For example, a failure rate of 10 ^-9 /operating hour corresponds to the ASIL D level.

One solution for meeting safety requirements according to ASIL-D for the entire system of the automated driving system is to impose ASIL-D safety requirements on the individual processing steps of the logic, in particular the SEE module, THINK module and ACT module. The selection and/or combination of signals from the signal processing paths according to the invention achieves an ASIL decomposition for the signal processing, according to which a safety requirement according to ASIL-D only has to be met for the execution of the driving maneuver in order to meet a safety requirement according to ASIL- to fulfill D. This makes it easier to secure and validate the driving system procedurally.

Another possible decomposition of ASIL-D is into ASIL-A and ASIL-C. ASIL-C must be further decomposed into ASIL-B and ASIL-A. This results in a decomposition of ASIL-D comprising at least three channels ASIL-A+ASIL-A+ASIL-B. This decomposition requires additional effort for new channels and demonstration of the independence of at least three channels.

According to one aspect, a first signal processing path includes at least the determination of the digital understanding of the scene and the planning of the driving maneuvers according to safety requirements according to QM. Based on "quality management", the QM level means that no safety measures according to ISO 26262 are required. In a second signal processing path, the digital understanding of the scene is determined independently of the first signal processing path. Hazard events are monitored based on the independently determined digital scene understanding. Based on the hazardous events, emergency maneuvers including emergency stopping maneuvers to avoid collisions and/or to avoid lane changes and/or emergency maneuvers for a lane change are initiated. The second signal processing path includes two redundant sub-signal processing paths. Each of the two sub-signal processing paths includes at least a determination of the digital understanding of the scene, a prediction of the traffic scenes and an evaluation of the predictions with regard to the emergency maneuvers, each according to safety requirements according to ASIL-B. The signals obtained from the first signal processing path and from the two sub-signal processing paths are combined. The driving maneuvers are carried out based on the signal combination according to safety requirements according to ASIL-D.

The first signal processing path corresponds to a QM nominal path. The second signal processing path corresponds to a safety path that is independent of the first signal processing path. Only vehicle reactions to hazards are monitored in the safety path. For example, braking is initiated in the safety path. The second signal processing path initiates emergency manoeuvres, but is independent of the planning and execution of driving manoeuvres. For example, in the case of emergency stopping maneuvers to avoid a collision, the vehicle reactions follow the target steering, maximum braking, and no propulsion is initiated. In the case of emergency stopping maneuvers to avoid changing lanes, the vehicle reactions can block the steering, maximum braking, no drive can be initiated. In the case of emergency maneuvers for a lane change, for example, the vehicle reactions maximum speed per mission point, leaving mission reference points are initiated.

According to one aspect, the signals obtained from the first signal processing path and from the two sub-signal processing paths are combined in a safety module of the logic, which satisfies safety requirements according to ASIL-D. The security module and the two sub-signal processing paths form the security path. In this context, the first signal processing path forms a performance path.

• • klare Trennung zwischen sicherheitsrelevanten und nicht sicherheitsrelevanten Themen;
• • Begrenzung eines Signalverarbeitungspfades auf den Sicherheitsbereich;
• • Nutzung von Graphikprozessoren und künstlichen neuronalen Netzwerken und Maschinenlernalgorithmen im QM nominalen Pfad nicht durch Sicherheitsbeschränkungen eingeschränkt, Sicherheitspfad ist regelbasiert und „klassisch“, was die Wiederaufarbeitung des Systemteils erleichtert;
• • kein Nachweis der Störungsfreiheit/Interferenz zwischen Umfelderfassungssensoren in den beiden Signalverarbeitungspfaden erforderlich;
• • Komplexität der Validierung gering.

This functional safety architecture, comprising the QM nominal path and the ASIL-D safety path, has the following advantages, for example, especially with regard to the primary safety goal of avoiding collisions with other objects:

• • clear separation between safety-related and non-safety-related topics;
• • Limitation of a signal processing path to the safety area;
• • Use of graphics processors and artificial neural networks and machine learning algorithms in the QM nominal path not constrained by safety constraints, safety path is rule-based and "classic", which facilitates the reprocessing of the system part;
• • No need to prove that there is no interference between environment detection sensors in the two signal processing paths;
• • Low complexity of the validation.

According to a further aspect, a first signal processing path includes at least the determination of the digital understanding of the scene, the prediction of the traffic scenes and the planning of the driving maneuvers, each based on safety requirements according to ASIL-B. A second signal processing path determines and predicts the digital scene understanding and traffic scenes redundantly according to ASIL-B safety requirements, respectively. In the first signal processing path, the signals obtained from the planning of the driving maneuvers are checked against the signals of the second signal processing path obtained from the predicted traffic scenes with regard to violations of safety goals. The signals obtained from the planning of the driving maneuvers and the signals of the first signal processing path obtained from the check are combined by means of a voting logic. The voting logic determines the control and/or regulation signal according to safety requirements according to ASIL-D for executing the driving maneuvers and makes them available to the control unit.

The aforementioned aspect implements a doer/checker principle. The first signal processing path corresponds to the Doer. The doer's plan is checked in the second signal processing path with independent SEE input. The second signal processing path corresponds to the checker. The voting logic ensures that only successfully verified waypoints are sent to ACT.

According to one aspect, the voting logic is generally implemented by a MooN system, which is an evaluation module that compares N measured values, of which at least M must meet specified criteria. For example, the MooN system is a 3oo1 system.

• • Optimierung der Falsch-Positiv-Erkennungen und Falsch-Negativ-Erkennung in verschiedenen Pfaden;
• • hohe Zuverlässigkeit hinsichtlich Fehlertoleranz.

This functional safety architecture based on the Doer/Checker principle has the following advantages, for example, especially with regard to the primary safety goal of avoiding collisions with other objects:

• • Optimization of false positive detections and false negative detections in different paths;
• • high reliability in terms of error tolerance.

In a further embodiment based on the Doer/Checker principle, evasive maneuvers are planned in the first signal processing path. The signals obtained from the planning of the evasive maneuvers are checked in the first signal processing path. Overall, the signals obtained from the planning of the driving maneuvers and the signals obtained from the planning of the evasive maneuvers are checked against the signals of the second signal processing path obtained from the predicted traffic scenes with regard to violation of safety goals. The signals obtained from the planning of the driving maneuvers and the evasive maneuvers and the signals obtained from the check are combined using the voting logic. The voting logic determines the control and/or regulation signals according to safety requirements according to ASIL-D for executing the driving maneuvers and the evasive maneuvers and makes them available to the control unit. The control unit stores the signals for a currently valid evasive maneuver.

The evasive manoeuvres, also known as emergency fall back maneuvers, are planned in parallel to the “normal” driving manoeuvres. The vehicle is always stopped during evasive maneuvers. Since the control unit stores every valid evasive maneuver, the evasive maneuver can be used in the event of a communication failure with the THINK module.

According to one aspect, the control unit includes an internal memory for storing the signals for currently valid evasive maneuvers.

In a further embodiment based on the Doer/Checker principle, evasive maneuvers are determined in the second signal processing path based on the predicted traffic scenes. In the second signal processing path, the signals obtained from the determination of the evasive maneuvers are checked against the signals of the first signal processing path obtained from the predicted traffic scenes with regard to violation of safety goals. The signals obtained from the determination of the evasive maneuver and the signals of the second signal processing path obtained from the check are combined with the signals obtained from the planning of the driving maneuver and the signals of the first signal processing path obtained from the check by means of the voting logic. The voting logic determines the control and/or regulation signal according to safety requirements according to ASIL-D for executing the driving maneuvers and the evasive maneuvers and provides them to the control unit. The control unit stores the signals for a currently valid evasive maneuver.

This embodiment includes a checker module in the first and second signal processing paths. The evasive maneuvers are determined in the second signal processing path and are thus based on the SEE input of the second signal processing path, which is independent relative to the first signal processing path. Combining the signals from the first and second signal processing paths, each comprising the signals obtained from the checks, enables a cross-check or a cross-check of the other SEE inputs in each case. With the cross-check, errors can be better assigned to the individual SEE modules.

In a further embodiment based on the Doer/Checker principle, comprising a checker module in the first and the second signal processing path, the second signal processing path comprises redundant planning of the driving maneuvers according to safety requirements according to ASIL-B. Evasive maneuvers are planned redundantly in the second signal processing path. In the second signal processing path, the signals obtained from the planning of the driving maneuvers and the evasive maneuvers are redundantly checked against the signals of the first signal processing path obtained from the predicted traffic scenes with regard to violation of safety goals. The signals received in the first signal processing path from the planning of the driving maneuvers and the evasive maneuvers and the signals received from the respective check and the signals received in the second signal processing path from the planning of the driving maneuvers and the evasive maneuvers and the signals received from the respective check are Voting logic merged.

In addition to the first THINK module in the first signal processing path, this embodiment includes a second THINK module in the second signal processing path. The first and the second THINK module each supply signals for carrying out the "normal" driving maneuvers and the evasive maneuvers. In one aspect, the second THINK module executes a shorter and/or slower mission than the first THINK module. According to a further aspect, the output of the first THINK module is preferred over the output of the second THINK module. In one aspect, the voting logic sends a pair of signals including driving maneuvers and evasive maneuvers when both are successfully verified.

In a further embodiment based on the Doer/Checker principle comprising the first and the second THINK module, the signals of the first signal processing path obtained from the predicted traffic scenes are compared in the first signal processing path against the signals of the first signal processing path obtained from the planning of the driving maneuvers according to safety requirements checked according to ASIL-B with regard to violation of safety goals. In the second signal processing path, the signals of the second signal processing path obtained from the predicted traffic scenes are checked against the signals of the second signal processing path obtained from the planning of the driving maneuver according to safety requirements according to ASIL-B with regard to violation of safety goals. The signals obtained from the aforementioned check in the first signal processing path and the signals obtained from the aforementioned check in the second signal processing path are combined by means of the voting logic. In total The signals received in the first signal processing path from the planning of the driving maneuvers and the evasive maneuvers, the signals received from the respective check and the signals received in the second signal processing path from the planning of the driving maneuvers and the evasive maneuvers and the signals received from the respective check are processed by means of merged with the voting logic.

With this additional cross-check of the outputs of the THINK modules with the respective SEE inputs, errors in the THINK modules can be better recognized and assigned.

According to a further aspect, a first signal processing path includes determining the digital understanding of the scene, predicting the traffic scenes and planning the driving maneuvers in accordance with safety requirements in accordance with ASIL-B. A second signal processing path that is redundant with respect to the first signal processing path includes determining the digital understanding of the scene, predicting the traffic scenes and planning the driving maneuvers in accordance with safety requirements in accordance with ASIL-B. The logic arbitrates the signals of the first and second signal processing path obtained from the planning of the driving maneuver and, if both signals are valid, selects the signal for executing the driving maneuver at minimum speed according to safety requirements according to ASIL-D.

By independently planning the driving maneuvers in the two signal processing paths, independent trajectories are calculated for the same global mission. In this case, independent situation assessments are used and each of the signal processing paths uses independent SEE inputs, based in one aspect on diverse sensor technologies, diverse algorithms and/or based on different maximum detection ranges.

This functional safety architecture is based on arbitrating between two independently calculated driving maneuvers and selecting a more conservative driving maneuver, e.g. minimum speed. One of the two signal processing paths will always detect an object and slow it down. Therefore, choosing the slower path is conservative.

In an embodiment based on the arbitration, emergency and/or evasive maneuvers are determined in the first and/or the second signal processing path. The signals obtained from the emergency and/or evasive maneuvers are arbitrated together with the signals obtained from the planning of the driving maneuvers. The determination of the emergency and/or evasive maneuvers in the first and the second signal processing path has the advantage that the ego vehicle can always be safely stopped in one of the signal processing paths in the event of serious hardware errors or a loss of communication.

According to a further aspect, the driving maneuver for fail-safe braking is integrated in the ACT module or the respective control unit, comprising maximum braking force or maximum braking force together with locking of the steering. This is advantageous in the event of hardware and/or communication errors, for example if all trajectories or travel commands to ACT are lost.

The scope of the invention also includes the fusion/plausibility check of two independent SEE inputs.

• 1 ein Ausführungsbeispiel eines ASIL-D Signalverarbeitungspfades,
• 2 ein Ausführungsbeispiel einer erfindungsgemäßen funktionalen Sicherheitsarchitektur umfassend einen QM nominalen Pfad und einen ASIL-D Sicherheitspfad,
• 3 eine weitere Ebene des Ausführungsbeispiels aus 2,
• 4 ein Ausführungsbeispiel einer erfindungsgemäßen funktionalen Sicherheitsarchitektur basierend auf dem Doer/Checker-Prinzip;
• 5 ein weiteres Ausführungsbeispiel der erfindungsgemäßen funktionalen Sicherheitsarchitektur aus 4 umfassend eine Planung von Ausweichmanövern in dem ersten Signalverarbeitungspfad;
• 6 ein weiteres Ausführungsbeispiel der erfindungsgemäßen funktionalen Sicherheitsarchitektur aus 4 umfassend eine Planung von Ausweichmanövern in dem zweiten Signalverarbeitungspfad;
• 7 ein weiteres Ausführungsbeispiel der erfindungsgemäßen funktionalen Sicherheitsarchitektur aus 5 umfassend neben dem ersten THINK-Modul in dem ersten Signalverarbeitungspfad ein zweites THINK-Modul in dem zweiten Signalverarbeitungspfad;
• 8 ein weiteres Ausführungsbeispiel der erfindungsgemäßen funktionalen Sicherheitsarchitektur aus 7 umfassend eine Überprüfung in dem ersten Signalverarbeitungspfad der aus den vorhergesagten Verkehrsszenen erhaltenen Signale des ersten Signalverarbeitungspfades gegen die aus der Planung der Fahrmanöver erhaltenen Signale des ersten Signalverarbeitungspfades und eine Überprüfung in dem zweiten Signalverarbeitungspfad der aus den vorhergesagten Verkehrsszenen erhaltenen Signale des zweiten Signalverarbeitungspfades gegen die aus der Planung der Fahrmanöver erhaltenen Signale des zweiten Signalverarbeitungspfades,
• 9 ein Ausführungsbeispiel einer erfindungsgemäßen funktionalen Sicherheitsarchitektur basierend auf dem Arbitrieren und
• 10 ein Ausführungsbeispiel einer erfindungsgemäßen funktionalen Sicherheitsarchitektur basierend auf einer Fusion/Plausibilisierung von zwei unabhängigen SEE-Inputs.

The invention is explained by way of example in the following figures. Show it:

• 1 an embodiment of an ASIL-D signal processing path,
• 2 an embodiment of a functional safety architecture according to the invention comprising a QM nominal path and an ASIL-D safety path,
• 3 another level of the embodiment 2 ,
• 4 an embodiment of a functional security architecture according to the invention based on the Doer / Checker principle;
• 5 another exemplary embodiment of the functional safety architecture according to the invention 4 comprising a planning of evasive maneuvers in the first signal processing path;
• 6 another exemplary embodiment of the functional safety architecture according to the invention 4 comprising a planning of evasive maneuvers in the second signal processing path;
• 7 another exemplary embodiment of the functional safety architecture according to the invention 5 comprising, in addition to the first THINK module in the first signal processing path, a second THINK module in the second signal processing path;
• 8th another exemplary embodiment of the functional safety architecture according to the invention 7 comprising a check in the first signal processing path of the signals obtained from the predicted traffic scenes of the first signal processing path against those from the planning of Signals of the first signal processing path obtained from driving maneuvers and a check in the second signal processing path of the signals of the second signal processing path obtained from the predicted traffic scenes against the signals of the second signal processing path obtained from the planning of the driving maneuvers,
• 9 an embodiment of a functional security architecture according to the invention based on the arbitration and
• 10 an exemplary embodiment of a functional safety architecture according to the invention based on a fusion/plausibility check of two independent SEE inputs.

In the figures, the same reference symbols denote parts that are the same or have a similar function. For the sake of clarity, the reference parts relevant for the respective understanding are indicated in the respective figures.

The signal processing path in 1 includes determining a digital scene understanding SEE, also called perception. In this case, data from surroundings detection sensors or from a network of surroundings detection sensors are generally read. The surroundings detection sensors can be cameras, radar, lidar, ultrasonic sensors, acoustic sensors and/or odor sensors. Features for perceiving the environment are extracted from the data based on dynamic and/or static object recognition, object tracking, and, for example, on determining the movement of the ego vehicle. From the extracted features, semantic maps of the environment including positions and/or poses of objects, object lists and free spaces are determined and converted into digital signals. This results in the digital understanding of the scene. In 1 meets the determination of digital scene understanding safety requirements according to ASIL-D. According to the solution according to the invention, the determination of the digital understanding of the scene satisfies safety requirements according to ASIL-B.

Furthermore, the signal processing path includes in 1 the determination of control and/or regulation signals THINK for collision-free execution of the driving maneuver, also called driving function. In this case, for example, object behavior is predicted from the signals from the outputs of the processing step SEE. This corresponds to the PREDICT traffic scene prediction processing step. Predicting object behavior includes phenomenological and physical object behavior. Based on the predicted object behavior or the resulting traffic scenes, trajectories are planned with fallback trajectories, for example. In 1 the processing step THINK fulfills safety requirements according to ASIL-D.

Furthermore, the signal processing path includes in 1 the execution of the driving actions by one or more control units ACT. For example, the driving actions are carried out by control units ACT for the longitudinal and/or lateral dynamics of the vehicle. According to one aspect, several control units or all control units for the longitudinal and/or lateral dynamics are controlled centrally by software. The execution of the driving maneuvers by the control unit(s) meets the safety requirements according to ASIL-D.

The invention proposes functional safety architectures to implement the ASIL-D signal processing path in 1 to decompose.

Show a first functional safety architecture according to the invention 2 and 3 . A first signal processing path S1, which is the QM nominal path, is protected by a second signal processing path S2, which is the ASIL-D safety path SAFE. As in 3 shown, the ASIL-D safety path SAFE is divided into a safety module SAFETY SYS and a safety envelope. The safety module SAFETY SYS meets safety requirements according to ASIL-D. The security envelope includes the second signal processing path S2, which is divided into a first and a second sub-signal processing path S2a, S2b. Each of the two sub-signal processing paths S2a, S2b includes at least a determination of the digital scene understanding SEE1, SEE2, a prediction of the traffic scenes PREDICT, PREDICT2 and an evaluation ASSESS, ASSESS2 of the predictions with regard to the emergency maneuvers according to safety requirements according to ASIL-B.

Show a second functional safety architecture according to the invention 4 until 8th . The second functional safety architecture implements a Doer/Checker principle.

4 shows a first embodiment of the Doer / Checker principle. The driving maneuvers planned in the first signal processing path, which are based on a first determination of the digital scene understanding SEE, are checked in the processing step CHECK with predicted traffic scenes PREDICT2 of the second signal processing path, which are based on a second determination of the digital scene understanding SEE2. The environment detection sensors on which SEE is based can differ from the environment detection sensors on which SEE2 is based sensors with regard to sensor technology, evaluation algorithms and/or maximum detection range in which the environment detection sensors are operated. The signals MAIN obtained from the planning of the driving maneuver PLAN and the signals obtained from the check CHECK are combined using a voting logic VOTE.

5 shows a second embodiment of the Doer / Checker principle. In addition to 4 a signal EFM for an evasive maneuver is determined in the first signal processing path S1. The signal EFM is included in the verification CHECK and is sent to the voting logic VOTE. The voting logic VOTE determines the control and/or regulation signals according to safety requirements according to ASIL-D for carrying out the driving maneuvers and the evasive maneuvers and makes these signals available to the control unit ACT. The ACT control unit stores the signals for a currently valid evasive maneuver.

6 shows a third embodiment of the Doer/Checker principle. In contrast to 5 the signals EFM for evasive maneuvers in the second signal processing path S2 are determined based on the predictions PREDICT2 of traffic scenes in the second signal processing path S2. In addition to the check CHECK in the first signal processing path S2, the second signal processing path S2 also includes the processing step of checking CHECK, with the signals EFM for the evasive maneuvers being checked in the second signal processing path S2 against the traffic scenes PREDICT predicted in the first signal processing path S1. The signals obtained from the two checks CHECK are combined with the signals MAIN obtained from the planning of the driving maneuvers in the first signal processing path S1 and the signals EFM for evasive maneuvers obtained in the second signal processing path S2 in the voting logic VOTE.

7 shows a fourth embodiment of the doer/checker principle. In contrast to 6 the second signal processing path S2 includes its own planning PLAN of the driving maneuvers based on the SEE2 and PREDICT2 input of the second signal processing path S2. The signals EFM for evasive maneuvers are determined from the plan PLAN of the second signal processing path S2.

8th shows a fifth embodiment of the Doer / Checker principle. In contrast to 7 the first signal processing path S1 and the second signal processing path S2 each include an additional check CHECK. In the additional check CHECK in the first signal processing path S1, the predicted traffic scenes PREDICT are checked against the planned driving maneuver PLAN. This means that the driving maneuvers PLAN planned in the first signal processing path S1 are checked with the vehicle's own environment model, ie with its own environment perception SEE of the first signal processing path S1. In the additional check CHECK in the second signal processing path S2, the predicted traffic scenes PREDICT2 are checked against the planned driving maneuver PLAN. This means that the driving maneuvers PLAN planned in the second signal processing path S2 are checked using the environment model, ie using the environment perception, SEE2 of the second signal processing path S2.

9 shows the functional safety architecture according to the invention based on arbitration. A first signal processing path S1 includes the determination of the digital understanding of the scene SEE, which includes the prediction of the traffic scenes PREDICT and the planning of the driving maneuvers PLAN, each based on safety requirements according to ASIL-B. A second signal processing path S2 that is redundant to the first signal processing path S1 includes the determination of the digital understanding of the scene SEE2, the prediction of the traffic scenes PREDICT2 and the planning of the driving maneuvers PLAN according to safety requirements according to A-SIL-B. In the processing step ARBITER, the logic arbitrates the signals MAIN of the first and second signal processing paths S1, S2 obtained from the planning of the driving maneuver PLAN. If both signals are valid, the signal for executing the driving maneuver at minimum speed is selected according to safety requirements according to ASIL-D.

10 shows the functional safety architecture according to the invention based on the FUSION processing step, in which two independent SEE inputs, namely SEE and SEE2, are fused and/or checked for plausibility. Based on the FUSION processing step, the THINK processing step follows. SEE and SEE2 each meet safety requirements according to ASIL-B and FUSION and THINK each meet safety requirements according to ASIL-D.

Reference List

S1

signal processing path

S2

signal processing path

S2a

Sub signal processing path

S2b

Sub signal processing path

LAKE

Method step determining a digital scene understanding

LAKE1

Method step determining a digital scene understanding

LAKE2

Method step determining a digital scene understanding

PREDICT

Method step prediction of traffic scenes

PREDICT2

Method step prediction of traffic scenes

PLAN

Process step planning of driving maneuvers

THINK

Method step determination of control and/or regulation signals

nale to

collision-free execution of driving manoeuvres

ACT

Control unit that executes the driving manoeuvres

SAFE

security path

SAFETY SYS

security module

ASSESS

Process step Evaluation of the signals

ASSESS2

Process step Evaluation of the signals

CHECK

Method step Checking the signals

MAIN

signals obtained from the planning of driving manoeuvres

EFM

signals obtained from the planning of evasive maneuvers

VOTE

voting logic

ARBITER

Process step arbitration of the signals

ASIL QM

security requirement

ASIL B

security requirement

ASIL-D

security requirement

FUSION

Process step fusion/plausibility check

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• EP 2622870 B1 [0002]

Claims (10)

A method for monitoring signal processing for an automated driving system, wherein • the signal processing includes at least one logic that determines a digital scene understanding (SEE) from signals from at least one environment detection sensor of the driving system, predicts traffic scenes based on the scene understanding (PREDICT), plans driving maneuvers (PLAN), control and/or regulation signals for collision-free execution of the determines driving maneuvers (THINK) and provides the control and/or regulation signals to at least one control unit (ACT) which executes the driving maneuvers; • at least part of the data processing in at least two signal processing paths (S1, S2) of the logic is monitored according to ASIL safety requirements and the signal processing paths (S1, S2) each meet safety requirements less than or equal to ASIL-D; • A safety requirement according to ASIL-D is met by selecting and/or combining (VOTE, ARBITER) signals from the signal processing paths (S1, S2) for executing the driving maneuver (ACT). procedure after claim 1 , wherein • a first signal processing path (S1) comprises at least the determination of the digital understanding of the scene (SEE) and the planning of the driving maneuvers (PLAN) in accordance with safety requirements in accordance with QM; • in a second signal processing path (S2) the digital scene understanding (SEE) is determined independently of the first signal processing path (S1), based on the independently determined digital scene understanding (SEE) hazard events are monitored and based on the hazard events emergency maneuvers including emergency stopping maneuvers to avoid collisions and/ or initiated to avoid lane changes and/or emergency lane change maneuvers; • the second signal processing path (S2) comprises two redundant sub-signal processing paths (S2a, S2b) and each of the two sub-signal processing paths (S2a, S2b) at least one determination of the digital scene understanding (SEE1, SEE2), a prediction of the traffic scenes (PREDICT, PREDICT2 ) and an assessment (ASSESS, ASSESS2) of the predictions with regard to the emergency maneuvers according to safety requirements according to ASIL-B; • the signals obtained from the first signal processing path (S1) and from the two sub-signal processing paths (S2a, S2b) are combined and the driving maneuvers are carried out based on the signal combination according to safety requirements in accordance with ASIL-D. procedure after claim 1 , wherein • a first signal processing path (S1) includes at least the determination of the digital scene understanding (SEE), the prediction of the traffic scenes (PREDICT) and the planning of the driving maneuvers (PLAN), each according to safety requirements according to ASIL-B; • a second signal processing path (S2) redundantly determines and predicts the digital scene understanding (SEE) and the traffic scenes (PREDICT2) according to safety requirements according to ASIL-B; • in the first signal processing path (S1), the signals (MAIN) obtained from the planning of the driving maneuver (PLAN) are checked (CHECK) against the signals obtained from the second signal processing path (S2) from the predicted traffic scenes (PREDICT) with regard to infringement of safety objectives; • the signals (MAIN) obtained from the planning of the driving maneuver (PLAN) and the signals of the first signal processing path (S1) obtained from the check (CHECK) are combined by means of a voting logic (VOTE); • The voting logic (VOTE) determines the control and/or regulation signal according to safety requirements according to ASIL-D for executing the driving maneuvers and makes them available to the control unit (ACT). procedure after claim 3 , wherein • evasive maneuvers are planned in the first signal processing path (S1); • the signals (EFM) obtained from the planning of the avoidance maneuver are checked (CHECK) in the first signal processing path (S1); • the signals (MAIN, EFM) obtained from the planning of the driving maneuvers (PLAN) and the avoidance maneuvers and the signals obtained from the verification (CHECK) are combined by means of the voting logic (VOTE); • the voting logic (VOTE) determines the control and/or regulation signal according to safety requirements according to ASIL-D for executing the driving maneuvers and the evasive maneuvers and makes them available to the control unit (ACT); • the control unit (ACT) stores the signals for a currently valid evasive maneuver. procedure after claim 3 , wherein • in the second signal processing path (S2) evasive maneuvers are determined based on the predicted traffic scenes (PREDICT2); • in the second signal processing path (S2), the signals (EFM) obtained from the determination of the evasive maneuver against the signals obtained from the predicted traffic scenes (PREDICT). of the first signal processing path (S1) are checked (CHECK) with regard to breaches of security objectives; • the signals (EFM) obtained from the determination of the avoidance maneuver and the signals obtained from the check (CHECK) of the second signal processing path (S2) with the signals (MAIN) obtained from the planning of the driving maneuver (PLAN) and the signals obtained from the check (CHECK )) received signals of the first signal processing path (S1) are combined by means of the voting logic (VOTE); • the voting logic (VOTE) determines the control and/or regulation signal according to safety requirements according to ASIL-D for executing the driving maneuvers and the evasive maneuvers and makes them available to the control unit (ACT); • the control unit (ACT) stores the signals for a currently valid evasive maneuver. procedure after claim 4 , wherein • the second signal processing path (S2) includes a redundant planning of the driving maneuvers (PLAN) according to safety requirements according to ASIL-B; • evasive maneuvers are planned redundantly in the second signal processing path (S2); • in the second signal processing path (S2), the signals (MAIN, EFM) obtained from the planning of the driving maneuvers and the evasive maneuvers (PLAN) are checked against the signals of the first signal processing path (S1) obtained from the predicted traffic scenes (PREDICT2) with regard to violation of safety goals (CHECK) become; • the signals (MAN, EFM) received in the first signal processing path (S1) from the planning of the driving maneuver and the avoidance maneuver (PLAN) and the signals received from the respective check (CHECK)) and the o in the second signal processing path (S2) signals (MAIN, EFM)) obtained from the planning of the driving maneuvers and the evasive maneuvers (PLAN) and the signals obtained from the respective check (CHECK)) are combined by means of the voting logic (VOTE). procedure after claim 6 , where • in the first signal processing path (S1) the signals of the first signal processing path (S1) obtained from the predicted traffic scenes (PREDICT) against the signals (MAIN) of the first signal processing path (S1) obtained from the planning of the driving maneuver (PLAN) according to safety requirements ASIL-B are checked (CHECK) with regard to violation of safety goals; • In the second signal processing path (S2), the signals of the second signal processing path (S2) obtained from the predicted traffic scenes (PREDICT2) against the signals (MAIN) of the second signal processing path (S2) obtained from the planning of the driving maneuver (PLAN) according to safety requirements according to ASIL- B are checked for violations of security goals (CHECK); • the signals obtained from the aforementioned verification (CHECK) in the first signal processing path (S1) and the signals obtained from the aforementioned verification (CHECK) in the second signal processing path (S2) are combined by means of the voting logic (VOTE). procedure after claim 1 , wherein • a first signal processing path (S1) includes the determination of the digital scene understanding (SEE), the prediction of the traffic scenes (PREDICT) and the planning of the driving maneuvers (PLAN), each according to safety requirements according to ASIL-B; • a second signal processing path (S2) that is redundant to the first signal processing path (S1) includes determining the digital scene understanding (SEE2), predicting the traffic scenes (PREDICT2) and planning the driving maneuvers (PLAN), each based on safety requirements according to A-SIL-B; • the logic arbitrates (ARBITER) the signals (MAIN) of the first and second signal processing paths (S1, S2) obtained from the planning of the driving maneuver (PLAN) and, if both signals are valid, the signal for executing the driving maneuver at minimum speed Selects safety requirements according to ASIL-D. procedure after claim 8 , wherein emergency and/or evasive maneuvers are determined in the first and/or the second signal processing path (S1, S2) and the signals (EFM) obtained from the emergency and/or evasive maneuvers together with the signals from the planning of the driving maneuvers (PLAN) received signals (MAIN) are arbitrated (ARBITER). Control unit (ACT) for an automated driving system comprising logic for signal processing, which determines a digital scene understanding (SEE) from signals from at least one environment detection sensor of the driving system, predicts traffic scenes based on the scene understanding (PREDICT), plans driving maneuvers (PLAN), control and/or or control signals for collision-free execution of the driving maneuver determined (THINK), the control and / or regulation signals to the control unit (ACT) provides and the control unit (ACT) performs the driving maneuver, the signal processing according to a method rens is monitored according to one of the preceding claims.

Images