WO2020109136A1

WO2020109136A1 - Method, computer program and device for evaluating the criticality of an option for human control of a vehicle, which has an automated control system

Info

Publication number: WO2020109136A1
Application number: PCT/EP2019/082112
Authority: WO
Inventors: Miriam Ruf; Manuel Martin; Jens Ziehn
Original assignee: Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V.
Priority date: 2018-11-30
Filing date: 2019-11-21
Publication date: 2020-06-04
Also published as: DE102018220752B3

Abstract

The invention relates to a method and a device for evaluating the criticality of an option for human control of a vehicle, which has an automated control system, and which is in a current state (z) at a current time (T0). The method comprises: determining (102) a first state space (Z') of one or more first states, into which the vehicle can be transferred from the current state (z) during a first time interval (T1) following the current time (T0) by means of human control; determining (104) a second state space (Z") of one or more second states into which the vehicle (200) can be transferred from the first states of the first state space (Z') during a second time interval (T2) following the first time interval (T1) by means of the automated control system; determining (106) whether at least one criterion (K) has been fulfilled, based on the second state space (Z") and/or the first state space (Z'), and if the criterion (K) is fulfilled, not prohibiting (108) the human controlling of the vehicle at least for the first time interval (T1), and if the criterion (K) is not fulfilled, prohibiting (110) the human controlling of the vehicle at least for the first time interval (T1). The invention also relates to a vehicle comprising the device for evaluating the criticality.

Description

METHOD, COMPUTER PROGRAM AND DEVICE FOR EVALUATING THE CRITICALITY OF A HUMAN CONTROL POSSIBILITY OF A VEHICLE USED BY AN AUTOMATED CONTROL SYSTEM

AVAILABLE

description

The present invention relates to the field of automated control of vehicles. Embodiments of the present invention create a method _» a computer program and a device for evaluating the criticality of a human control possibility of a vehicle _» which has an automated control system (AST) _» and which is in a current state (z) at a current point in time (T0) located. Further embodiments of the invention provide an approach to enable manual control of a vehicle under the safety guarantees of fully automated driving.

Currently known approaches is for operating a vehicle use and driver assistance systems allow a so-called assisted driving _"the seen as a precursor to autonomous or fully automated driving. Assisted driving is merely an extension of manual or human driving _"to support the driver in certain driving situations _" and thus to improve safety or comfort. However, this is not fully automated or autonomous driving _» assisted driving serves to support the driver. The aim here is not to _» fulfill binding safety guarantees _» which, for example, go beyond the assets of the human driver per se _» or therefore _» to take full responsibility for driving errors of the human driver through assisted driving. In fact, currently known systems go assumes _"that the human driver malfunctions of the system detect and possibly override needs.

DE 10 2016 202 590 A1 describes an approach for implementing a so-called driving school mode in a fully automated motor vehicle, according to which a learner driver controls the automated motor vehicle manually during driver training. During manual control, the automated driving parameters continue to be calculated in the background _» and manual control of the vehicle solely by the learner driver is permitted _» as long as there are no critical situations. It comes If, on the other hand, a critical situation arises, control of the motor vehicle is withdrawn from the learner driver and the motor vehicle is then operated automatically, ie partially autonomously, until the critical situation has been overcome without the driver's intervention being necessary. This approach thus offers a user of a fully automated vehicle the ability to control the vehicle itself, ie manually, using the automated system in critical situations. However, it is only rudimentary how the critical situation could actually be recognized.

However, this approach is disadvantageous in that the motor vehicle then takes control, i.e. ends manual steering, if it is determined on the basis of the parameters calculated in the background that a critical driving situation is present without taking the actual behavior of the manual driver into account, so that the fully automated control system interrupts the manual control system too often due to the safety regulations to be fulfilled and / or also in situations in which the driver's behavior can still prevent a critical situation. It is also assumed that a critical driving situation is identified either by existing driver assistance systems or by a deviation between driver input and the maneuver calculated by the automated control system. On the one hand, this only allows operation in which the driver should clearly imitate the planned behavior of the automated control system, in contrast to a free driving behavior in which a wide variety of maneuvers can be safe and permitted. On the other hand, this nevertheless does not allow any direct derivation of safety guarantees for the overall system, since the criticality of the situation itself is used as a benchmark, but not the options for action of the human driver and their consequences. For example, it is possible that even in a fundamentally safe situation (such as driving close to oncoming traffic) human control must be critically assessed because problematic inputs (such as steering in the direction of oncoming traffic) may not be prevented in time. At the same time, human control can also be permissible in critical situations if the system finds a safe resolution for every conceivable human intervention.

DE 10 2016 117 743 A1 describes a method for evaluating a driving behavior of a driver of a motor vehicle, in which sensors of a driver assistance system are used during a manual driving maneuver that is carried out by the driver of the motor vehicle sensor data are determined. On the basis of the sensor data, a movement of the motor vehicle during the manual driving maneuver is determined and the driver is provided with an output for evaluating the driving behavior as a function of the determined movement, with a driver assistance system during a parking maneuver which is carried out by the driver as the manual driving maneuver a reference movement for the parking maneuver is determined to assist the driver when parking and is compared with the determined movement during the parking maneuver and the output is provided as a function of the comparison.

DE 10 2007 007 640 A1 describes a method for recognizing accident-critical situations and a collision avoidance system using this method, in which the surroundings of a vehicle are detected in order to recognize a vehicle-accessible space and objects, and in which a situation assessment is carried out by a virtual lane is determined on the basis of a few virtual support points in such a way that it lies in the passable space, and it is assessed whether and if so when the recognized objects will assume a position lying in the virtual lane. Based on this assessment, an acceleration required to avoid collisions is determined and from this and from the curvature of the virtual lane an evaluation of the criticality for vehicle guidance along the virtual lane is carried out. The virtual lane is optimized with regard to minimizing the criticality by shifting the virtual support points, and the situation is assessed as critical to the accident if the criticality after the optimization exceeds a predetermined threshold value.

DE 10 2016 210 560 A1 describes a method for controlling a motor vehicle, comprising the steps of determining an upcoming driving maneuver; the sensing of a driver-controlled control intervention in the movement of the motor vehicle; and determining automatic control intervention to perform the driving maneuver. A driver's vitality parameter is scanned; and the driver-controlled control intervention is superimposed on the automatic control intervention depending on the determined vitality parameter.

DE 10 2016 205 508 A1 describes a longitudinal driver assistance system in a motor vehicle for controlling or regulating a drive and / or braking unit, taking into account a predefined maximum permissible maximum speed, with a detection system for recognizing preceding relevant events that adapt the predefined maximum permissible maximum speed require, a functional unit which is set up to determine a first location or first point in time when a relevant event ahead is detected, based on the location of the relevant event, upon reaching which an indication of the upcoming automatic adaptation of the maximum permissible maximum speed to the driver is output, and one to determine after the first location or the first point in time to be reached, when it reaches an intervention in the longitudinal guidance of the motor vehicle in the direction of the new maximum permissible speed at the preceding location of the relevant event if no rejection of the automatic initiated by the driver Adjustment of the maximum permissible maximum speed is available.

Based on the prior art described above, the present invention seeks to provide an approach in which the takeover of control of a vehicle by an automated control system is improved in the case of manual control by a driver.

Exemplary embodiments create a principle according to which on the one hand several different actions of the driver can be allowed to be equivalent, and at the same time lower limits can be defined for the security of the overall system, which can be functionally secured under all possible actions of the driver identified as relevant. A system is thus implemented which allows flexible and direct human control, but at the same time can offer binding security guarantees which correspond to those of a purely automated system without the possibility of human control.

This object is achieved by the subject matter of the independent claims, and preferred configurations are defined in the subclaims.

Exemplary embodiments of the present invention are explained in more detail below with reference to the accompanying drawings:

1 shows a flowchart which represents a first exemplary embodiment of the method according to the invention; 2 is an abstract representation of a state space of a vehicle to illustrate the approach according to the invention;

FIG. 3 illustrates examples of a critical (FIG. 3 (a)) or non-critical (FIG. 3 (b)) situation;

4 shows an example of the use of the approach according to the invention in a first traffic situation;

5 shows an example of the use of the approach according to the invention in a second traffic situation;

6 shows an example of the use of the approach according to the invention in a third traffic situation; and

7 shows a schematic block diagram of an exemplary embodiment of the inventive device for generating control signals for actuating actuators of a vehicle for controlling the vehicle

FIG. 8 shows a schematic illustration of a vehicle which comprises the device according to the invention from FIG. 2;

FIG. 9 shows an example of a computer system in order to implement the units or modules described in the various exemplary embodiments and in order to carry out the method steps carried out by these units / modules.

In the following description of the preferred exemplary embodiments of the present invention, elements which are the same or have the same effect are provided with the same reference symbols.

The present invention provides, in accordance with embodiments, an approach to enabling manual control of a vehicle under the safety guarantees of fully automated driving, where the vehicle can take responsibility for safety and intervene when there is a risk of human error or critical error a next or later moment through your own Options for action could get into a critical situation. According to the invention, the fully automated control system of the vehicle ensures that at least some of the actions of the human driver are prevented which could bring or transfer the vehicle into a state, for example an inadmissible or unsafe state, hereinafter also referred to as the driving situation. The actions referred to include, in particular, actions carried out or omitted by the human driver, which would lead to the vehicle being transferred, for example, to a state or driving situation within the response time of the automated control system or computer system, which the automated system no longer resolves in good time could ensure that a safe state is guaranteed. However, the system not only prevents unsafe conditions, but also those states into which a vehicle can be brought by the driver and on the basis of which unsafe conditions that can no longer be resolved by the automated control system or computer system can be reached in the event of further intervention by the driver can be. For example, the system could only allow the human driver to drive into the opposite lane at 50 cm, because otherwise, for example from 49 cm, if the driver accidentally turns left, he could drive into oncoming traffic before the system can intervene. The distance of 49 cm from the opposite lane is therefore not per se an unsafe / impermissible condition, but a condition based on which further intervention by the driver could lead to an unsafe condition.

Embodiments of the present invention are based on a vehicle, a human driver, and an automated control system for the vehicle. Also known is a state z of the vehicle relevant to the driving task, possibly including its environment, which is in a state space Z; a model M of how the human driver can influence this state space, for example in the form of a probability distribution via control commands, which can also be caused by environmental perception or interior observation of the vehicle; and a model A of how the automated control system can affect vehicle condition. Finally, there is a model G which can be used to evaluate the quality of states or state spaces in Z, for example in the form of accident risks, based on other features, such as the perception of the environment. During the journey, but possibly not necessarily with the human driver in the driving task, the system according to the invention always monitors the current state z of the vehicle and uses the human behavior model M to determine a subsequent state z 'or a number of subsequent states Z', into which the human driver Vehicle can bring in the next magazine or bar or the next time steps or bars. The system according to the invention now looks at the state space (s) "which the automated system according to model A of z 'or one or more states in Z' could achieve. According to the quality model G, the state space Z" does not have sufficient quality, For example, because a reliable resolution of the situation is unlikely, the system according to the invention judges that the control of the vehicle should be taken over by the automated control system System. Also conceivable, but less advantageous, is a warning to the human driver to voluntarily relinquish control of the vehicle.

According to further exemplary embodiments, the use of the system according to the invention is also possible while the automated system is in the driving task. It applies here that the system according to the invention allows the human driver to take over the driving task if the described quality requirement on Z “is met. In other words, in accordance with exemplary embodiments of the invention, the responsibility remains with the vehicle, even though the person controls - that is, the vehicle assumes the responsibility to overrule the person if necessary.

According to exemplary embodiments of the present invention, the automated system checks a current situation at fixed times. The system can work with a fixed cycle, and can check the situation, for example during or after one or more cycles or cycle cycles. If the check shows that manual control is not possible, the automated control is maintained and any actions by the human driver are overridden. If the vehicle is controlled manually at the time of the test, the manual control is ended and the automated system takes control of the vehicle and overrides the human driver. The human driver can, for example, leave a safe state space, that is, a state space that includes safe driving situations, by prolonged action or inaction. In this case, the vehicle takes control. In contrast to known approaches, according to the teachings of the present application, in addition to the parameters recorded by the vehicle, the behavior of the driver, who could drive the vehicle manually, is also taken into account, and based on actions or non-actions by the driver, it is estimated whether one critical driving situation is reached, ie whether a safe status area is left, which requires system intervention. The system according to the invention can therefore also be used to inform the driver that the vehicle is currently being driven, while the vehicle is driving automatically.

According to exemplary embodiments of the present invention, it is provided that in situations in which the currently safe driving situation or the current safe state changes suddenly, the fully automated system takes over control immediately or immediately, for example in situations in which obstacles in front of the vehicle suddenly occur occur, for example in the form of people walking on the road or the like.

1 is a flowchart which shows a first exemplary embodiment of the method according to the invention. The method is used to evaluate the criticality of a human control option of a vehicle that has an automated control system, i.e. the evaluation of the human control capacity of the vehicle to the extent to which human control of the vehicle poses an existential threat to the human driver, possibly other people in the vehicle Vehicle, the vehicle or objects / people in the vicinity of the vehicle. The method proceeds from a situation 100 in which the vehicle which has the autonomous control system is in a current state z. The situation 100 is also referred to as the current time T0 at which the vehicle is in the current state z.

According to exemplary embodiments, the vehicle is controlled by the automated control system at time T0, with intervention by the human driver for manual control of the vehicle being permitted or enabled at time T0 and in state z. If the human driver makes use of this possibility, the steps of the method described below are carried out in response to the detection of an intervention by the human driver. The driver interventions just mentioned, which are detected in order to initiate the steps described below, can be one or more interventions that are part of a plurality of possible interventions that are available to a driver to intervene in the control . According to exemplary embodiments, it can be provided that from the total number of interventions that would be fundamentally available to the driver, the control system intervention of the vehicle, only a subset is included in the list of possible interventions, so that the method according to the invention is carried out in response to the detection of an intervention that is part of this list.

According to other exemplary embodiments, the vehicle is controlled by the human driver at the current time TO, and the steps explained in more detail below determine whether control of the vehicle by the human driver is still to be permitted or should be prevented.

At the current time TO, a state space Z '(first state space) is determined in block 102 in FIG. 1, which can have one or more states t (first state). The states z 'in the first state space Z are those states which the vehicle can achieve by means of a human control system starting from the current state z during a time interval T 1 which follows the current time TO. Furthermore, as shown in block 104, a state space Z "(second state space) is determined, which can have one or more states z" (second state). The second states z "are those states that the vehicle can achieve on the basis of a state z", that is, on the basis of a first state, during a time interval T2 that follows the time interval T1 if the vehicle is controlled by an automated control system. In block 106, it is determined, based on the second state space Z ″ and / or the first state space Z ″, whether at least one criterion K is met. If the criterion K is met, the human control of the vehicle is not prohibited at least for the first time interval T1, as is shown at 108. If the criterion K is not met, the human control of the vehicle is prohibited, at least for the time interval T1, as shown in block 110.

According to exemplary embodiments of the present invention, a first model M is used to determine the first state space Z, which specifies the possibilities that a human driver has in order to influence the vehicle state on the basis of the current state z. In block 104, a model A is used to determine the second state space Z ″, the second model specifying the possibilities that the automated control system has to influence the vehicle state starting from the first states z ¹ . In other words, the above-mentioned models describe the possibilities of the human driver or the automated control system in order to act on the vehicle in order to control it, for example in order to enable steering of the vehicle in a first direction or a second direction.

According to exemplary embodiments, the predetermined criterion K mentioned in block 106 may include one or more criteria, and the one or more criteria may be selected from a group comprising:

(a) The quality and / or the probability of one or more of the states of the first and second state space, the states in the second state space, for example with regard to security, e.g. B. Freedom of collision, conformity with traffic regulations and the like can be assessed.

The probability of the states is based on the probability with which a situation is brought about. The situations brought about are e.g. an undesirable or critical situation or a desired or uncritical situation.

If you consider, for example, a situation in which a driver with a basic probability x turns to the right, and from there the vehicle is inexorably drifting into a ditch with a probability of 80%, the second state would only have a probability of 20%. that the automated control system can successfully resolve the situation, i.e. prevent it from entering the ditch. In this case, there is basically the possibility of resolving the situation by means of the automated system, namely preventing the trip into the ditch, for which there is a high quality, but only with a relatively low probability of 20%. Most likely, due to the driver's initial control, the automated system will not be able to prevent the vehicle from entering the trench. The overall probability of a corresponding accident results from x multiplied by 80%.

(b) The traffic conformity of the states indicates whether currently applicable traffic rules in the environment in which the vehicle is moving are observed or not.

If a vehicle is already moving at the speed limit, for example, there is a probability that the driver will accelerate the vehicle further, for example 5%, the first state z 'already has a low quality, since the traffic rule is violated, although the automated control system is able to brake the vehicle again. On the basis of the rule violation already detected in the first state, the method according to the invention will remove the control from the manual driver in order to prevent acceleration beyond the speed limit. In other exemplary embodiments, however, provision can also be made to tolerate a brief overspeed.

(c) The safety of the states of the first and second state spaces means that the vehicle poses no hazard in these states, so that, for example, the integrity of people, animals and objects in the surroundings of the vehicle is ensured.

(d) The predictability of the quality of the states describes the recognizability of certain

Situations.

If you look again at the above-mentioned example regarding the drive towards the trench and assume that the roadside is not clearly recognizable, it is difficult to predict how unfavorable the state z 'after the driver initially steered to the right. Even the automated control system cannot recognize whether the state z “that can be reached with a further steering to the right is an unfavorable state or a favorable state, the roadside is not clearly recognizable.

(e) The minimum quality of the states of the state spaces is the smallest quality of all states in the respective state space.

For example, manual control or control is prevented as soon as a possible first state z 'indicates that a person is being approached, which also applies if there are other possible states in the first state space in which no one is harmed. In other words, according to exemplary embodiments, driver intervention is only permitted if the worst state is sufficiently uncritical among all possible sequences of intervention, i.e. under all possible states in the first or second state space, states with the worst consequences being of minimal quality. (f) The suitability or difference of the first states with regard to their treatment from the starting point for the automated control.

The suitability or diversity of the states means that different states in the first state space may be suitable for planning the further steps. If certain conditions are unsuitable, planning from or based on this condition is not attempted at all. For example, in the case of the ditch example set out above, the roadside that is not clearly recognizable is not well suited for subsequent planning, but another parameter that is more recognizable is well suited. Furthermore, different but similar states z 'can lead to different reactions. For example, braking or acceleration can be effected in front of a yellow traffic light. If the vehicle recognizes that, depending on human behavior, two states are possible that would have to be resolved completely differently and the distinction between the two states is complicated, the vehicle can take control and brake in good time, for example when the traffic light is yellow, to avoid having to deal with the differentiation of states.

According to embodiments, a quality model can be used to determine the quality as explained above, and depending on the quality obtained by the quality model, it is determined whether human control is permitted or prohibited.

According to exemplary embodiments, the second state space is considered to be sufficiently safe if the criterion is met and as critical if the criterion is not met. In the event of a critical situation, block 108 can provide forbidding human control of the vehicle over a time interval that extends beyond the first time interval until the critical driving situation is resolved by the automated control system. In accordance with exemplary embodiments, this means that the critical driving situation has been finally or finally resolved by the automated control system. The system only returns control to the driver, for example, when the driving situation has normalized. For example, assume a situation in which the system according to the invention avoids a rear-end collision by switching to the opposite lane. In this case, the immediate cause, the collision with the vehicle in front, is resolved, but now the vehicle is in the opposite lane, so that the human driver may be confused and therefore all the more susceptible to wrong decisions, and the system therefore remains in control until it is assessed that a normal driving situation is now again present, for example when the vehicle has been stopped or another defined driving situation has taken.

According to other exemplary embodiments, provision can generally be made to maintain the automated control for a period going beyond the first time period T1, and only to allow the human control again after a prolonged period of time, e.g. Avoid short-term, theoretically possible control effects by the driver, so that either manual control or automated control is permitted over defined periods.

1, it was described with reference to block 106 that the determination as to whether the criterion is met is based on the second state space and / or the first state space. In other words, according to the first exemplary embodiments of the invention, it is determined in block 106 only based on the first state space whether the at least one criterion is met or not; according to the second exemplary embodiments, the determination as to whether the criterion is met or not is made exclusively on the basis of the second state space, and according to third exemplary embodiments, the determination as to whether the criterion is fulfilled or not is made on the first state space and on the second state space. The exemplary embodiments just mentioned are explained in more detail below with the aid of examples.

Assessment only based on the first state space

According to the first exemplary embodiments, the judgment as to whether the criterion is fulfilled or not is made exclusively as a function of the first state space Z. This can e.g. then occur when the damage can already arise directly from the action of the human driver at time T0, even if this damage could then be resolved by the automated control system.

If one considers a follow-up drive as a scenario, according to which another vehicle F closely follows the vehicle E according to the invention, then the state space Z 'contains the possibility that a human driver brakes. Due to the distance of the following vehicle F, the intervention can be prohibited because the driver of the following vehicle F could scare and therefore have an accident. Although there was no real risk of a rear-end collision, because the automated control system could react quickly enough even in the event of braking and accelerate the vehicle E, the possibility that the driver in the following vehicle F is frightened and accidented is sufficient to brake classified as unacceptable, regardless of what the resolution options of the automated control system are.

Another scenario is a speed limit and it is assumed that the vehicle E according to the invention is driving at the current speed limit of 50 km / h. Is there a possibility that the human driver can accelerate to 55 km / h if e.g. If, for example, no mechanism preventing acceleration (limit switch) is activated, a state z 'exists in the first state space Z', which represents a speed limit being exceeded. In such a scenario, the driver can be deprived of control, regardless of whether the automated control system is able to brake again to 50 km / h by the next point in time or in the next cycle. The damage already occurs in the first violation of the speed limit.

Furthermore, the criterion can be assessed in such situations only on the basis of the states in the first state space, in which damage caused by the action is trivially recognizable inevitably, without it being necessary to check the options for action of the automated control system. In one scenario, the vehicle E according to the invention drives e.g. close to the right edge of the road. There is a ditch directly behind the edge of the road. If the state space Z contains a state z ″ in which the vehicle is appropriately steered by the driver to the right in the direction of the trench, this fact already means that further human intervention is prohibited. Due to the circumstances, for example the distance to the trench, it is immediately clear that this intervention, the possible strong steering to the right, would be fatal without it being necessary to run through the resolution options of the automated control system and so to determine, for example, that none There is a possibility of resolution.

Yet another scenario relates to oncoming traffic, for example when vehicle E according to the invention drives close to dense and fast oncoming traffic. If there is a possibility that the driver can steer oncoming traffic before the automated control system can intervene (e.g. if the response time of the automated system is not sufficient to prevent or resolve the situation because of the Distance to oncoming traffic is too small), steering intervention to the left is prohibited because an accident is extremely likely and the probability that the automated control system could even resolve the situation would be extremely unlikely.

Assessment only based on the second state space

According to the second exemplary embodiments, the judgment as to whether the criterion K is met is made exclusively on the basis of the states in the second state space Z ″.

The assessment can only be carried out depending on the second state space, if an intervention possibility e.g. cannot be resolved sufficiently well. If, in turn, the scenario of a follow-up drive is considered, in which the vehicle E according to the invention is followed by a fully automated vehicle F at a short distance, in which, for example, no human driver is seated, the first state space contains the possibility that the driver of E suddenly brakes, but calculates it In this case, the vehicle determines the attainable states in the second state space in order to determine whether it could accelerate the vehicle E in good time, taking into account all possible braking strengths and braking times, in order to avoid a rear-end collision.

This assessment can show that at least one state in the second state space indicates a rear-end collision, so that the situation may not be resolved. Therefore human intervention is prohibited. In other words, it is recognized that at least one state in the second state space means a worst-case scenario (rear-end collision), so that human control is prevented. According to other exemplary embodiments, human intervention can be prohibited if the at least one state in the second state space is associated with a risk that exceeds a predetermined limit value. The risk can be determined, for example, based on the product of accident costs and the probability of occurrence. If there are no signs that the vehicle is slowing down, the possible intervention is classified as extremely unlikely and a ban will not be imposed, although the possibility has been recognized.

Another example scenario, in which only the states in the second state space are considered, relates to the behavior at a stop line to which a vehicle E according to the invention is driving. While the vehicle is approaching the stop line at an intersection, the system checks at all times whether, taking into account all possible actions by the human driver, a stop in front of / on the continues Stop line can be reached. The following then applies to the worst case scenario; Is there an action that the human driver could take, e.g. B. a renewed acceleration, which can not be resolved to a stop in front of / on the stop line, ie there is the best possible resolution in the second state space, in which the vehicle E has nevertheless crossed the stop line, human intervention is prohibited and that automated control system does the stopping.

Assessment based on the first state space and the second state space

According to the third exemplary embodiments, the judgment is made as to whether the criterion is met or not depending on the first state space and the second state space.

For example, the states in the two state spaces, viewed individually, can be unproblematic and only have a critical consequence in combination. If one again considers a speed limit as an example scenario and assumes that the vehicle E according to the invention is traveling at the current speed limit of, for example, 50 km / h, it may be acceptable to exceed the limit for one time interval or one cycle, but not for two cycles or two time intervals behind each other. If there is a state z 'in the first state space in which the human driver can accelerate to 51 km / h, but there is no state in the second state space in which the automated control system can brake the vehicle again to 50 km / h, e.g. . B. because there is a gradient, the intervention is prevented, although the respective limit violations in the two status rooms would be individually justifiable.

In another example scenario, there is again a follow-up drive, now with a critical coefficient of friction between the vehicle and the road, for example due to a wet road. Again, it is assumed that the vehicle E according to the invention is closely followed by a vehicle F, but now on a wet road. If the first status area Z contains the possibility that the driver of E suddenly brakes, the automated control system must take control and accelerate quickly in the next instant or cycle in order to restore the safety margin. The state in the first state space Z is not critical because it does not result in an accident, and in the second state space Z “an uncritical state can be reached in which the safety distance has been restored, but the combination of sudden braking and acceleration on a wet road increases the risk that the tires lose grip on the wet road, so that in state space Z “the acceleration cannot be achieved with a sufficient safety margin, at least not within the desired cycle or time interval. According to exemplary embodiments, the second status area Z ″ can also contain information about the predecessor status in the first status area Z ′, so that, for example, in the example just mentioned regarding the following drive with a critical coefficient of friction in the second status area, it could already be noted that the wheels may lose their grip .

According to further exemplary embodiments, the combination of the two state spaces can be used if the states in the individual state spaces are possibly problematic, but are still below a predetermined limit value, but the combination leads to the predetermined limit value being exceeded. If you again consider the above-mentioned example of a follow-up drive with a critical coefficient of friction, modeling using expected damage values can be used. Furthermore, the possibility of loss of liability of the wheels may already be included in the second state space. The first state space contains a state in which the driver brakes and the human driver in the following vehicle has an accident, which, for example, damages the following vehicle from e.g. Could cause 20,000 euros, but with an assumed or modeled probability of 1 / 40,000 (fright accident). The expected cost is 50 cents. Furthermore, in order to avoid the actual rear-end collision, the automated control system would have to accelerate again, with the risk of a loss of liability and, in turn, the risk of an accident. The damage to the vehicle according to the invention would be e.g. 50,000 euros, with an assumed or modeled probability but 1 / 100,000 (liability loss accident). The expected cost is also 50 cents. As a security criterion, it is envisaged that risks from a loss expectation value of 1 euro must be prevented. The risks of the frightful accident and the liability loss accident would each be separately below the 1 euro threshold, so that human intervention would be permitted if there was an accident risk in only one of the two places. However, since both the first step and the second step involve accident risks that exceed the total limit (the expected costs are 1 euro), the maneuver is prohibited.

According to exemplary embodiments, it is provided that, in contrast to known, assisted or automated driving, in which the responsibility changes between the person and the assistance system, the responsibility lies with the automated system of the vehicle, so that the human driver no longer has to intercept a malfunction of the assistance system. According to the invention, it is thus possible for the human driver to under the fully automated driving safety guarantees the vehicle can control, and the system is able to intercept short-term human errors due to the actions performed or the actions not performed, thereby allowing an average human driver to drive with almost no system interference.

According to exemplary embodiments, it is provided that the interventions of the automated control system of the vehicle are logged so that the interventions can be displayed directly to the driver, for example after the journey has been completed. Furthermore, the logging can be used to issue a driver's license, depending on his current driving practice and depending on the number of system interventions, and, if necessary, to limit this to a predetermined time, for example to a shorter period for drivers who have a high number of System interventions, or for a longer time for drivers who cause a small number of system interventions. Thus, according to the invention, a possibility is created that the human driver can collect driving experience even in fully automated driving.

According to further exemplary embodiments, it is provided that the fully automated system cannot be overridden by the human driver.

2 illustrates the approach according to the invention based on an abstract representation of a state space of a vehicle. The striped area C is the area of the status area with impermissible or unsafe conditions or driving situations. Area D shows the possible actions of the human driver before the control system of the vehicle may have to react to the action due to its reaction time and must intervene accordingly. The white area A indicates the area in which the human driver can still freely control the vehicle. The black area B indicates the area at which the fully automated system relieves the human driver of control.

2 shows two example states Di, D2 of the vehicle, the states D1, D2 being represented by corresponding circles with a center point. If the vehicle is in the center of states D1, D2, this is a position within area A, the vehicle is therefore in a currently safe driving state or a currently safe driving situation and is controlled by the driver. The radius of the circle shows how driver behavior, For example, a reaction of the driver in a current, safe driving situation could change the state of the vehicle. If the state D1 is considered, the system recognizes that the behavior of the driver, for example any possible reaction, changes the vehicle from the current, safe driving state into a new driving state that is in area A, that is to say is also a safe driving state, so that in the case of the state D1, no critical state is reached regardless of a reaction by the driver, and therefore no intervention by the automated system is required. On the other hand, state D2 shows that one or more of the possible reactions or actions or non-actions of the driver can change the vehicle to state B, in which an error of the human driver can possibly no longer be intercepted in time that automated system intervention is required.

Thus, according to embodiments of the invention, when situation Di is recognized, manual control is permitted to continue, but when situation D2 is recognized, manual control by the human driver is ended and the vehicle takes over the control, more precisely the automated control system of the vehicle takes over control so that the new situation is safely in the area of states A, that is to say in a safe state. According to exemplary embodiments, it can be provided that after the manual control has ended and after the automated control has been carried out and a new, safe position has been reached, the driver is again able to control manually.

3, examples for a critical (see FIG. 3 (a)) or for an uncritical (see FIG. 3 (b)) situation are explained below. 3 overall shows the range of possible states, the dark region representing an unsafe region and the white region a safe region. A current state at time T0 is shown, as well as a first state space Z 'with a plurality of first states z' which can be reached from the current state z by human control of the vehicle. 3, the states Zi, z ₂ and z _{3 are shown} as first states z 'by way of example. Furthermore, second state spaces Zi “, Z2“ and Z ₃ “with the respective second states z“ which can be reached from the first states zi, z ₂ and z ₃ are shown.

A critical situation is shown in Fig. 3 (a). In the current state z, the vehicle is in the safe area and based on model M for human control the states Zi, Z2 and z ₃ which can be achieved in the first state space Z 'are determined. Starting from the states zi, Z2 and z ₃ , the achievable second state spaces Z, Z2 "and Z ₃ " are determined using model A for the automated control. The situation shown in FIG. 3 (a) is critical because, in the current state z, the human driver could control a state zi in the first state space Z ', on the basis of which the automated system is unable to operate in each of the second state spaces Z1 ", Z2" and Z ₃ "to achieve at least a safe state. This is only possible based on the states z ₂ 'and z ₃ '. Starting from the state Zi, only states of the second state space Zi “that are in the unsafe area can be reached. Consequently, in a situation as shown in FIG. 3 (a), the human driver is deprived of control, and the automated control system takes over control of the vehicle or the takeover of control by the operator at the time TO starting from the state z human driver is prevented. It is therefore essential that the control in state z is removed from the human being, although at this point in time there are certainly human and automatic options for keeping the vehicle in the safe area the next time.

3 (b) shows an uncritical situation, since starting from each state in the first state space Z ', at least one state a * in the second state spaces Z to Z ₃ "can be reached, which is within the safe range. The situation is therefore not critical, since all states in the first state space Z 'can be resolved safely by the automated system. Control of the vehicle can therefore be left to the human driver in the situation shown in FIG. 3 (b), or acceptance of control by the human driver can be permitted.

FIG. 4 shows an example of the use of the approach according to the invention in a situation in which the vehicle 200 equipped with the system according to the invention, which is currently manually controlled by a driver, is approaching the end of a traffic jam, the approaching schematically in FIG. 4 Vehicle 200 and the vehicles 202 to 206 located at the control end are shown. 4 thus shows a typical scenario in which a rear-end collision threatens at the end of a traffic jam. In FIG. 4, the white area A indicates the area in which the human driver would typically brake. The vehicle 200 detects the surroundings and the vehicle 202 located at the end of the traffic jam by means of the sensors 200a to 200d. These parameters, together with the current vehicle parameters, are input to the device 150 according to the invention, as is shown schematically in FIG. 3. If the manually controlling driver brakes the vehicle 200, then this is recognized by the corresponding vehicle parameters, and the system according to the invention can determine whether the braking action initiated by the driver leads to the vehicle moving from the situation shown in FIG. 4 into a new, uncritical driving situation within area A or is transferred to it, more precisely it stops there. If this is the case, the system according to the invention allows manual control to continue. However, if the system detects that the human driver is not responding or is not responding sufficiently, for example due to the fact that no parameters relating to the initiation of a braking action are recorded so that the vehicle would enter the black area B, the vehicle takes over control according to the invention to bring the vehicle to a stop in good time. This area represents the latest opportunity in which the fully automated control system can bring the vehicle to a standstill in good time. The approach according to the invention thus ensures that the vehicle takes over the control before the vehicle reaches the striped area C, in which the fully automated system would no longer be able to bring the vehicle 200 to a standstill in good time. In other words, it is relevant whether the AST can still stop, even if the human could possibly still stop in C, which would be speculative at best - the system according to the invention always plans according to exemplary embodiments in such a way that it only uses its own resolution options, which may even be can be worse than the best human driver imaginable.

FIG. 5 shows another example of a situation in which the approach according to the invention can end and take over the manual control of the driver. FIG. 5 shows a situation in which the vehicle 200 is moving at a certain speed along a road 208 that bends sharply in the area 210, so that a reduction in the speed of the vehicle 200 is necessary in order to prevent that Vehicle is carried out of curve 210. According to the invention, the system monitors the surroundings of the vehicle, for example the course of the road based on sensor data, for example optically recognized road signs or electronically read out information from units on the roadside, or based on map information. It is also monitored whether the manual driver is braking the vehicle 200 sufficiently. If it is determined that braking the vehicle 200 leads to a sufficient reduction in speed, that is to say that it is in state A, manual control can be continued. However, it is found that the driver is not initiating sufficient or no braking, so that a new situation in area B, the manual control is ended before reaching state B, and the vehicle or its fully automated control system takes over the control and brakes the vehicle before reaching area C and, if necessary, effects a corresponding steering, so that it is safe to drive through curve 210.

FIG. 6 shows yet another example of an application of the approach according to the invention at a junction, which the vehicle 200 approaches, for example at a certain speed, the situation shown in FIG. 6 being assessed as a safe driving situation. The junction 212 may not be signposted, for example, so that the right applies over the left, that is, the vehicle 202 shown in FIG. 6 has priority. Alternatively, the right of way regulation can be regulated by a corresponding traffic sign 214, for example a stop sign, or a traffic light system 216, a traffic light. In the case of a right-to-left regulation, the vehicle 200 detects the vehicle 202 which is moving on the right of way road in the direction of the junction 212, for example by means of V2V communication (vehicle-to-vehicle communication) with the vehicle 202 or by appropriate sensors. Furthermore, the vehicle 200 determines whether the driver is reacting, so that the vehicle is still in the safe area A due to the reaction. If this is the case, for example if the driver slows the vehicle 200 sufficiently so that the vehicle 202 can safely pass the junction 212, the manual control is maintained. If, however, it is recognized that the driver's reaction or non-reaction leads to area B being reached, in which neither human behavior nor the automated system can prevent the area C from being reached and thus a collision with the vehicle 202, the manual control is ended and the vehicle 202 is moved by means of its automated control, so that the critical situation, that is to say a collision with the vehicle 202, is avoided. If the junction 212 is signposted, in addition or as an alternative to detecting the presence of the vehicle 202, the controller can include the detected traffic signs in the check, in order to ensure, for example in the event of a stop sign 214 or a red traffic light 216, that the vehicle 200 is before the junction 212 is stopped, either by manual control of the driver who responds accordingly, or by ending manual control and stopping the vehicle by the autonomous or automated control of the vehicle.

According to exemplary embodiments of the present invention, the prohibition of human control in block 108 in FIG. 1 can be configured differently, depending on whether the vehicle is currently being controlled by a vehicle human driver is controlled or by the automated control system. If the vehicle is controlled by the human driver at the current point in time 100, the control of the vehicle can be withdrawn from the human driver and transmitted to the automated control system at least for the first time interval T1 or longer. According to other exemplary embodiments, in such a situation, at least for the first time period T1 or beyond, one or more control commands which have been specified by the human driver cannot be carried out and the control is transmitted to the automated control system. According to another exemplary embodiment, the human driver can be informed that control of the vehicle is to be surrendered, and control is subsequently transferred to the automated control system for notification at least for the duration of the first time interval TΊ or longer. According to exemplary embodiments, the above-mentioned notification of the driver can include the output of an audible, visible and / or tactile warning to the human driver, for example an acoustic signal, a display or head-up display or a vibration of the steering wheel.

If the vehicle is already in automated mode at the current time, that is to say is controlled by the automated control system, this automated control is maintained in block 108.

According to further exemplary embodiments, one or more vehicle parameters and / or the vehicle interior can be monitored in block 102 in order to determine one or more actions performed and / or omitted by the human driver. The following parameters can be monitored:

(a) acceleration of the vehicle,

Braking the vehicle,

Steering the vehicle,

Actuation of the clutch or gear change,

Transmission of signals, for example light signals, such as indicators, flashing lights, or radio messages,

Speed of the vehicle,

Position of the steering wheel,

Engine settings,

Predicting the position of the vehicle in the area,

Driving stability of the vehicle, Wheel rotation speeds of the vehicle,

Acceleration of the vehicle,

Steering wheel turning speed of the vehicle,

Yaw rate of the vehicle,

(b) driver's pose,

Driver's line of sight,

Gestures or facial expressions of the driver,

Behavior or activities of the driver,

physiological or psychological data of the driver (e.g. concentration, fatigue, nervousness based on e.g. electrocardiogram, electromyogram and / or skin conductance),

Gestures and facial expressions of other vehicle occupants,

Behavior or activities of other vehicle occupants,

State of the interior electronics of the vehicle (e.g. communication or entertainment electronics),

Vehicle interior temperature,

(c) an estimate of the accuracy of the parameters mentioned.

In further exemplary embodiments, the vehicle environment is monitored and the following parameters can be recorded, for example:

(a) position of one or more stationary or moving objects in the vicinity of the vehicle,

Speed and direction of movement of a moving object in the vicinity of the vehicle,

Predicting the position of the moving object in the vicinity of the vehicle,

Predicting the speed of the moving object in the vicinity of the vehicle,

Predicting the orientation of the moving object in the vicinity of the vehicle,

applicable traffic rules,

Condition of the road surface,

Visibility,

(b) an estimate of the accuracy of said parameters. 7 shows a schematic block diagram of an exemplary embodiment of the device according to the invention for evaluating the criticality of a human control possibility of a vehicle, which has an automated control system, and the

Can generate control signals for actuating actuators of a vehicle to control the vehicle. The device 150 comprises a signal processing device 152, which in turn comprises a plurality of modules. A first module 154 of the signal processing device 152 determines whether one or more criteria for manual control of the vehicle by the driver are met, based on the second state space (Z “) and / or the first state space (Z ′), as described above 1 was explained. If it is determined that manual control is possible, manual control of the vehicle by the driver is permitted in module 156. On the other hand, if it is determined in module 154 that manual control is not possible, module 158 effects the control of the vehicle by the automated control and corresponding control signals 160 for automated control of the vehicle are generated. The device 150 outputs the control signals 160, for example to certain actuators 162 of the vehicle, for example in order to accelerate or brake or steer the vehicle, for example in order to move the vehicle along a specific trajectory which prevents a critical driving situation.

8 shows a schematic illustration of a vehicle, for example a motor vehicle 200, which comprises the device 150 according to the invention and which, according to the teachings according to the invention, allows manual control by a human driver which, if a critical driving situation occurs, according to the teachings of the present invention Registration is ended. The further control then takes place through the automated control system 201 of the motor vehicle 200. The motor vehicle 200 comprises a plurality of sensors, of which only four sensors 200a to 200d are shown schematically in FIG. 8, which are arranged at different positions of the vehicle 200. The sensors 200a-200d serve, for example, to detect the vehicle and the surroundings of the vehicle 200, for example objects in the surroundings and their movement, speed and direction of movement. The controller 150 determines, based on the ambient conditions and the driving parameters of the vehicle 200, whether a specific action / non-action by the driver, who is currently driving the vehicle manually, converts the vehicle 200 into a critical situation or into a non-critical situation based on a current situation . A person skilled in the art will readily recognize many other possible applications for the approach according to the invention based on the above descriptions of the various situations, and the present invention is thus not restricted to the exemplary embodiments described in detail above

Exemplary embodiments were explained above using a car. However, the present invention is not limited to this, rather the approach according to the invention described above can be used in accordance with further exemplary embodiments with any other land vehicles. Furthermore, the present invention is also not limited to land vehicles, but can also be used in water vehicles or aircraft according to further exemplary embodiments.

Although some aspects have been described in connection with a device, it goes without saying that these aspects also represent a description of the corresponding method, so that a block or a component of a device is also to be understood as a corresponding method step or as a feature of a method step. Analogously, aspects that have been described in connection with or as a method step also represent a description of a corresponding block or details or feature of a corresponding device.

9 shows an example of a computer system 300, and the units or modules described above in connection with the various exemplary embodiments and the method steps carried out by these units / modules can be carried out using one or more such computer systems 300. The computer system 300 comprises one or more processors 302, for example a special or general digital signal processor, DSP, which is coupled to a communication infrastructure 304, for example a bus or a network. The computer system 300 comprises a main memory 306, for example a random access memory, RAM, and a secondary memory 308, for example a hard disk drive and / or a removable memory. The secondary memory can be provided to enable computer programs or load other commands into the computer system. Computer system 300 may further include a communication interface 310 to enable software and data to be transferred between computer system 300 and external devices. Communication can take the form of electrical, electronic, electromagnetic, optical or other signals that can be processed by the communication interface. The communication can be wired or wireless, eg via a wire, a cable, an optical fiber or a telephone line, or wireless, eg via a radio connection, an RF connection or another communication channel 312.

The terms "computer program medium" and "computer-readable medium" are used to refer to a storage medium, for example a removable storage unit or a hard disk. The computer program product is used to provide software to system 300. The computer program, which is also referred to as computer logic, is stored in main memory 306 and / or in secondary memory 308. The computer program can also be received via the communication interface 310. The computer program, when executed, causes the computer system 300 to execute the present invention. In particular, when executed, the computer program enables processor 302 to implement the processes described herein, such as the inventive method. Thus, such a computer program can be referred to as a controller of computer system 300. If the approach according to the invention is implemented in the form of software, this software can be stored in a computer program product and loaded into the computer system 300, for example using a removable storage medium or an interface, such as the communication interface 310.

Depending on the specific implementation requirements, exemplary embodiments of the invention can be implemented in hardware or in software. The implementation can be performed using a digital storage medium, such as a floppy disk, DVD, Blu-ray disc, CD, ROM, PROM, EPROM, EEPROM or FLASH memory, hard drive, or other magnetic or optical memory are carried out, on which electronically readable control signals are stored, which can interact with a programmable computer system in such a way or interaction that the respective method is carried out. The digital storage medium can therefore be computer-readable. Some exemplary embodiments according to the invention thus comprise a data carrier which has electronically readable control signals which are able to interact with a programmable computer system in such a way that one of the methods described herein is carried out. In general, exemplary embodiments of the present invention can be implemented as a computer program product with a program code, the program code being effective to carry out one of the methods when the computer program product runs on a computer. The program code can, for example, also be stored on a machine-readable carrier.

Other embodiments include the computer program for performing one of the methods described herein, the computer program being stored on a machine readable medium.

In other words, an exemplary embodiment of the method according to the invention is thus a computer program which has a program code for performing one of the methods described here when the computer program runs on a computer. A further exemplary embodiment of the method according to the invention is thus a data carrier (or a digital storage medium or a computer-readable medium) on which the computer program for carrying out one of the methods described herein is recorded.

A further exemplary embodiment of the method according to the invention is thus a data stream or a sequence of signals which represents the computer program for performing one of the methods described herein. The data stream or the sequence of signals can, for example, be configured to be transferred via a data communication connection, for example via the Internet.

Another exemplary embodiment includes a processing device, for example a computer or a programmable logic component, which is configured or adapted to carry out one of the methods described herein.

Another embodiment includes a computer on which the computer program for performing one of the methods described herein is installed.

In some exemplary embodiments, a programmable logic component (for example a field-programmable gate array, an FPGA) can be used to perform some or all of the functionality of the methods described herein. In some embodiments, a field programmable gate array may cooperate with a microprocessor to perform one of the methods described herein. In general, in some embodiments, the methods are performed by any hardware device. This can be a universally usable hardware such as a computer processor (CPU) or hardware specific to the method, such as an ASIC.

The above-described embodiments are merely illustrative of the principles of the present invention. It is understood that modifications and

Variations in the arrangements and details described herein will be apparent to those skilled in the art. Therefore, it is intended that the invention be limited only by the scope of the following claims and not by the specific details presented with the description and explanation of the embodiments herein.

Claims

1. A method for evaluating the criticality of a human control possibility of a vehicle (200) which has an automated control system (201), AST, and which is in a current state (z) at a current time (TO), the Method has the following steps:

(a) determining (102) a first state space (Z ') from one or more first states into which the vehicle (200) during a first time interval (T1) following the current time (TO) by a human controller starting from the current one Condition (z) is transferable,

(b) determining (104) a second state space (Z ") from one or more second states into which the vehicle (200) emanates from the automated control system (201) during a second time interval (T2) following the first time interval (T1) can be transferred from the first states of the first state space (Z '),

(c) determining (106) whether at least one criterion (K) is met, based on the second state space (Z ") and / or the first state space (Z '),

(d) if the criterion (K) is met, non-prohibiting (108) human control of the vehicle (200) at least for the first time interval (T1), and

(e) if the criterion (K) is not met, prohibit (110) human control of the vehicle (200) at least for the first time interval (T1).

2, The method of claim 1, wherein

step (a) comprises determining the first state space (Z ') using a first model (M), the first model (M) indicating the possibilities that the human driver has to determine a vehicle state based on the current state ( z) to influence, and

step (b) comprises determining the second state space (Z ") using a second model (A), the second model (A) indicating the possibilities that the automated control system (201) has to determine a vehicle state based on the to influence the first states (z ').

3. The method according to any one of the preceding claims, wherein the criterion (K) comprises one or more criteria selected from a group comprising:

a quality of one or more of the second states (z ") of the second state space (Z '");

a probability of one or more of the second states (z ") of the second state space (Z '");

a quality of one or more of the states (z ') of the first state space (Z');

a probability of one or more of the states (z ’) of the first state space (Z’);

a traffic activity I com nformity of one or more of the states (z ’, z“) of the first or second state space (Z ’, Z“);

a security of one or more of the states (z ', z ") of the first or second state space (Z', Z");

a predictability of the quality of the states (z ', z ") of the first or second state space (Z', Z");

a minimum quality of one or more of the first states (z ') of the first state space (Z');

a minimum quality of one or more of the second states (z “) of the second state space (Z’ ’);

a suitability or difference of one or more of the first states (z ') of the first state space (Z') with regard to their treatment as a starting point for the automated control.

4. The method according to any one of the preceding claims, wherein the criterion (K) comprises a quality of the state (z ") of the second state space (Z"), wherein

step (c) uses a quality model (G) to determine the quality of at least one state of the first and / or second state space (Z ', Z "), wherein

in step (d) human control of the vehicle (200) is not prohibited if this evaluation according to the quality model (G) is of sufficient quality, and in step (e) human control of the vehicle (200) is prohibited if this evaluation according to the quality model (G) is not of sufficient quality.

5. The method according to claim 1, wherein in step (e) the prohibition of human control of the vehicle (200) comprises the following: if the vehicle (200) is controlled by a human driver at the current time (T0),

Withdrawing control of the vehicle (200) from the human driver and transferring control to the automated control system (201) for the first time interval (T1), or

Not performing the control commands entered by the human driver and transferring the control to the automated control system (201) for the first time interval (T1), or

Notifying the human driver that control of the vehicle (200) is to be surrendered and transferring control to the automated control system (201) for the first time interval (T1), and if the vehicle (200) at the current time (T0) the automated control system (201) is controlled, maintaining the automated control.

6. The method of claim 5, wherein notifying the driver includes issuing an audible, visible, and / or tactile warning to the human driver.

7. The method according to any one of the preceding claims, in which

if the criterion (K) is met, the second state space (Z “) represents sufficiently safe driving situations, and

if the criterion (K) is not met, the second state space (Z “) represents critical driving situations.

8. The method according to claim 7, wherein in step (e) the human control of the vehicle (200) is prohibited for a time interval beyond the first time interval (T1) until the critical driving situation is resolved by the automated control system (201).

9. The method according to claim 1, wherein step (a) comprises monitoring one or more vehicle parameters and / or monitoring the vehicle interior in order to determine one or more actions taken and / or omitted by the human driver.

10. The method of claim 9, wherein the vehicle parameter and / or the parameter of the vehicle interior comprises one or more of the following parameters:

Acceleration of the vehicle (200), braking of the vehicle (200), steering of the vehicle (200), actuation of the clutch or gear change, transmission of signals, for example light signals, such as indicators, flashing lights, or radio messages, vehicle speed (200) , Position of the steering wheel, or more engine settings, prediction of the position of the vehicle (200) in the vicinity, driving stability of the vehicle (200), wheel rotation speed of the vehicle (200), acceleration of the vehicle (200), steering wheel rotation speed of the vehicle (200), yaw rate the vehicle (200), and / or

Pose of the driver, direction of the driver, gestures or facial expressions of the driver, behavior or activities of the driver, physiological or psychological data of the driver (e.g. concentration, fatigue, nervousness based on e.g. electrocardiogram, electromyogram and / or skin conductance), gestures and facial expressions other vehicle occupants (200), behavior or activities of other vehicle occupants (200), state of the interior electronics of the vehicle (200), for example Communication or entertainment electronics, vehicle interior temperature, and / or

an estimate of the accuracy of the parameters mentioned.

11. The method according to any one of the preceding claims, wherein step (a) comprises monitoring one or more vehicle environment parameters.

12. The method of claim 1 1, wherein the vehicle environment parameter comprises one or more of the following parameters:

Position of one or more stationary or moving objects in the vicinity of the vehicle (200), speed and direction of movement of a moving object in the surroundings of the vehicle (200), previously say the position of the moving object in the surroundings of the vehicle (200), predict the speed of the moving object in the surroundings of the vehicle (200), predict the orientation of the moving object in the surroundings of the vehicle (200), applicable traffic rules , Condition of the road surface, visibility, and / or an estimate of the accuracy of the parameters mentioned.

13. The method according to any one of the preceding claims, wherein the first state space (Z ') comprises a plurality of first states (z') and / or the second state space (Z ') comprises a plurality of second states (z').

14. The method according to any one of the preceding claims, wherein the vehicle (200) is controlled at the current time (T0) by the automated control system (201) and an intervention of the human driver for manual control of the vehicle (200) is permitted, wherein responsive steps (a) to (e) are carried out upon detection of an intervention from a plurality of possible interventions by the human driver.

15. The method according to any one of claims 1 to 13, wherein the vehicle (200) is controlled by the human driver at the current time (T0).

16. The method according to any one of the preceding claims, with the following step:

Log the interventions of the automated control system (201) of the vehicle (200).

17. A computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method according to one of claims 1 to 16.

18. Device (150) for evaluating the criticality of a human control possibility of a vehicle (200), which has an automated control system (201), AST, and which is in a state (z) at a current time (T0), comprising: a signal processing device (152) configured to to determine (102) a first state space (Z ') into which the vehicle (200) can be transferred based on the state (z) during a first time interval (T1) following the current point in time (TO), to determine (104) a second state space (Z ") into which the vehicle (200) during a first time interval (T2) following the first time interval (T1) by the automated control system (201) starting from at least one state (z ') of the first state space (Z ') can be transferred, to determine (106, 154), based on the second state space (Z ") and / or the first state space (Z'), whether at least one criterion (K) is met, if that Criterion (K) is met not to prohibit (108, 156) human control of the vehicle (200) at least for the first time interval (T1), and if the criterion (K) is not met, human control of the vehicle (200 ) at least for the first time interval (T1) (110 , 158).

19. The apparatus (150) according to claim 18, wherein the signal processing device (152) is configured to generate control signals (160) for actuating actuators (162) of the vehicle (200), for controlling the vehicle (200) by the automated one Control system (201).

20. Vehicle (200) with an automated control system (201), AST; and a device (150) according to claim 18 or 19.

21. The vehicle (200) of claim 20, wherein the vehicle comprises a land vehicle, a watercraft, or an aircraft.