METHOD AND DEVICE FOR MONITORING A SYSTEM OF A VEHICLE WHICH PROVIDES AN AT LEAST PARTIALLY AUTOMATED DRIVING FUNCTION

Abstract

A method for monitoring a system of a vehicle which provides an at least partially automated driving function, including the following steps: checking setpoint driving state of the vehicle, predefined by the system, for plausibility, controlling the vehicle as a function of the predefined setpoint driving state in order to reach the predefined setpoint driving state when a result of the check is that the predefined setpoint driving state is plausible, or controlling the vehicle as a function of an emergency setpoint driving state in order to reach the emergency setpoint driving state when a result of the check is that the predefined setpoint driving state is implausible. Moreover, a corresponding device, a corresponding monitoring system, and a corresponding computer program are described.

Claims

1-12. (canceled)

13. A method for monitoring a system of a vehicle which provides an at least partially automated driving function, the method comprising: checking a setpoint driving state of the vehicle, predefined by the system, for plausibility; controlling the vehicle as a function of the predefined setpoint driving state in order to reach the predefined setpoint driving state when a result of the checking is that the predefined setpoint driving state is plausible; and controlling the vehicle as a function of an emergency setpoint driving state in order to reach the emergency setpoint driving state when a result of the checking is that the predefined setpoint driving state is implausible.

14. The method as recited in claim 13, wherein the checking for plausibility includes comparing a setpoint driving state parameter which characterizes the setpoint driving state to a limiting driving state parameter, the result of the checking being ascertained based on the comparison.

15. The method as recited in claim 13, wherein environmental data which characterize surroundings of the vehicle are received, the comparison being made based on the environmental data.

16. The method as recited in claim 13, wherein the setpoint driving state includes a time stamp, the check for plausibility including a check for at least one of: i) whether the time stamp is in the past, and ii) is no farther in the future than the prediction horizon, the result of the check being ascertained based on the check of the time stamp.

17. The method as recited in claim 13, wherein the setpoint driving state includes a setpoint trajectory which includes a time curve of setpoint positions and setpoint speeds associated with the setpoint positions, the check for plausibility including a redundancy check for whether setpoint speeds correspond to a time derivative of the setpoint positions associated with these setpoint speeds, the result of the check being ascertained based on the redundancy check.

18. The method as recited in claim 13, wherein the surroundings of the vehicle are detected by sensor, the check for plausibility including a check of the surroundings detected by sensor for whether at least one physically drivable collision-free trajectory exists in the surroundings detected by sensor, the result of the check being ascertained based on the check of the surroundings detected by sensor.

19. The method as recited in claim 13, wherein the surroundings of the vehicle are detected by sensor, the check for plausibility including a check of the surroundings detected by sensor for whether the setpoint driving state in the surroundings detected by sensor is collision-free, the result of the check being ascertained based on the check of the surroundings detected by sensor.

20. The method as recited in claim 13, wherein a digital map is received, the check for plausibility including comparing the setpoint driving state with the digital map, the result of the check being ascertained based on the comparison.

21. The method as recited in claim 13, wherein data of another vehicle are received, the check for plausibility including comparing the setpoint driving state with the data of the other vehicle, the result of the check being ascertained based on the comparison.

22. A device for monitoring a system of a vehicle which provides an at least partially automated driving function, the device comprising: an interface for receiving a setpoint driving state predefined by the system; a plausibility device for checking the received setpoint driving state of the vehicle for plausibility; and an interface for at least one of: i) outputting a result of the check that the predefined setpoint driving state is either plausible or implausible to a control device for controlling the vehicle based on the result, ii) outputting the predefined setpoint driving state when the predefined setpoint driving state is plausible, and iii) outputting an emergency setpoint driving state to an actuator system of the vehicle when the predefined setpoint driving state is implausible.

23. A monitoring system for monitoring a system of a vehicle which provides an at least partially automated driving function, the monitoring system comprising: a device including an interface for receiving a setpoint driving state predefined by the system, a plausibility device for checking the received setpoint driving state of the vehicle for plausibility, and an interface for at least one of: i) outputting a result of the check that the predefined setpoint driving state is either plausible or implausible to a control device for controlling the vehicle based on the result, ii) outputting the predefined setpoint driving state when the predefined setpoint driving state is plausible, and iii) outputting an emergency setpoint driving state to an actuator system of the vehicle when the predefined setpoint driving state is implausible; and a control device for controlling the vehicle based on the result, the control device including an interface for receiving the output result and designed for deciding whether the vehicle should be controlled as a function of the setpoint driving state or as a function of the emergency setpoint driving state.

24. A non-transitory machine readable storage medium on which is stored a computer program for monitoring a system of a vehicle which provides an at least partially automated driving function, the computer program, when executed by a processor, causing the processor to perform: checking a setpoint driving state of the vehicle, predefined by the system, for plausibility; controlling the vehicle as a function of the predefined setpoint driving state in order to reach the predefined setpoint driving state when a result of the checking is that the predefined setpoint driving state is plausible; and controlling the vehicle as a function of an emergency setpoint driving state in order to reach the emergency setpoint driving state when a result of the checking is that the predefined setpoint driving state is implausible.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0045] FIG. 1 shows a flow chart of a method for monitoring a system of a vehicle.

[0046] FIG. 2 shows a device for monitoring a system of a vehicle.

[0047] FIG. 3 shows a monitoring system for monitoring a system of a vehicle.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

[0048] Below, the same reference numerals may be used for identical features.

[0049] FIG. 1 shows a flow chart of a method for monitoring a system of a vehicle.

[0050] A setpoint driving state of the vehicle is checked for plausibility in a step 101, the setpoint driving state having been predefined by a system of the vehicle which provides an at least partially automated driving function.

[0051] The vehicle is appropriately controlled based on the result of the check according to step 101. The vehicle is thus controlled as a function of the predefined setpoint driving state in a step 103 in order to reach the predefined setpoint driving state when a result of the check according to according to step 101 is that the predefined setpoint driving state is plausible. However, if the result of the check according to step 101 is that the predefined setpoint driving state is implausible, the vehicle is controlled as a function of an emergency setpoint driving state in a step 105 in order to reach the emergency setpoint driving state.

[0052] Controlling the vehicle as a function of the emergency setpoint driving state includes, for example, controlling the vehicle into a safe state. Controlling the vehicle into a safe state includes, for example, stopping the vehicle.

[0053] In particular one or more of the following criteria may be used for the decision of whether the predefined setpoint driving state is plausible or implausible:

[0054] 1. or example, a model-based consistency and plausibility check of the setpoint driving state may be carried out. This requires no additional input data.

[0055] a. check for maximum/minimum values, for example:

[0056] i. global maximum values, for example maximal physically possible accelerations/decelerations, maximum allowable acceleration/deceleration of the function, time stamp of the driving state not in the past/not farther in the future than the prediction horizon

[0057] ii. driving state-dependent maximum values, for example maximal physically possible transverse acceleration at a given speed, maximum allowable deceleration at a given speed.

[0058] b. for setpoint trajectories: check of the sequence of setpoint driving states for consistency, for example:

[0059] i. advancing time stamps; during a check of such a sequence, the particular time stamps of the setpoint driving states must advance,

[0060] ii. “redundancy” on the physical level; for example, do the speeds in the setpoint states correspond to the derivatives of the positions?

[0061] c. continuity of successive messages (such a message is predefined by the system and includes the setpoint driving state), for example:

[0062] i. advancing time stamps, advancing message counters

[0063] ii. the content of a message cannot be the same as one of the preceding messages (check via check sum, for example). This should never be the case, in particular when a time stamp is contained.

[0064] iii. physical consistency of successive messages, for example continuously increasing setpoint variables.