WO2019215017A1

WO2019215017A1 - Method, device and computer-readable storage medium containing instructions for monitoring and validating operating data in the actuator system of an autonomous motor vehicle

Info

Publication number: WO2019215017A1
Application number: PCT/EP2019/061287
Authority: WO
Inventors: Ebru Gömek
Original assignee: Volkswagen Aktiengesellschaft
Priority date: 2018-05-09
Filing date: 2019-05-02
Publication date: 2019-11-14
Also published as: DE102018207339A1

Abstract

A method, a device and a computer-readable storage medium containing instructions for monitoring and validating operating data in the actuator system of an autonomous motor vehicle. In a first step, operating parameters of a control system for an autonomous driving mode are recorded (10). These are compared with setpoint values (11). If the operating parameters deviate from the setpoint values, at least the operating values lying outside the setpoint values are stored in a memory (12).

Description

description

Method, apparatus and computer-readable storage medium with instructions for monitoring and validating operating data in the actuator system of an autonomous

motor vehicle

The present invention relates to a method, a device and a computer-readable storage medium with instructions for monitoring and validating operating data in the actuator system of an autonomous motor vehicle. The invention further relates to a

Motor vehicle in which a method according to the invention or a device according to the invention is used.

The development of autonomous motor vehicles is currently being driven forward vigorously. Already in a few years, the first motor vehicles will be on the market that can drive autonomously, at least in selected traffic situations. In addition, systems are developed that can support an autonomous ferry operation.

For example, DE 10 2014 008 578 A1 describes a method for determining position data for use in the operation of a vehicle system of a motor vehicle. By means of a surveillance camera provided externally to the motor vehicle, an environment of the motor vehicle or the motor vehicle itself is detected. The of the

Surveillance camera recorded image data are evaluated to determine position data of a detected object. The detected object may be the motor vehicle or another road user. The position data are at least partially made available to the vehicle system.

DE 10 2016 1020 65 A1 describes a method for supporting an autonomous drive of a motor vehicle on a parking area. An infrastructure map is provided which describes the parking area in a parking area reference system, wherein a

Reference position is specified on the parking area as a reference point for the parking area reference system. In addition, a position of a motor vehicle side

Reference object relative to a located at the reference position parking-side reference object determined by the parking-side reference object or

Vehicle-side reference object is detected by at least one detection device. The infrastructure map is transformed from the parking area reference system into a motor vehicle reference system by setting the position of the motor vehicle side reference object as a reference point for the motor vehicle reference system. When describing autonomous motor vehicles, very different terms are used. For the purposes of the invention, the terms autonomous motor vehicle,

automatic motor vehicle, automated motor vehicle and SDS (SDS: Seif Driving System) used interchangeably.

The development of autonomous motor vehicles creates numerous new business models. It is thus foreseeable that autonomous motor vehicles will be used to operate comprehensive vehicle fleets, which will carry out short-distance passenger transport, especially in the urban environment.

Regardless of their design, safety in ferry operations plays a key role.

In the course of development, it is necessary to identify all conceivable driving scenarios and test them in advance. Thus, the safety standards achieved so far also in the development of non-autonomous motor vehicles should also be achieved for autonomous motor vehicles.

In commercial operation, other aspects come into play. Here, liability issues and the clarification of the question of guilt in the event of an accident should be mentioned.

During a test phase, but also at the beginning of the first commercial applications, it is imperative to ensure that even in highly complex driving situations the autonomous motor vehicle poses no danger. This applies to both

Vehicle occupants as well as for the other road users.

To rule out such a risk fundamentally and permanently, is as

Transitional solution provided for the use of a so-called security driver. Such a safety driver should not during the normal driving or test operation in the

Driving events intervene. Only when a driving situation by the automatic system can not be handled satisfactorily or not, the safety driver must intervene.

In such an intervention in retrospect, the necessary knowledge to

System optimization must be able to draw the system state of the autonomous

Motor vehicle reproducible documented. Likewise, it is necessary to the conditions resulting from the traffic or the vehicle environment capture and describe. For this purpose, extensive data volumes from very different data sources are to be received and fed to an evaluation.

An important technical device for this purpose are so-called data loggers. With them operating data of a motor vehicle can be collected while driving. These data are then evaluated, often a decentralized evaluation

is made. For this purpose, the data is either transmitted via a radio data interface (wireless / digital / over the air) or analyzed after removal of the recording medium in a central evaluation station.

In EP 3 208 775 a method and a system for recording of

Operating data described in a motor vehicle in operation, with the help of a fixed point, both the time recorded before the fixed point data and the time recorded after the fixed point data can be coupled together. The memory technology used here is a ring buffer.

EP 3 057 839 discloses a method for developing and validating

Vehicle safety functions of a vehicle safety system having at least one computer-implemented safety function, a vehicle control unit and one or more vehicle actuators. Come in the process

Datalogger is used to capture relevant vehicle data and the

To test safety function in the vehicle.

DE 10 2015 003 21 1 describes an arrangement for diagnosing a motor vehicle, in particular during the production process. The arrangement has several diagnostic interfaces that communicate with each other.

DE 10 2013 203 501 describes a measured-value acquisition device for recording acquired measured values in a motor vehicle. This detection device has a plurality of data loggers that can communicate with each other.

DE 10 2010 053 955 describes a data logger device with filters

equipped. The collected information can be analyzed and condensed with the help of the filters.

In DE 103 60 125 a method for mitprotokollieren messages on a data bus and buffering the messages sent in a cyclic rewritable, volatile storage means described. In this case, triggered by a defined trigger signal, the data content of the volatile storage medium in the

Transfer memory cells of the non-volatile storage medium.

The object remains to describe a solution for monitoring and validating operating data in the actuators of an autonomous motor vehicle that reliably

can detect problematic situations or incidents, such as an accident or near-miss, of an autonomous ferry operation.

This object is achieved by a method having the features of claim 1, by a computer-readable storage medium with instructions according to claim 8 and by an apparatus having the features of claim 9. Preferred embodiments of the invention are the subject of the dependent claims.

According to a first aspect of the invention, a method for monitoring and validating operating data in the actuator system of an autonomous motor vehicle comprises the steps:

- Detecting operating parameters of a control system for an autonomous

ferry service;

- comparing the operating parameters with setpoints; and

- Storing at least a part of the operating parameters in a memory, if the operating parameters deviate from the desired values.

According to another aspect of the invention, a computer-readable storage medium includes instructions that, when executed by a computer, cause the computer to perform the following steps to monitor and validate operational data in the actuator system of an autonomous motor vehicle:

- Detecting operating parameters of a control system for an autonomous

ferry service;

- comparing the operating parameters with setpoints; and

The term computer is to be understood broadly. In particular, it also includes

Controllers and other processor-based data processing devices.

According to a further aspect of the invention, an apparatus for monitoring and validating operating data in the actuator system of an autonomous motor vehicle comprises: a data processing unit for acquiring operating parameters of a control system for an autonomous ferry operation and for comparing the

Operating parameters with setpoints; and

a memory for storing at least a part of the operating parameters in a memory if the operating parameters deviate from the desired values.

According to the invention, the operating parameters of the control system for the autonomous ferry operation are continuously compared with setpoints in order to identify potentially dangerous situations and to take appropriate measures. For this purpose, at least one algorithm for data collection is used, which is set up in particular to document the nature and extent of the autonomously executed driving functions. By storing at least the deviating operating parameters, but preferably all operating parameters and, if necessary, additional data, a later evaluation is made possible on the basis of which, for example, an adaptation of the

Control system or even the road infrastructure can be made. This adaptation will help to avoid similar potentially dangerous situations in the future. Preferably, the storage takes place in a ring memory. It can be used for the storage of data, a data store, the

is mechanically removed from the motor vehicle and can be evaluated by means of an evaluation device outside the motor vehicle. This has the advantage that a non-time-critical evaluation of the stored data with high computer power is possible. Alternatively, a control unit is used in the motor vehicle, the one

Radio data interface for wireless transmission of the detected operating parameters or other data to an evaluation device outside of the motor vehicle has. This has the advantage that a timely evaluation of the data with high computing power is possible.

According to one aspect of the invention, the operating parameters include control data for acceleration, deceleration or steering operation. The setpoints define permissible value ranges for the control data in this case. To capture the

The algorithm programmed for the validation can document operating parameters in the datalogger, for example, steering forces / steering torques / steering radii, braking forces / braking torques or acceleration forces / acceleration torques. Furthermore, he can also directly generated by the control system for the autonomous ferry operation

Control commands with the corresponding operating parameters for

Steering forces / steering moments, braking forces / braking torques or

Acceleration forces / acceleration moments as well as possible

Evaluate takeover requests to a security driver. Control software for The autonomous ferry service is not regularly developed by the manufacturer of a motor vehicle, but the development is commissioned. In this case, specifications are usually made as to which ranges of values the control data have to adhere to

ensure a pleasant and safe driving experience for vehicle occupants. Exceeding the specified values does not necessarily lead to a dangerous situation, but may possibly be perceived as unpleasant by the vehicle occupants and impair vehicle performance. By means of the solution according to the invention can thus be detected whether the predetermined value ranges are met by the control software, or whether it repeatedly

Overruns are coming. If necessary, then a revision of the control software can be arranged.

According to one aspect of the invention, the control system for the autonomous

Ferry mode deactivated if the operating parameters deviate from the setpoints. In this way it is ensured that in case of potentially dangerous or for the

Vehicle occupants unpleasant situations the safety driver takes control of the motor vehicle.

According to one aspect of the invention, the operating parameters include information that the autonomous ferry control system is deactivated due to extraneous circumstances. Setpoint in this case is the active state of the control system.

External circumstances that may lead to a deactivation of the autonomous ferry control system are, for example, confusing or unclear

Traffic situations or general traffic situations with which the

Control software is overwhelmed, for example, due to deficiencies in the

Road infrastructure. Disabling the autonomous ferry control system ensures that the safety driver takes control.

According to one aspect of the invention, a position of the motor vehicle or surroundings data captured by a sensor system are stored for a certain time before and after a deactivation of the autonomous ferry control system. For this purpose, the at least one sensor is suitable for documenting traffic situations or the existing road infrastructure. This can be done in particular by cameras or Lidarsensoren, with the help of which the environment is monitored by the autonomous motor vehicle. Furthermore, there may be a data interface configured to receive data and / or information from external data sources. Such a data source may in particular be a data source within the surrounding Infrastructure. For example, information from traffic lights can be transmitted to the data processing unit in this way. Based on the additional

stored data can be determined where and why the control system for autonomous ferry operation has been disabled. In this way, situations can be identified that are beyond the control of the control software or the

Control software at least not satisfactory mastered. The data thus obtained can then be used, for example, for a revision of the control software.

According to one aspect of the invention, defects and their exact position in the road infrastructure are determined by means of an accumulation of the stored data. If the autonomous ferry control system is deactivated due to external circumstances, this is often due to deficiencies in the road infrastructure. Examples of such defects are potholes, missing lane markings or traffic lights obscured by branches or damaged by vandalism. By accumulating the collected data such deficiencies can be identified and transmitted to the competent authorities. The removal of the shortcomings not only increases the safety of autonomous vehicles, but also benefits all road users.

In one aspect of the invention, in the event of a pending deactivation of the autonomous ferry control system, the following steps are performed:

Issuing a request to a safety driver to take over manual control of the motor vehicle before deactivating the autonomous ferry control system;

- storing a time of the request;

- To record the type or timing of a safety driver's reaction to the

Request; and

- Save the type or time of reaction of the safety driver.

Before disabling the autonomous ferry control system, the driver should be prompted to undertake manual control of the vehicle. On the one hand this is necessary in order to give the driver sufficient time to take over, but on the other hand this also concerns questions of liability. With the takeover, the driver also assumes responsibility for driving. If the request is not made at all or too late, the security driver can not be held responsible. The latency time, ie the time between the request to the safety driver and the reaction of the safety driver, as well as the type of reaction of the safety driver, can determine the performance or suitability of the safety driver become. A delayed or inappropriate response, such as a groundless braking maneuver, is an indication that the safety driver must be trained. The reaction of the safety driver can be, for example, that a

Steering operation, a braking operation or an acceleration process is initiated or an emergency device is actuated. Safety driver reactions can also be detected by image-processing sensors. These may in particular be camera systems for monitoring the interior of the motor vehicle.

According to one aspect of the invention, interventions of a safety driver in the autonomous ferry operation are detected and stored. For this purpose, the at least one sensor is set up to document manual activities of the safety driver. In particular, the nature and extent of the manual intervention should be documented. These include, for example, intervention by the safety driver such as steering operations, braking or acceleration processes, the operation of emergency equipment or switching to manual ferry operation. This solution has the advantage that even manual operations of the safety driver, which may occur in the form of a driver intervention, can be stored in evaluable form. On the one hand, such interventions allow conclusions to be drawn that irregularities or unusual situations have occurred in autonomous ferry operations, which may require further analysis. On the other hand, an evaluation of the stored information can also be used to evaluate the safety driver and the autonomous ferry operation. For example, if the analysis indicates that the safety driver repeatedly intervenes manually in the autonomous ferry operation without necessity, training for the safety driver may be advisable. If the analysis shows that the autonomous ferry control system does not prompt the security driver in time to take over

Responsible driving responsibility or repeatedly exceeds the setpoint of the operating parameters can be warned by a risk management of the developer of this function in order to achieve an agreed performance early and continue to safely.

Particularly advantageous is a method according to the invention or a device according to the invention in a vehicle, in particular an autonomous motor vehicle.

Further features of the present invention will become apparent from the following description and the appended claims, taken in conjunction with the figures.

Fig. 1 shows schematically a method for monitoring and validating

Operating data in the actuator system of an autonomous motor vehicle; Fig. 2 shows a first embodiment of a device for monitoring and

Validating operating data in the actuator system of an autonomous motor vehicle;

Fig. 3 shows a second embodiment of a device for monitoring and

Validating operating data in the actuator system of an autonomous motor vehicle; and

Fig. 4 schematically illustrates a motor vehicle in which a solution according to the invention is realized.

For a better understanding of the principles of the present invention, embodiments of the invention will be explained in more detail below with reference to the figures. It is understood that the invention is not limited to these embodiments, and that the features described can also be combined or modified without departing from the scope of the invention as defined in the appended claims.

1 schematically shows a method for monitoring and validating operating data in the actuator system of an autonomous motor vehicle. In a first step will be

Operating parameters of a control system for autonomous ferry operation recorded 10. These are compared with setpoints 1 1. The operating parameters include, for example, control data for acceleration, deceleration or steering operation. The setpoints define permissible value ranges for the control data in this case.

Similarly, the operating parameters may include information that the autonomous ferry control system is deactivated due to extraneous circumstances. Setpoint in this case is the active state of the control system. If the operating parameters deviate from the desired values, at least some of the operating parameters are stored in a memory 12. In this case, if necessary, a request 13 is made to a

Safety driver to take a manual control of the motor vehicle. The time of this request is saved. At the same time, the nature or time of the driver's reaction to the request is recorded 14 and stored. in the

15. In this case, a position of the motor vehicle or surroundings data sensed by a sensor system are preferably stored. By means of an accumulation of this stored data, later defects in the road infrastructure and their exact position can be determined. In addition, interventions of the safety driver in the autonomous ferry operation recorded 17 and saved. In the case of a manual intervention, the control system for autonomous ferry operation is deactivated 15. Optionally, in turn, the position of the motor vehicle or environment data captured by the sensor system are stored 16.

2 shows a simplified schematic representation of a first embodiment of a device 20 for monitoring and validating operating data in the actuator system of an autonomous motor vehicle. The device 20 has an input 21, via which sensor data and data of a control system for an autonomous ferry operation can be received. The apparatus 20 also has a data processing unit 22 for detecting operating parameters of a control system for autonomous ferry operation and for comparing the operating parameters with target values. The operating parameters may include, for example, control data for acceleration, deceleration or steering. The setpoints define permissible value ranges for the control data. Furthermore, the operating parameters may include information that the autonomous ferry control system is deactivated due to extraneous circumstances. Setpoint in this case is the active state of the control system. If the comparison reveals that the operating parameters deviate from the desired values, at least a part of the operating parameters is stored in a memory 23 of the device 20. In this case, optionally by an output module 24 a

Request issued to a security driver to take over a manual control of the motor vehicle. The time of this request is written in the memory 23. Optionally, by means of a detection module 25, the type or time of a reaction of the safety driver to the request is recorded and stored in the memory 23.

Afterwards the control system for the autonomous ferry operation can be deactivated. In this case, preferably a position of the motor vehicle or environment data captured by a sensor system are stored in the memory 23. By accumulating this stored data later deficiencies in the road infrastructure can be determined. In addition, 25 interventions by the safety driver in the autonomous ferry operation are detected by the detection module and noted in the memory 23. In the case of manual intervention, the autonomous ferry control system is deactivated. Optionally, in turn, the position of the motor vehicle or detected by the sensor

Environment data are stored. Via an output 27 of the device 20, the data generated by the components of the device 20 can be output for further processing. In Fig. 2, the storage of the various data is carried out in a memory 23 of the device. The data can also be stored in an external memory or wirelessly transmitted via a wireless data interface to an evaluation device outside the motor vehicle. The data processing unit 22, the output module 24 and the detection module 25 can be controlled by a control unit 26. If necessary, settings of the data processing unit 22, the

Output module 24, the detection module 25 or the control unit 26 are changed. The data processing unit 22, the output module 24, the detection module 25 and the control unit 26 can be implemented as dedicated hardware, for example as integrated circuits. Of course, they can also be partially or fully combined or implemented as software running on a suitable processor, such as a GPU or a CPU. The input 21 and the output 27 may be as separate interfaces or as a combined bidirectional interface

be implemented.

3 shows a simplified schematic representation of a second embodiment of a device 30 for monitoring and validating operating data in the actuator system of an autonomous motor vehicle. The device 30 has a processor 32 and a memory 31. For example, device 30 is a computer or controller. In the memory 31 instructions are stored, the device 30 at

Execution by the processor 32, the steps according to one of

to carry out the described method. The instructions stored in the memory 31 thus embody a program which can be executed by the processor 32 and implements the method according to the invention. The device 30 has an input 33 for receiving information, in particular sensor data and data

Control system for an autonomous ferry operation. Data generated by the processor 32 is provided via an output 34. In addition, they can be stored in the memory 31. The input 33 and the output 34 can be combined to form a bidirectional interface.

The processor 32 may include one or more processing units, such as microprocessors, digital signal processors, or combinations thereof.

The memories 23, 31 of the described embodiments can have both volatile and non-volatile memory areas and a wide variety of memory devices and

Storage media include, for example, hard disks, optical storage media or semiconductor memory. Fig. 4 schematically illustrates a motor vehicle 40 in which a solution according to the invention is realized. The motor vehicle 40 has a control system 41 for an autonomous ferry operation as well as a camera 42, a radar sensor 43, a lidar sensor 44 and a near field sensor system 45 for acquiring environmental data. An information system 46 can be used to interact with a security driver. For example, the

Security driver via the information system 46 are prompted to take over manual control. Furthermore, the motor vehicle 40 has a device 20 for monitoring and validating operating data in the actuator system of the motor vehicle 40. Further components are a data transmission unit 47 and a memory 48 for storing data. By means of the data transmission unit 47, a connection to a service provider can be established, for example for transmitting the acquired operating parameters or environment data. The data exchange between the various components of the motor vehicle 40 takes place via a network 49.

Listing of Operating Parameters of a Control System Comparing the Operating Parameters with Setpoints

Saving at least part of the operating parameters Prompt to take over the manual control Detecting a reaction

Disable the control system

Save position or environment data

Detecting interventions in the autonomous ferry operation device

entrance

Data processing unit

Storage

output module

acquisition module

control unit

output

User interface

contraption

Storage

processor

entrance

output

motor vehicle

Control system for an autonomous ferry operation camera

radar sensor

lidar

Nahfeldsensorik

information system

Data transfer unit

Storage

network

Claims

claims

A method for monitoring and validating operating data in the actuator system of an autonomous motor vehicle (40), comprising the steps of:

- detecting (10) operating parameters of a control system (41) for an autonomous ferry operation;

- comparing (1 1) the operating parameters with setpoints; and

- Storing (12) of at least a part of the operating parameters in a memory (23), if the operating parameters deviate from the desired values.

2. The method of claim 1, wherein the autonomous ferry control system (41) is deactivated (15) if the operating parameters deviate from the desired values.

3. The method of claim 1, wherein the operating parameters include control data for acceleration, deceleration, or steering, and wherein the setpoints define allowable ranges of values for the control data, or wherein the operating parameters include information that the control system (41) is for the autonomous ferry service is deactivated due to external circumstances.

4. The method according to claim 2 or 3, wherein at a deactivation of

Control system (41) for the autonomous ferry operation a position of the

Motor vehicle or from a sensor system (42, 43, 44, 45) recorded environment data are stored (16).

5. The method according to claim 4, wherein defects and their position in the road infrastructure are determined by means of an accumulation of the stored data.

6. The method according to any one of claims 2 to 5, comprising the steps:

- Issuing (13) a request to a safety driver, a manual

Take control of the motor vehicle before deactivating the

Control system for autonomous ferry operations;

- storing a time of the request;

- detecting (14) the type or timing of a safety driver's response to the request; and

- Save the type or time of reaction of the safety driver.

7. The method according to any one of the preceding claims, wherein intervention by a security driver in the autonomous ferry operation detected (17) and stored.

A computer-readable storage medium having instructions which, when executed by a computer, cause the computer to perform the steps of a method according to any one of claims 1 to 7 for monitoring and validating operational data in the actuator of an autonomous motor vehicle (40).

9. An apparatus (20) for monitoring and validating operating data in the actuator system of an autonomous motor vehicle (40), comprising:

- A data processing unit (22) for detecting (10) operating parameters of a control system (41) for an autonomous ferry operation and for comparing (11) the operating parameters with setpoints; and

a memory (23) for storing (12) at least a part of

Operating parameters if the operating parameters deviate from the setpoints.

10. motor vehicle (40), characterized in that the motor vehicle (40) a

Apparatus (20) according to claim 9 or adapted to carry out a method according to one of claims 1 to 7 for monitoring operating data.