WO2018141545A1

WO2018141545A1 - Method and device for checking the plausibility of a vehicle trajectory in order to control a vehicle

Info

Publication number: WO2018141545A1
Application number: PCT/EP2018/051074
Authority: WO
Inventors: Marlon Ramon EWERT
Original assignee: Robert Bosch Gmbh
Priority date: 2017-01-31
Filing date: 2018-01-17
Publication date: 2018-08-09
Also published as: DE102017201517A1

Abstract

The invention relates to a method for checking the plausibility of a vehicle trajectory in order to control a vehicle (100), wherein the vehicle (100) has a control device (104) comprising a storage unit (106) for storing vehicle trajectories. In said method, the storage unit (106) is read in order to obtain a stored vehicle trajectory (108). This is subsequently compared with a vehicle trajectory to be travelled in order to check the plausibility of the vehicle trajectory to be travelled.

Description

Description title

Method and device for plausibility of a vehicle trajectory for controlling a vehicle

State of the art

The invention is based on a device or a method according to the preamble of the independent claims. The subject of the present invention is also a computer program.

There are known vehicles that do without drivers. The vehicles drive autonomously by, for example, a road course, others

Identify road users or obstacles independently, calculate corresponding control commands and forward them to appropriate actuators in the vehicle, so that the driving behavior of the vehicle can be influenced correctly. The driver is not involved in a fully autonomous vehicle on the ride.

Disclosure of the invention

Against this background, with the approach presented here, a method for checking the plausibility of a vehicle trajectory for controlling a vehicle, a device using this method, and finally a corresponding computer program according to the main claims are presented. The measures listed in the dependent claims are advantageous developments and improvements in the independent

Claim specified device possible. A method for plausibility checking of a vehicle trajectory for controlling a vehicle is presented, wherein the vehicle has a control unit with a storage unit for storing vehicle trajectories, the method comprising the following steps:

Reading the memory unit to obtain a stored vehicle trajectory; and

Compare the stored vehicle trajectory with a vehicle trajectory to be traversed in order to make the trajectory of the vehicle trajectory plausible.

A vehicle trajectory can be understood, for example, as a data record based on a digital map with control commands for navigating the vehicle. The vehicle trajectory can be calculated, for example, during operation of the vehicle by the control unit. The stored vehicle trajectory can be, for example, a vehicle trajectory calculated by the control unit at an earlier time and then stored in the storage unit. Under one

To be traversed vehicle trajectory, for example, a last from

Control unit received vehicle trajectory are understood. Under a

In the present case, for example, recognizing a plausibility can be understood as plausible.

The approach presented here is based on the knowledge that a vehicle trajectory calculated by a control unit of a vehicle is in conflict with

unauthorized changes, such as in the context of a hacker attack, can be protected by the vehicle trajectory is compared with a stored in the control unit vehicle trajectory. As a result, the safety during autonomous driving in an autonomous vehicle can be significantly increased.

According to one embodiment, in the step of comparing the

vehicle trajectory are recognized as plausible if the vehicle trajectory to be traversed and the stored vehicle trajectory coincide with one another within a tolerance range. This will a simple and quick plausibility check of the vehicle trajectory to be traveled or recognition of a plausible vehicle to be driven off

Vehicle trajectory allows.

According to another embodiment, the method may include a step of outputting a control signal for controlling the vehicle. In this case, the control signal for controlling the vehicle can be output in accordance with the vehicle trajectory to be traveled if, in the step of the comparison, the vehicle trajectory to be traveled has been recognized as plausible. Additionally or alternatively, the control signal for controlling the vehicle according to the stored vehicle trajectory or to decelerate the vehicle can be output if in the step of the comparison the vehicle trajectory to be traveled has not been recognized as plausible. As a result, dangerous traffic situations can be avoided.

Furthermore, in the read-out step, the memory unit can be read in order to obtain a reference trajectory generated by the control unit as the stored vehicle trajectory. For example, a reference trajectory can be understood as a desired trajectory of the vehicle classified as safe. This embodiment enables a reliable plausibility check of the vehicle trajectory to be traveled.

It is also advantageous if in a step of saving the

Reference trajectory is stored in the memory unit to at least one storage time. The storage time may represent a time determined by means of a key assigned to the vehicle. As a result, the storage of security-relevant data in the storage unit can be regulated.

In particular, in the step of storing the reference trajectory can be stored cyclically. This will result in a continuous saving of

Reference trajectories allows. Thus, a possible current reference trajectory can always be stored in the memory unit. The method may include a step of preventing write access to the memory unit outside of the storage time. As a result, the storage unit can be reliably protected against unauthorized access from the outside, for example in the context of a hacker attack.

According to a further embodiment, in the step of storing, the reference trajectory can be transmitted via a communication interface of the vehicle to an external storage unit in order to store the reference trajectory in the external storage unit. In this case, in the readout step, the external memory unit can be read out via the communication interface in order to obtain an externally stored vehicle trajectory.

Accordingly, in the step of comparing, the externally stored

Vehicle trajectory are compared with the vehicle trajectory to be traversed to recognize the trajectory to be trajectory as plausible. Under an external storage unit, for example, a central

Data server to communicate with a plurality of semi-or highly automated vehicles are understood. The combination interface may, for example, be an interface for car-to-car communication, which serves to exchange information and data between motor vehicles. The purpose of such data exchange may be to inform critical drivers of critical and dangerous situations at an early stage. In addition, the communication interface can be used to exchange vehicle-specific data between vehicles. For this purpose, the vehicles in question collect, for example, data such as ABS interventions, steering angle, position, direction or speed and send them, for example via radio (WLAN, UMTS) to other road users. Thus, the respective "visibility" of the driver can be extended by electronic means.The communication interface can also be designed for car-to-infrastructure communication, which can be understood as the exchange of data between the vehicle and a surrounding infrastructure such as traffic light installations or the like The mentioned communication technologies are therefore based on the

Interaction of sensors of different traffic partners. By this embodiment, the calculated by the controller

Vehicle trajectory are stored centrally. This allows the Processing of the vehicle trajectory can be simplified or made available to other road users

This method can be implemented, for example, in software or hardware or in a mixed form of software and hardware, for example in a control unit.

The approach presented here also provides a device which is designed to implement the steps of a variant of a method presented here

to implement, control or implement appropriate facilities. Also by this embodiment of the invention in the form of a device, the object underlying the invention can be solved quickly and efficiently.

For this purpose, the device may comprise at least one computing unit for processing signals or data, at least one memory unit for storing signals or data, at least one interface to a sensor or an actuator for reading sensor signals from the sensor or for outputting data or control signals to the sensor Actuator and / or at least one

Communication interface for reading or outputting data embedded in a communication protocol. The arithmetic unit may be, for example, a signal processor, a microcontroller or the like, wherein the memory unit is a flash memory, an EPROM or a

magnetic storage unit can be. The communication interface can be designed to read or output data wirelessly and / or by line, wherein a communication interface that can read or output line-bound data, for example, electrically or optically read this data from a corresponding data transmission line or output in a corresponding data transmission line.

In the present case, a device can be understood as meaning an electrical device which processes sensor signals and outputs control and / or data signals in dependence thereon. The device may have an interface, which may be formed in hardware and / or software. In a hardware training, the interfaces, for example, part of a so-called system ASICs, which includes a variety of functions of the device. However, it is also possible that the interfaces are their own integrated circuits or at least partially consist of discrete components. In a software training, the interfaces may be software modules that are present, for example, on a microcontroller in addition to other software modules.

In an advantageous embodiment, the device is used to control the vehicle. For this purpose, the device can access, for example, sensor signals such as acceleration, pressure, steering angle or environmental sensor signals. The control takes place via actuators such as brake or steering actuators or an engine control unit of the vehicle.

Also of advantage is a computer program product or computer program with program code which can be stored on a machine-readable carrier or storage medium such as a semiconductor memory, a hard disk memory or an optical memory and for carrying out, implementing and / or controlling the steps of the method according to one of the above

described embodiments, in particular when the program product or program is executed on a computer or a device.

Embodiments of the invention are illustrated in the drawings and explained in more detail in the following description. It shows:

1 shows a schematic representation of a vehicle with a device according to an embodiment;

Fig. 2 is a schematic representation of a device according to a

Embodiment; and

3 is a flowchart of a method according to a

Embodiment. In the following description of favorable embodiments of the present invention are for the in the various figures

represented and similar elements acting the same or similar

Reference numeral used, wherein a repeated description of these elements is omitted.

1 shows a schematic representation of a vehicle 100 having a device 102 for checking the plausibility of a vehicle trajectory for controlling the vehicle 100. The vehicle 100 is, for example, a highly-automated vehicle, also called an autonomous vehicle, which is equipped with a corresponding driver assistance system. In which

Driver assistance system is an electronic option to assist the driver in certain driving situations. Here, safety aspects, but also the increase in ride comfort can be in the foreground. The driver assistance system can partially autonomously or autonomously intervene in drive, control (gas or brake), steering or signaling devices of the vehicle 100 or warn the driver of a suitable man-machine interface shortly before or during critical situations. The driver assistance system, for example, is designed so that the responsibility remains with the driver and this is not incapacitated. The

Driver assistance system can be used depending on the embodiment with various types of environment sensors, among others

Ultrasonic (parking aid), radar (lane change assistant, automatic

Distance warning), Lidar (blind spot monitoring, automatic

Distance warning, distance control, pre-crash and pre-brake) or

Cameras (lane departure warning, traffic sign recognition,

Lane change assistant, blind spot monitoring, emergency braking system for

Pedestrian protection).

According to this exemplary embodiment, the device 102 is realized as a component of a control device 104 of the vehicle 100, wherein the control device 104 comprises a memory unit 106 for storing vehicle trajectories. The device 102 is designed to read the memory unit 106. In this case, the device 102 receives from the memory unit 106 a stored vehicle trajectory 108. This is supplied by the device 102 with a vehicle trajectory to be traveled, which is, for example, a vehicle trajectory presently present to the control device 104, compared in order to make the vehicle trajectory to be plausibility checked. Depending on the result of the comparison, the device 102 outputs a corresponding control signal 110 for controlling the vehicle 100.

The control signal 110 serves, for example, to control various actuators of the vehicle 100, such as steering, engine control or brake, in order to control the vehicle 100 along the vehicle trajectory to be traveled, for example when the vehicle trajectory to be traveled substantially coincides with the vehicle trajectory

stored vehicle trajectory 108, or to control along the stored vehicle trajectory 108, such as when

Comparison results in a deviation between the vehicle trajectory to be traveled and the stored vehicle trajectory 108. In this case, the control signal 110 is also generated, for example, to bring the vehicle 100 to a halt or at least slow it down.

The stored vehicle trajectory 108 is in particular a reference trajectory generated by the control unit 104, which is stored cyclically in the memory unit 106, for example at previously calculated times. The calculation of these storage times takes place, for example, using a specific

Calculation key, which may be associated with the vehicle 100 specifically.

According to a further embodiment, the control unit 104 not only stores the reference trajectory in the memory unit 106, but additionally sends it in the form of a corresponding data stream 111 via an appropriate communication interface 112 of the vehicle 100 to an external one

Memory unit 114, such as a central data server of a cloud, where the reference trajectory is stored outside the vehicle. The device 102 accordingly reads out the external memory unit 114 to read the

Obtain reference trajectory as externally stored vehicle trajectory 118 and to compare them with the vehicle trajectory to be traced to their plausibility. In this way, the calculation of the vehicle trajectories in the vehicle 100 can be reliably protected against attacks by hackers.

FIG. 2 shows a schematic representation of a device 102 according to an exemplary embodiment, for example as described above with reference to FIG. 1

Contraption. The device 102 comprises a readout unit 210 for

Receiving the stored vehicle trajectory 108 from the memory unit 106 of the controller and a comparison unit 220 for comparing the stored vehicle trajectory 108 with the traversed

Vehicle trajectory. For this purpose, the comparison unit 220 reads a the

trajectory data set 222 representing the vehicle trajectory to be traveled.

According to this embodiment, the device 102 is additionally equipped with an output unit 230 for outputting the control signal 110 in dependence on a plausibility value 232 provided by the comparison unit 220.

FIG. 3 shows a flowchart of a method 300 according to FIG

Embodiment. The method 300 for plausibility of a

For example, vehicle trajectory for controlling a vehicle may be performed using a device as described above with reference to FIGS. 1 and 2. In this case, in a step 310, the memory unit is read to obtain the stored vehicle trajectory. In a further step 320, the stored vehicle trajectory is compared with the vehicle trajectory to be traveled by the vehicle in order to make it plausible.

Hereinafter, various embodiments of the approach presented here will be described again in other words.

An autonomous vehicle usually calculates itself the vehicle trajectory, which is automatically run by the vehicle if the vehicle is in autonomous operation. In this case, the vehicle trajectory already calculated in the vehicle during ongoing vehicle operation, for example by a hacker, to be changed. At this point, the approach presented here comes into play, because the device 102 can significantly increase safety during an autonomous journey in an autonomous vehicle.

The increase in safety refers to the protection of a vehicle trajectory, which was calculated by the autonomous vehicle and is to be driven off the autonomous vehicle.

According to one embodiment, the vehicle trajectory is stored cyclically in a secure shadow register of the vehicle control unit. Before the execution of the control commands of the vehicle trajectory, the vehicle trajectory is compared with the vehicle trajectory stored in the shadow register. Only when both vehicle trajectories are identical within a tolerance does the processing of the vehicle trajectory in the vehicle take place. Otherwise it can be assumed that the vehicle trajectory has been hacked. In this case, the secured vehicle trajectory is executed or the vehicle is brought to a safe state by, for example, braking and parking it in a controlled manner until the damage or hack has been rectified.

According to an alternative embodiment, the vehicle trajectory is cyclically secured in a cloud, for example via a car-to-X communication connection between the vehicle and the cloud. Before the execution of the control commands of the vehicle trajectory, a comparison of

Vehicle trajectory with the vehicle trajectory stored in the cloud. Only when both vehicle trajectories are identical within a tolerance does the processing of the vehicle trajectory in the vehicle take place. Otherwise it can be assumed that the vehicle trajectory has been hacked. In this case, the secured vehicle trajectory is executed or the vehicle is brought to a safe state by, for example, being braked in a controlled manner (via the cloud) and switched off until the damage or hack has been rectified.

According to a further embodiment, the vehicle trajectory is again cyclically secured in the cloud. Before processing the control commands of the vehicle trajectory, the vehicle trajectory is compared with the vehicle trajectory stored in the cloud. In the event of a deviation, the cloud checks what the vehicle is going to do. If the result of the calculation is that the vehicle is placed in a critical situation, then the secured

Vehicle trajectory is executed or the vehicle is brought to a safe state, for example, by the controlled slowed down (via the cloud) and turned off until the damage or hack has been corrected. This means that the vehicle trajectory is made plausible within the cloud. h., recognized as plausible. In addition to the vehicle trajectory, the actual vehicle positions between the vehicle and the cloud are exchanged and included in the calculations on the cloud.

By securing the vehicle trajectory, safety in the

Road traffic can be significantly increased and it can be avoided even with hacks serious accidents in traffic. The approach presented here is also applicable if the vehicle has a malfunction and its trajectory suddenly calculated incorrectly.

According to an exemplary embodiment, the storage of the vehicle trajectory takes place in the shadow register or in the cloud by means of an encrypted connection.

To prevent the correct vehicle trajectory in the shadow register or on the cloud by a manipulated or implausible trajectory

is overwritten, the update of the trajectory in the shadow register or in the cloud, for example, only at certain times. For example, the storage time at which a trajectory is saved is calculated using a vehicle-specific key. The backup of the trajectories outside the time points calculated with the key is thus prevented, since the backup times in the shadow register or in the cloud are checked before the trajectory is saved. For example, because a hacker does not know the key, the manipulated trajectory can not immediately in the

Shadow registers or on the cloud to be secured. Instead, the manipulated trajectory immediately by the time comparison or by a

Trajectory comparison between shadow register or cloud and the new trajectory discarded. For example, the calculation of the vehicle trajectory next to the vehicle also takes place in parallel in the cloud. In this case, both trajectories within the cloud are made plausible, ie, recognized as plausible. If the result of the calculation is that the vehicle is put into a critical situation, then the secured vehicle trajectory is executed or the vehicle is brought to a safe state by, for example, controlled braking (via the cloud) and parking until the damage or hack was fixed. With the approach presented here, trajectories of autonomous vehicles can be efficiently secured and compared with newly calculated trajectories, whereby the newly calculated trajectories can be checked for deviations almost in real time and made plausible, ie, plausible. As a result, the safety in traffic can be significantly increased and it can be avoided even with hacks serious accidents on the road, since the vehicles can be transferred to larger trajectory deviations directly into a safe state.

If an exemplary embodiment comprises a "and / or" link between a first feature and a second feature, then this is to be read so that the embodiment according to one embodiment, both the first feature and the second feature and according to another embodiment either only first feature or only the second feature.

Claims

claims

A method (300) for plausibility checking a vehicle trajectory for controlling a vehicle (100), the vehicle (100) comprising a controller (104) having a memory unit (106) for storing vehicle trajectories, the method (300) comprising the steps of: :

Reading (310) the memory unit (106) to a stored one

To obtain vehicle trajectory (108); and

Comparing (320) the stored vehicle trajectory (108) with a vehicle trajectory (222) to be traveled in order to track the vehicle trajectory (222)

Vehicle trajectory (222) to plausibility.

2. The method (300) according to claim 1, wherein in the step of

Comparing (320) the vehicle trajectory (222) to be traveled is recognized as plausible if the vehicle trajectory (222) to be traversed and the stored vehicle trajectory (108) are within one

Tolerance range coincide with each other.

The method (300) according to one of the preceding claims, comprising a step of outputting a control signal (110) for controlling the

Vehicle (100) according to the abzufahrenden

Vehicle trajectory (222), if in the step of comparing (320) the vehicle trajectory (222) to be traveled has been recognized as plausible, and / or for controlling the vehicle (100) according to

stored vehicle trajectory (108) and / or braking of the vehicle (100) if in the step of comparing (320) the vehicle trajectory (222) to be traveled was not recognized as plausible.

4. Method (300) according to one of the preceding claims, in which the memory unit (106) is read in the step of reading out (310), to obtain a reference trajectory generated by the controller (104) as the stored vehicle trajectory (108).

Method (300) according to claim 4, comprising a step of storing the reference trajectory in the memory unit (106) at at least one storage time, wherein the storage time comprises a time determined by means of a key assigned to the vehicle (100)

represents.

The method (300) according to claim 4 or 5, wherein in the step of

Save the reference trajectory is stored cyclically.

A method (300) according to any one of claims 4 to 6, comprising a step of preventing write access to the memory unit (106) outside of the storage time.

Method (300) according to one of claims 4 to 7, wherein in the step of storing the reference trajectory via a

Communication interface (112) of the vehicle (100) to an external memory unit (114) is transmitted to store the reference trajectory in the external memory unit (114), wherein in the step of

Reading (310) the external memory unit (114) over the

Communication interface (112) is read to obtain an externally stored vehicle trajectory (118), wherein in the step of comparing (320) the externally stored vehicle trajectory (118) is compared with the vehicle trajectory (222) to be traveled to the vehicle trajectory (222) to be traversed to be recognized as plausible.

Apparatus (102) comprising units (210, 220, 230) adapted to execute and / or drive the method (300) according to any one of claims 1 to 8.

A computer program configured to execute and / or drive the method (300) according to any one of claims 1 to 8. A machine readable storage medium storing the computer program of claim 10.