ARCHITECTURE FOR A DRIVING ASSISTANCE SYSTEM WITH CONDITIONAL AUTOMATION

Abstract

The invention concerns an architecture for a driving assistance system with conditional automation capable of controlling an automatic emergency stop of a vehicle, comprising: a set (2) of sensors of at least three different technologies for observing an area in front of a vehicle; a main computer (10) capable of receiving, via a first upstream data communication network, information from said set (2) of sensors, and of transmitting commands, via a first downstream communication network, to a first computer (3) of an engine control system, to a second computer (4) of a braking system and to a third computer (5) of a steering control system: a backup computer (11) capable of receiving, via a second upstream data communication network, information from said set of sensors in case of a failure relative to the main computer (10); a main power supply source linked to each computer; and a backup power supply source. The architecture comprises a second downstream communication network connecting only the backup computer (11) to said second computer (4) of the braking system for the transmission of commands, and the backup power supply source is connected only to the main computer (10), to the backup computer (11) and to the second computer (4) braking system.

Claims

1. An architecture for driving assistance system with conditional automation able to control automatic emergency stopping of a vehicle, comprising: a set of sensors of at least three different technologies for observing a zone at the front of a vehicle; a main computer able to receive, through a first upstream data communication network, information from said set of sensors, and to transmit commands, through a first downstream communication network, to a first computer of an engine control system, to a second computer of a braking system and to a third computer of a steering control system; a backup computer able to receive, through a second upstream data communication network, information from said set of sensors; a main power supply source linked to each computer; a backup power supply source; and a second downstream communication network linking only the backup computer to said second computer of the braking system for the transmission of commands, and in that the backup power supply source is linked only to the main computer, to the backup computer and to the second computer of the braking system.

2. The architecture as claimed in claim 1, wherein the first and second upstream and downstream data communication networks are serial data bus networks.

3. The architecture as claimed in claim 2, wherein the first and second upstream and downstream data communication networks are CAN networks.

4. The architecture as claimed in claim 1, wherein the backup computer is identical to the main computer.

5. The architecture as claimed in claim 1, wherein the backup computer has a lower failure criticality level than that of the main computer.

6. The architecture as claimed in claim 5, wherein the failure criticality level of the main computer is ASIL D, and the failure criticality level of the backup computer is ASIL B.

7. The architecture as claimed in claim 1, wherein said set of sensors comprises at least one image sensor, one radar sensor and one laser sensor.

8. The architecture as claimed in claim 1, wherein the backup computer is linked to the main computer, and controlled in such a way as to receive, through the second upstream data communication network, information from said set of sensors only in case of a failure relating to the main computer.

9. The architecture as claimed in claim 1, wherein the backup computer receives permanently, through the second upstream data communication network, information from said set of sensors, even in the absence of a failure relating to the main computer.

Description

[0032] The invention and the various advantages that it affords will be better understood in view of the following description, given with reference to the appended figures in which:

[0033] FIG. 1, already described hereinabove, schematically illustrates the phases implemented by a driving aid system with conditional automation in a known strategy for returning to the safe state;

[0034] FIG. 2 schematically illustrates an exemplary architecture in accordance with the invention for a driving aid system with conditional automation.

[0035] Throughout the disclosure, any driving assistance system of level 3 (SAE/NHTSA) is called a driving assistance system with conditional automation.

[0036] With reference to FIG. 2, an architecture for a driving assistance system with conditional automation able to control automatic emergency stopping of a vehicle and to guarantee a return to the safe state in accordance with the scenario described in FIG. 1 conventionally comprises a core control module 1 comprising: [0037] on the one hand, a main computer 10 able to receive, through a first upstream data communication network, information from a set 2 of sensors able to observe a zone at the front of the vehicle; [0038] on the other hand, a backup computer 11, linked to the main computer 10, and able to receive, through a second upstream data communication network, information from said set 2 of sensors.

[0039] The system has an ASIL D failure criticality level so that, for the set 2, provision is made to use three different technologies for the sensors. Thus, the set 2 can comprise, by way of nonlimiting example, at least one laser sensor 20, one radar sensor 21 and one image sensor 22. The principles of the invention are applicable whatever combination of different technologies (or types) is used.

[0040] In FIG. 2, the first upstream network comprises the three connections shown diagrammatically as solid lines between the sensors 20 to 22 and the main computer 10, whilst the second upstream network comprises the three connections shown diagrammatically as dashed lines between these same sensors 20 to 22 and the backup computer 10.

[0041] The role of the main computer 10 is to process the information originating from the sensors 20 to 22, and in particular to apply, if necessary, the strategy for returning to the safe state, described with reference to FIG. 1. Accordingly, this main computer 10 is able to transmit the appropriate commands to the various computers of the vehicle that are involved in this strategy, and in particular respectively: [0042] to a first computer 3 of an engine control system, [0043] to a second computer 4 of a braking system; and [0044] to a third computer 5 of a steering control system.

[0045] The transmission of the commands is performed through a first downstream communication network, represented by the solid-line connections between the main computer 10 and the three computers 3, 4 and 5.

[0046] All the computers described hereinabove are powered by a main power supply, for example a battery (+BAT1 in FIG. 2).

[0047] The role of the backup computer 11 is for its part to substitute itself for the main computer 10 in case of failure of the latter.

[0048] In accordance with the invention, instead of doubling the downstream communication network between the computers of the system on the one hand, and the three computers 3, 4 and 5, there is provision here to provide a second downstream communication network linking the backup computer 11 just to the second computer 4 of the braking system for the transmission of commands. This second downstream communication network is represented by dashed lines between the backup computer 11 and the braking computer 4.

[0049] This type of control is sufficient to also control the steering of the vehicle, in particular at low speed. Indeed, the computers of braking systems are currently all so-called ESP computers (the initials standing for Electronic Stability Program) which can command in a differential manner the braking on each of the wheels, and thus contrive matters so that the vehicle remains in its lane until it stops.

[0050] Moreover, to mitigate a possible malfunction of the main power supply +BAT1, a backup power supply source (+BAT2 in FIG. 2), for example a battery, is provided in the architecture. Here again, the architecture is simplified to what is strictly necessary by providing that this backup power supply be used only by the main computer 10, the backup computer 11 and the computer 4 of the braking system alone.

[0051] Stated otherwise, an architecture in accordance with the invention consists in making redundant, downstream of the computer of the system, the double power supply and the communication network only for the computer 4 of the braking system.

[0052] This results in a cost reduction which in no way limits the guarantee of a return to the safe state in the case in which a driver were unable to take back control.

[0053] Within the framework of FIG. 2, it has been considered that the backup computer 11 was linked to the main computer 10, so that it operates in reception and in emission only in case of failure of the main computer.

[0054] It is however possible, without departing from the scope of the invention, not to link the two computers 10 and 11. In this case, the two computers 10 and 11 operate in parallel permanently and it is in case of failure of the main computer that the computers 3, 4 and 5 downstream switch to backup mode. One then speaks of hot redundancy. This solution allows a faster reconfiguration but consumes more energy.