DE102022203353A1 - Method for operating a vehicle and control module for a vehicle - Google Patents

Abstract

The invention relates to a method for operating a vehicle (50), wherein the vehicle (50) can be operated in a manual and in at least one automated operating mode, with a predetermined trigger (10) for an operating mode change from an actual operating mode to a target -Operating mode is received and/or recognized, predetermined preconditions (11) for the target operating mode being checked, the operating mode being changed if all predetermined preconditions (11) are met, for which purpose a control signal (20) is sent to affected components ( 51) of the vehicle (50), a respective acknowledgment signal (21) for a successful operating mode change being received by the affected components (51), and the vehicle (50) being transferred to a safe state if the acknowledgment signal (21 ) of at least one of the components (51) is missing. The invention further relates to a control module (1) for a vehicle (50) and a system (60) for a vehicle (50).

Description

The invention relates to a method for operating a vehicle and a control module for a vehicle.

Automated vehicles with SAE Level 4 or higher generally drive without a human driver. However, there are use cases in which these vehicles need to be controlled manually. For example, manual control may be necessary during production, loading, transfer or maintenance. Other use cases include failures or breakdowns in which the automated operation no longer works but the vehicle still needs to be moved. Manual operation is also necessary during development to explore new operating environments or to test automated operation with a fallback level where a driver can or must intervene.

An automated vehicle therefore usually has the operating modes “automatic” and “manual”. Since both operating modes are implemented via distributed systems in the vehicle, that is, a large number of components (control devices) distributed across the vehicle are required to implement these operating modes, but these components have different tasks in each operating mode, the need for a central control arises the operating mode.

From the DE 10 2015 122 513 A1 An autonomous vehicle interface for a vehicle and a method for activating and using an autonomous vehicle interface for a vehicle are known. The autonomous vehicle interface may be configured to seamlessly change driving modes or vehicle mode of operation from user-controlled to autonomously controlled driving without the user physically activating the autonomously controlled driving. The autonomous vehicle interface may further be configured to take into account active components and environmental conditions used by the user when activating the autonomous control. The autonomous vehicle interface may further be configured to take into account the user's operating state and/or the user's attention to activate the autonomous vehicle mode. Furthermore, the autonomous vehicle interface may be configured to change the operating mode of the vehicle from automatically controlled to user-controlled driving in response to a positive change in the operating state and/or the user's attention.

The invention is based on the object of creating a method for operating a vehicle and a control module for a vehicle with which an operating mode change between operating modes of the vehicle can be carried out in an improved manner.

The object is achieved according to the invention by a method with the features of patent claim 1 and a control module with the features of patent claim 6. Advantageous embodiments of the invention result from the subclaims.

In particular, a method for operating a vehicle is provided, wherein the vehicle can be operated in a manual and in at least one automated operating mode, wherein a predetermined trigger for an operating mode change from an actual operating mode to a target operating mode is received and/or recognized is, whereby predetermined preconditions for the target operating mode are checked, the operating mode being changed if all predetermined preconditions are met, for which purpose a control signal is transmitted to affected components of the vehicle, with a respective acknowledgment signal for a successful operating mode change from the affected components is received, and wherein the vehicle is transferred to a safe state if the acknowledgment signal from at least one of the components is missing.

Furthermore, in particular, a control module is created for a vehicle, wherein the vehicle can be operated in a manual and in at least one automated operating mode, comprising a data processing device, the data processing device being set up to convert a trigger predetermined for an operating mode change from an actual operating mode Receive and/or recognize the target operating mode, check predetermined preconditions for the target operating mode, and initiate the operating mode change if all predetermined preconditions are met, and for this purpose transmit a control signal to affected components of the vehicle, a respective acknowledgment signal for to receive a successful operating mode change from the affected components and to cause the vehicle to be transferred to a safe state if the acknowledgment signal from at least one of the components is missing.

Furthermore, in particular, a system for a vehicle is created, comprising at least one component of the vehicle, wherein the at least one component has a configuration for a has manual and at least one automated operating mode, and wherein the at least one component is set up to carry out an operating mode change after receiving a control signal by changing the configuration and to acknowledge a successful operating mode change by means of an acknowledgment signal; and a control module according to one of the described embodiments.

The method, the device and the system make it possible to carry out an operating mode change on the vehicle in an improved manner. In particular, a failure of the operating mode change can be prevented, since in this case the vehicle is transferred to a safe state. This is achieved by receiving and/or recognizing a predetermined trigger for an operating mode change from an actual operating mode to a target operating mode. A trigger is in particular a trigger signal or a trigger condition. Prerequisites specified for the target operating mode are also checked before an operating mode change is initiated. The operating mode is changed if all predetermined preconditions are met, and after receiving the predetermined trigger, a control signal is transmitted to affected components of the vehicle. The transmission takes place, for example, via a communication connection set up for this purpose, for example via a Controller Area Network (CAN) bus and/or another suitable communication bus. After transmitting the control signal, a respective acknowledgment signal for a successful operating mode change is generated by the affected components, transmitted to the control module or the data processing device and received by it. If the acknowledgment signal is missing for at least one of the components, the vehicle is transferred to a safe state. A safe state is, for example, a complete standstill of the vehicle due to emergency braking and/or stopping at the side of the road. For this purpose, in particular, a corresponding emergency control command is generated and transmitted to relevant components (e.g. brake control).

An advantage of the method and the control module is that an operating mode change can only take place if the specified preconditions are met. Another advantage is that the vehicle can only continue to be operated after the operating mode change has been initiated if all components affected by the operating mode change have successfully changed from the actual operating mode to the target operating mode and this has also been acknowledged by means of a respective acknowledgment signal or sent to the control module have reported back. A component can be both a hardware component of the vehicle, for example a control unit, and a software component of the vehicle. In particular, the component has multiple configurations, one for each operating mode, and can provide different functionalities according to the multiple configurations. The component is designed in such a way that it acknowledges a control signal for the operating mode change by means of an acknowledgment signal after the operating mode change has been successfully completed. A steering module is mentioned as an example component: In the automated operating mode, this component must implement control commands from a central trajectory specification, while in the manual operating mode it must apply or initiate a steering torque in accordance with the driver's request.

Parts of the control module, in particular the data processing device, can be designed individually or collectively as a combination of hardware and software, for example as program code that is executed on a microcontroller or microprocessor. However, it can also be provided that parts are designed individually or combined as an application-specific integrated circuit (ASIC) and/or field-programmable gate array (FPGA). In principle, it can also be provided that the method and the control module are executed or designed in a central computer of the vehicle, for example in the form of a software module that is executed on a data processing device of the central computer.

A vehicle is in particular a motor vehicle. In principle, the vehicle can also be another land, rail, water, air or space vehicle, for example an air taxi or a drone.

Examples of predefined preconditions and triggers for various operating mode changes, that is, for various transitions between an actual operating mode and a target operating mode, are listed below:

1) Actual operating mode: “deactive” and target operating mode: “automatic”

• - Aktorik funktionsfähig, z.B. Lenkung, Bremse, Antrieb, Energie;
• - Sensorik funktionsfähig, z.B. Kamera, Lidar, Ultraschall, Radar, Beschleunigungssensoren, Bewegungssensoren, Globales Positionierungssystem (GPS);
• - Umweltbedingungen entsprechen der Betriebserlaubnis, z.B. kein Regen, Temperatur >0°C, Lichtstärke >20 Lux usw.;
• - Fahrzeug befindet sich in der erlaubten Betriebsumgebung, z.B. Braunschweig, öffentliche Straße usw.;
• - Verbindungen zu einem Backendserver oder zu anderen Fahrzeugen bestehen;
• - Fahrzeug steht sicher geparkt, z.B. ist eine Feststellbremse angezogen;
• - Benutzung des Fahrzeugs wurde legitimiert durch den Besitzer, z.B. über authentifizierte Backendkommunikation oder Zündschlüssel;

Preconditions (“and” linked):

• - Actuators are functional, e.g. steering, brakes, drive, energy;
• - Sensors functional, e.g. camera, lidar, ultrasound, radar, acceleration sensors, motion sensors, global positioning system (GPS);
• - Environmental conditions correspond to the operating permit, e.g. no rain, temperature >0°C, light intensity >20 lux, etc.;
• - Vehicle is in the permitted operating environment, e.g. Braunschweig, public road, etc.;
• - There are connections to a backend server or to other vehicles;
• - The vehicle is safely parked, e.g. a parking brake is applied;
• - Use of the vehicle was authorized by the owner, e.g. via authenticated backend communication or ignition key;

• - menschlicher Überwacher erteilt den Befehl zum Wechsel in den automatisierten Betriebsmodus, z.B. aus einer Steuerzentrale über die Anbindung an den Backendserver;
• - Passagier/Fahrer im Fahrzeug drückt eine „Start automatisch“-Taste;
• - Servicemitarbeiter gibt einen Aktivierungscode über ein Programmiergerät ein.

Trigger (“or” linked):

• - human monitor issues the command to switch to automated operating mode, e.g. from a control center via the connection to the backend server;
• - Passenger/driver in the vehicle presses an “automatic start” button;
• - Service employee enters an activation code using a programming device.

2) Actual operating mode: “deactive” and target operating mode: “manual”

• - Aktorik funktionsfähig, z.B. Lenkung, Bremse, Antrieb, Energie;
• - manuelle Kontrolleingaben funktionsfähig, z.B. Lenkrad, Bremspedal, Fahrpedal;
• - Fahrer sitzt auf dem Fahrersitz und ist angeschnallt, z.B. Sitzbelegung erkannt und Gurtschloss eingerastet;
• - Benutzung des Fahrzeugs wurde legitimiert durch den Besitzer, z.B. über authentifizierte Backendkommunikation oder Zündschlüssel;

Preconditions (“and” linked):

• - Actuators are functional, e.g. steering, brakes, drive, energy;
• - manual control inputs functioning, e.g. steering wheel, brake pedal, accelerator pedal;
• - Driver sits in the driver's seat and is wearing a seat belt, e.g. seat occupancy detected and seat belt buckle engaged;
• - Use of the vehicle was authorized by the owner, e.g. via authenticated backend communication or ignition key;

• - Passagier/Fahrer im Fahrzeug drückt eine „Start manuell“-Taste.

Trigger (“or” linked):

• - Passenger/driver in the vehicle presses a “manual start” button.

3) Actual operating mode: “manual” and target operating mode: “automatic”

• - Sensorik funktionsfähig, z.B. Kamera, Lidar, Ultraschall, Radar, Beschleunigungssensoren, Bewegungssensoren, GPS;
• - Umweltbedingungen entsprechen der Betriebserlaubnis, z.B. kein Regen, Temperatur >0°C, Lichtstärke >20 Lux usw.;
• - Fahrzeug befindet sich in der erlaubten Betriebsumgebung, z.B. Braunschweig, öffentliche Straße usw.;
• - Verbindungen zum Backendserver oder zu anderen Fahrzeugen bestehen;
• - Fahrzeug steht sicher geparkt, z.B. Feststellbremse angezogen;

Preconditions (“and” linked):

• - Sensors functional, e.g. camera, lidar, ultrasound, radar, acceleration sensors, motion sensors, GPS;
• - Environmental conditions correspond to the operating permit, e.g. no rain, temperature >0°C, light intensity >20 lux, etc.;
• - Vehicle is in the permitted operating environment, e.g. Braunschweig, public road, etc.;
• - There are connections to the backend server or other vehicles;
• - Vehicle is safely parked, e.g. parking brake applied;

• - Menschlicher Überwacher erteilt den Befehl zum Wechsel in den automatisierten Betriebsmodus, z.B. aus der Steuerzentrale über die Anbindung ans Backend;
• - Passagier/Fahrer im Fahrzeug drückt die „Start automatisch“-Taste;
• - Servicemitarbeiter gibt einen Aktivierungscode über ein Programmiergerät ein.

Trigger (“or” linked):

• - Human supervisor issues the command to switch to automated operating mode, e.g. from the control center via the connection to the backend;
• - Passenger/driver in the vehicle presses the “Start automatically” button;
• - Service employee enters an activation code using a programming device.

4) Actual operating mode: “automatic” and target operating mode: “manual”

• - manuelle Kontrolleingaben funktionsfähig, z.B. Lenkrad, Bremspedal, Fahrpedal;
• - Fahrer sitzt auf dem Fahrersitz und ist angeschnallt, z.B. Sitzbelegung erkannt und Gurtschloss eingerastet;
• - Benutzung des Fahrzeugs wurde legitimiert durch den Besitzer, z.B. über authentifizierte Backendkommunikation oder Zündschlüssel;

Preconditions (“and” linked):

• - manual control inputs functioning, e.g. steering wheel, brake pedal, accelerator pedal;
• - Driver sits in the driver's seat and is wearing a seat belt, e.g. seat occupancy detected and seat belt buckle engaged;
• - Use of the vehicle was authorized by the owner, e.g. via authenticated backend communication or ignition key;

• - Passagier/Fahrer im Fahrzeug drückt die „Start manuell“-Taste;
• - Fahrer bringt ein Lenkmoment am Lenkrad auf, z.B. >3 Nm für >0,5 s;
• - Fahrer betätigt das Bremspedal, z.B. >1,5 cm für >0,5 s;
• - Fahrer betätigt das Gaspedal, z.B. >1,5 cm für >0,5 s.

Trigger (“or” linked):

• - Passenger/driver in the vehicle presses the “Manual Start” button;
• - Driver applies a steering torque to the steering wheel, e.g. >3 Nm for >0.5 s;
• - Driver presses the brake pedal, e.g. >1.5 cm for >0.5 s;
• - Driver presses the accelerator pedal, e.g. >1.5 cm for >0.5 s.

5) Actual operating mode: “automatic” and target operating mode: “deactive”

• - Fahrzeug steht sicher geparkt, z.B. Feststellbremse angezogen;

Preconditions (“and” linked):

• - Vehicle is safely parked, e.g. parking brake applied;

• - Menschlicher Überwacher erteilt den Befehl zum Wechsel in den automatisierten Betriebsmodus, z.B. aus der Steuerzentrale über die Anbindung ans Backend;
• - Passagier/Fahrer im Fahrzeug drückt die „Stop“-Taste.

Trigger (“or” linked):

• - Human supervisor issues the command to switch to automated operating mode, e.g. from the control center via the connection to the backend;
• - Passenger/driver in the vehicle presses the “Stop” button.

6) Actual operating mode: “manual” and target operating mode: “deactive”

• - Fahrzeug steht sicher geparkt, z.B. Feststellbremse angezogen;

Preconditions (“and” linked):

• - Vehicle is safely parked, e.g. parking brake applied;

• - Passagier/Fahrer im Fahrzeug drückt die „Stop“-Taste.

Trigger (“or” linked):

• - Passenger/driver in the vehicle presses the “Stop” button.

In one embodiment it is provided that the absence of the acknowledgment signal of affected components is determined if the acknowledgment signal is not received within a predetermined period of time after the control signal has been transmitted to the affected components. This allows a maximum time limit for confirmation to be specified and checked by the respective acknowledgment signal. Depending on the number of components affected, the specified duration can be in the range from a few 10 milliseconds to a few 100 milliseconds. It can also be provided that the predetermined duration is predetermined depending on the actual operating mode and/or the target operating mode and/or a number of affected components. As a result, the specified duration can be adjusted depending on the situation and/or operating mode.

In one embodiment it is provided that the predefined preconditions are specified or selected depending on the situation. This allows you to react flexibly to any current situation. A situation can affect both a situation inside the vehicle and outside the vehicle. Examples include the following situations: a vehicle in production, a vehicle has identified a defect, a vehicle is being operated outside of a specified operating range, or the vehicle is being tested with a new configuration of hardware and software. For each of these situations mentioned as examples, other preconditions can then be specified or selected.

In one embodiment it is provided that predetermined triggers are predetermined or selected depending on the situation. This allows you to react flexibly to any current situation. A situation can affect both a situation inside the vehicle and outside the vehicle. For example, a special input device and/or a special interface can be provided with which the trigger can be detected and/or provided. For a vehicle in production, the trigger can be detected, generated and/or provided, for example, via a production programming device. For a vehicle that has suffered and/or is identified as having a defect, the trigger can be activated using a special key provided by a service technician. For a vehicle that is operated outside of a predetermined operating range and/or that is operated/tested with new configurations of hardware and software, a safety driver is usually necessary; the trigger can then be activated via a or on a steering wheel and/or via a brake can be detected and/or generated and/or provided.

In one embodiment it is provided that the control signal is generated according to one of several internal states of a state machine, the internal states corresponding to the operating modes of the vehicle, wherein a manual operating mode, at least one automated operating mode and an operating mode in which the vehicle is deactivated , is provided. This means that it is always known which (actual) operating state the vehicle is currently in. The internal state represents this (actual) operating state. As a result, the control signal can be specifically tuned for the operating mode change.

Further features for the design of the control module result from the description of embodiments of the method. The advantages of the control module are the same as in the embodiments of the method.

• 1 eine schematische Darstellung einer Ausführungsform des Steuermoduls für ein Fahrzeug;
• 2 ein schematisches Ablaufdiagramm einer Ausführungsform des Verfahrens zum Betreiben eines Fahrzeugs.

The invention is explained in more detail below using preferred exemplary embodiments with reference to the figures. Here show:

• 1 a schematic representation of an embodiment of the control module for a vehicle;
• 2 a schematic flowchart of an embodiment of the method for operating a vehicle.

The 1 shows a schematic representation of an embodiment of the control module 1 for a vehicle 50. The control module 1 is arranged in the vehicle 50 and, together with several components 51 of the vehicle 50, forms a system 60. The components 51 are, for example, control devices or control modules of the vehicle 50, for example a steering control, a traction control, etc. The control module 1 is in particular special designed to carry out the method described in this disclosure.

The control module 1 includes a data processing device 2. The data processing device 2 includes a computing device 2-1 and a memory 2-2. The data processing device 2 is set up to receive and/or recognize a trigger 10 specified for an operating mode change from an actual operating mode to a target operating mode, to check predetermined preconditions 11 for the target operating mode, and to initiate the operating mode change, if all predetermined preconditions 11 are met, and for this purpose a control signal 20 is transmitted to affected components 51 of the vehicle 50 and a respective acknowledgment signal 21 for a successful operating mode change is received from the affected components 51.

If the acknowledgment signal 21 from at least one of the components 51 is missing, the data processing device 2 causes the vehicle 50 to be transferred to a safe state. For this purpose, the control module 1 generates, for example, an emergency control command 22 and supplies it to the relevant components 51, for example a brake control, which triggers emergency braking of the vehicle 50.

In particular, it is provided that the control signal 20 is generated according to one of several internal states of a state machine 3, the internal states corresponding to the operating modes of the vehicle 50, wherein a manual operating mode 30, at least one automated operating mode 31 and an operating mode 32, in which the vehicle 50 is deactivated, is provided.

It can be provided that the absence of the acknowledgment signal 21 of affected components 51 is determined if the acknowledgment signal 21 is not received within a predetermined duration 12 after transmission of the control signal 20 to the affected components 51. For example, a predetermined duration may be 12,100 milliseconds (or another suitable value). After the control signal 20 has been transmitted, the data processing device 2 in particular starts a timer (“timer”) in order to check the predetermined duration 12. If not all acknowledgment signals 21 of the affected components 51 have arrived after the timer has expired, the data processing device 2 causes the vehicle 50 to be transferred to a safe state.

It can be provided that the predefined preconditions 11 are specified or selected depending on the situation. For this purpose, it can be provided that a current situation, for example in an environment of the vehicle 50, a context in which the vehicle 50 is located and/or a situation in the interior of the vehicle 50 is detected by means of a suitable sensor system (not shown) and/or or is recognized and is supplied as an input signal to the control module 1, which takes the current situation into account when setting and / or selecting the predetermined preconditions 11.

It can be provided that predetermined triggers 10 are predetermined or selected depending on the situation. The implementation takes place in particular in a manner analogous to the specified preconditions 11.

The 2 shows a schematic flowchart of an embodiment of the method for operating a vehicle. The method is carried out in particular by means of a control module according to one of the described embodiments.

In a measure 100, a predetermined trigger for an operating mode change from an actual operating mode to a target operating mode is received and/or recognized. Examples of triggers are listed in the general description.

In a measure 101, predetermined preconditions for the target operating mode are checked. Examples of predefined preconditions are listed as examples in the general description. If the specified preconditions are not met, a corresponding message is generated and output in a measure 102. Then continue with measure 100.

However, if the predetermined preconditions are met, a change in operating mode is initiated in a measure 103, for which a control signal is transmitted to affected components of the vehicle.

In measure 104, a respective acknowledgment signal for a successful operating mode change is received from the affected components.

A measure 105 checks whether acknowledgment signals have been received for all affected components. If this is not the case, that is, if the acknowledgment signal from at least one of the components has not been received, the vehicle is transferred to a safe state in a measure 106. However, if this is the case, then In a measure 107, for example, output a confirmation message that the operating mode change was successfully completed.

Reference symbol list

1

Control module

2

Data processing device

2-1

Computing facility

2-2

Storage

3

State machine

10

trigger

11

predetermined preconditions

12

specified duration

20

Control signal

21

Acknowledgment signal

22

Emergency control command

30

manual operating mode

31

automated operating mode

32

deactivated operating mode

50

vehicle

51

component

60

system

100-107

Measures of the procedure

QUOTES INCLUDED IN THE DESCRIPTION

This list of documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102015122513 A1 [0004]

Claims (10)

Method for operating a vehicle (50), wherein the vehicle (50) can be operated in a manual and in at least one automated operating mode, wherein a predetermined trigger (10) for an operating mode change from an actual operating mode to a target operating mode is received and/or recognized, wherein predetermined preconditions (11) for the target operating mode are checked, the operating mode being changed if all predetermined preconditions (11) are met, for which purpose a control signal (20) is transmitted to affected components (51) of the vehicle (50). , wherein a respective acknowledgment signal (21) for a successful operating mode change is received by the affected components (51), and the vehicle (50) is transferred to a safe state if the acknowledgment signal (21) is missing from at least one of the components (51). . Procedure according to Claim 1 , characterized in that the absence of the acknowledgment signal (21) of affected components (51) is determined if the acknowledgment signal (21) is not received within a predetermined period (12) after transmitting the control signal (20) to the affected components (51). . Procedure according to Claim 1 or 2 , characterized in that the predetermined preconditions (11) are specified or selected depending on the situation. Method according to one of the preceding claims, characterized in that predetermined triggers (10) are predetermined or selected depending on the situation. Method according to one of the preceding claims, characterized in that the control signal (20) is generated according to one of several internal states of a state machine, the internal states corresponding to the operating modes of the vehicle (50), wherein a manual operating mode, at least one automated operating mode and an operating mode in which the vehicle (50) is deactivated is provided. Control module (1) for a vehicle (50), wherein the vehicle (50) can be operated in a manual and at least one automated operating mode, comprising: a data processing device (2), the data processing device (2) being set up to to receive and/or recognize a trigger (10) specified for an operating mode change from an actual operating mode to a target operating mode, to check predetermined preconditions (11) for the target operating mode, and to initiate the operating mode change, provided that all predetermined preconditions (11) are met, and to transmit a control signal (20) to affected components (51) of the vehicle (50), to receive a respective acknowledgment signal (21) for a successful operating mode change from the affected components (51), and to cause the vehicle (50) to be transferred to a safe state if the acknowledgment signal (21) from at least one of the components (51) is missing. Control module (1). Claim 6 , characterized in that the data processing device (2) is further set up to determine the absence of the acknowledgment signal (21) of affected components (51) if the acknowledgment signal (21) is not received within a predetermined period (12) after transmitting the control signal (20). is received to the affected components (51). Control module (1). Claim 6 or 7 , characterized in that the predetermined preconditions (11) are specified or selected depending on the situation. Control module (1) according to one of the Claims 6 until 8th , characterized in that predetermined triggers (10) are specified or selected depending on the situation. System (60) for a vehicle (50), comprising: at least one component (51) of the vehicle (50), wherein the at least one component (51) has a configuration for a manual and at least one automated operating mode, and wherein the at least one Component (51) is set up to carry out an operating mode change after receiving a control signal (20) by changing the configuration and to acknowledge a successful operating mode change by means of an acknowledgment signal (21); and a control module according to one of the Claims 6 until 9 .

Images