METHOD AND APPARATUS FOR OPERATING A VEHICLE

Abstract

A method for operating a vehicle, the vehicle being guided in fully automated fashion, and if an error is detected during the fully automated guidance, a safe state being selected from a plurality of safe states as a function of one parameter, the vehicle being guided in fully automated fashion into the selected safe state. Also described is an apparatus for operating a vehicle, as well as to a computer program.

Claims

1-9. (canceled)

10. A method for operating a vehicle, the method comprising: guiding the vehicle in a fully automated manner; selecting, if an error is detected during the fully automated guidance, a safe state from a plurality of safe states as a function of one parameter; and guiding the vehicle in a fully automated manner into the selected safe state.

11. The method of claim 10, wherein the plurality of safe states includes elements from the following group of safe states: standstill on a roadway, standstill in its own lane, standstill in a breakdown lane, standstill in a rest stop, standstill in a parking area, adapting the guidance of the vehicle to a guidance of a vehicle driving in front of the vehicle.

12. The method of claim 10, wherein the parameter describes a traffic situation and/or a sensor availability and/or a hardware availability and/or a state of health of a driver of the vehicle.

13. The method of claim 11, wherein the parameter describes a failure of a rear sensor system of the vehicle, and the guidance of the vehicle is adapted to a guidance of a vehicle driving in front of the vehicle.

14. The method of claim 11, wherein the parameter describes a loss of the driver, and the vehicle is parked in a rest stop or in a parking area.

15. The method of claim 11, wherein the parameter describes a failure of an electronic stability program of the vehicle, and the vehicle is stopped in its own lane.

16. The method of claim 11, wherein the parameter describes a failure of a vehicle electronic stability program and of a vehicle steering system, and the vehicle is stopped on the roadway.

17. An apparatus for operating a vehicle, including: a guidance device to guide the vehicle in a fully automated manner; a detection device for detecting an error; and a selection device, which is configured, upon detection of an error during the fully automated guidance, to select a safe state from a plurality of safe states as a function of one parameter; wherein the guidance device is configured to guide the vehicle in a fully automated manner into the selected safe state.

18. A computer readable medium having computer program, which is executable by a processor, comprising: a program code arrangement having program code for operating a vehicle, by performing the following: guiding the vehicle in a fully automated manner; selecting, if an error is detected during the fully automated guidance, a safe state from a plurality of safe states as a function of one parameter; and guiding the vehicle in a fully automated manner into the selected safe state.

Description

[0042] The present invention is explained in greater detail below on the basis of preferred exemplary embodiments. In this connection:

[0043] FIG. 1 shows a flowchart of a method for operating a vehicle;

[0044] FIG. 2 shows an apparatus for operating a vehicle; and

[0045] FIG. 3 shows a cascade of safe states.

[0046] FIG. 1 shows a flowchart of a method for operating a vehicle.

[0047] According to a step 101, the vehicle is guided in fully automated fashion. If, according to a step 103, an error is detected during the fully automated guidance, then according to a step 105, a safe state is selected from a plurality of safe states as a function of one parameter.

[0048] For example, an error is a failure and/or a malfunction of one or more control devices in the vehicle and/or a failure and/or a malfunction of one or more sensors, e.g., driving-environment sensors and/or inertial sensors, of the vehicle. For instance, an error is a loss of the driver. An error is a limited fitness of the driver to drive, for example. In particular, several errors are detected.

[0049] In a step 107, the vehicle is then guided in fully automated fashion into the selected safe state.

[0050] FIG. 2 shows an apparatus 201 for operating a vehicle (not shown).

[0051] Apparatus 201 includes a guidance device 203 which is designed to guide the vehicle in fully automated fashion. To that end, in particular, the guidance device is in operative connection with actuators and/or control elements of the vehicle. Guidance device 203 especially is in operative connection with a brake system, a steering system and/or a drive system of the vehicle.

[0052] In addition, apparatus 201 includes a detection device 205 for detecting an error. A selection device 207 is also provided which is designed, upon detection of an error by detection device 205 during the fully automated guidance with the aid of guidance device 203, to select a safe state from a plurality of safe states as a function of one parameter. Meanwhile, guidance device 203 is designed to guide the vehicle in fully automated fashion into the safe state which was selected with the aid of selection device 207. For example, the plurality of safe states are stored in a memory.

[0053] Thus, in particular, according to the present invention, from a plurality of safe states, the most suitable safe state is selected for the specific existing situation in which the vehicle finds itself at the moment. Based on this selected safe state, the vehicle is then guided in fully automated fashion into this safe state. In particular, the guidance of the vehicle into this safe state includes the guidance of the vehicle based on a predetermined strategy which, for example, may also be referred to as a fallback strategy. The invention thus makes numerous defined fallback strategies available, and selects the most sensible without aid on the basis of decision criteria (described by the parameter(s)) online (and preferably afresh, thus, continuously at each instant during the automated travel).

[0054] Advantageously, it is thus made possible at any time and as a function of the situation, a specific system state of the vehicle and a detected malfunction, to automatically determine the safe state from a pool of previously defined and technically possible safe states. According to the present invention, preferably procedures and strategies are defined in order to select the suitable fallback mode at any point in time. In case of an error, the vehicle, which may also be referred to as an autonomous or fully automated vehicle, is thereby able to come to a safe state without action by the driver. In this context, the definition of the safe state is essentially a function of the situation in which the vehicle finds itself at the moment. Therefore, according to the present invention, specifically, the safe state is selected automatically at each point in time as a function of the situation (described by the parameter), the system state and the detected malfunctions.

[0055] The following safe states may be defined by way of example: [0056] 1) Standstill on the roadway [0057] 2) Standstill in own lane [0058] 3) Standstill in the breakdown lane [0059] 4) Standstill in the rest stop/parking area [0060] 5) Continuation of travel by “cruising in traffic” (thus, for example, adapting the driving strategy of the ego vehicle to the preceding vehicle)

[0061] For example, the selection of the safe state is a function of the following assessments:

[0062] Traffic Situation

[0063] Here, for instance, the explicit traffic situation, with the speed of the ego vehicle, the position and speed of all other road users and the respective prediction, is decisive. Examples would be “driving in a traffic jam”, “freeway driving, heavy traffic”, “freeway driving, slow-moving traffic”, “freeway driving, light traffic”, “stop & go”, “urban driving”, “overland driving”.

[0064] Sensor Availability

[0065] Namely, here it is a question of which driving-environment and inertial sensors are still available. For example, if the driving-environment sensors to the front fail, then the system must select a different safe state than if only the rear sensors or the side sensors fail.

[0066] Hardware Availability

[0067] In particular, here it is a matter of the control devices in the vehicle which include, for instance, the central control device on which calculations are carried out, the braking-system control device, the steering-system control device, the control device of the monitoring function and/or all further control devices installed in the vehicle.

[0068] FIG. 3 shows a cascade of safe states, for which given availabilities may then be defined, for example. Different escalation levels are shown. The least critical level is a continuation of driving (if, for example, a rear sensor should fail), but the fallback mode may further escalate (thus, the further states are started up depending on the situation) if, in addition, for instance, the steering system or the driver are also lost. Therefore, the wording “cascade” used is meant in this context. “Given availabilities” means in this regard that a specific fallback strategy is used depending upon which vehicle components (sensor systems, control devices...) are still functional.

[0069] If, according to block 301, a rear sensor system has failed, then, for instance, a continuation of driving correspondent to cruising in traffic according to block 303 is provided.

[0070] If, according to block 305, a loss of a driver of the vehicle is detected, then according to block 307, the vehicle is parked in a rest stop or in a parking area (standstill in the rest stop or in the parking area).

[0071] If, according to block 309, a failure of an ESP is detected, then according to block 311, the vehicle is stopped in its own lane (standstill in own lane).

[0072] If, according to block 313, it is detected that both the ESP and a steering system of the vehicle have failed, then according to block 315, the vehicle is stopped on the roadway (standstill on the roadway).

[0073] An illustrative cascade of exemplary strategies in the fallback system may look as follows, for example: [0074] 1) Complete redundant continuation of driving: [0075] A redundantly designed sensor/control device fails. Here, continuing to drive with primary sensors and without redundancy, possibly at reduced speed and with reduced range of functions, is the safest state in certain situations. Certain situations are particular situations in which a different strategy would have an increased risk of accident. For example, braking in lane if the vehicle is driving in the left lane and no vehicle is coming behind the ego vehicle. Then, as the case may be, a rapidly approaching vehicle can run into our (the vehicle) from behind. Reduction of the range of functions: No lane changes, no passing maneuvers, “cruising”. Speed reduction in order to bring about shorter braking distance and less required foresight. Maximum allowed braking distance depends upon the functional performance actually remaining (e.g., projection of the surround-field model). [0076] 2) Assume the speed of the vehicle in front (thus, the preceding vehicle) and follow the lane: [0077] This strategy includes braking or acceleration to the speed of the preceding vehicle, as well as lane keeping. In particular, this strategy is advantageous on little-used freeways, with vehicle in front and available front sensor system. For example, in the event the rear sensor system fails. “Little-used” means, in particular, that the distances to the vehicle driving ahead or driving behind are considerably greater (>>) than the braking distance. [0078] 3) Active lane change to the emergency stopping lane: [0079] For instance, this strategy is employed if a driver-monitoring system signals back that the driver has health problems. In this situation, the highly automated vehicle is still completely functional, but because of statutory provisions, is no longer allowed to continue to drive. [0080] 4) Slow drifting in the direction of the shoulder or emergency stopping lane: [0081] This strategy includes two steps. In the first step, there is no further acceleration. In the second step, the vehicle attempts to drift slowly to the right (in the direction of the shoulder). “Slowly” depends especially upon how much steering-wheel torque is still able to be provided. Here, slowly means preferably that the dynamics have no significant influence for the steering control. This strategy is advantageous particularly in situations with few road users, low speed differentials and high absolute speeds. [0082] 5) Braking in its own lane: [0083] This is the simplest strategy; it may be used especially when the vehicle (and all surrounding vehicles) are underway a bit faster, and have small spacings between them. For instance, this is the case in a traffic jam in curves. In order not to additionally bring the other road users into danger due to unexpected braking maneuvers, notably, this state is only activated if vehicles are detected behind the ego vehicle which are not traveling substantially faster (e.g., maximum of 10 km/h to 20 km/h faster) than the vehicle (ego vehicle) (maximum distance 2-3 times the braking distance in the case of full brake application). They should then have a distance small enough that they perceive the action of the ego vehicle and brake their vehicle accordingly. This situation is mostly found in traffic-jam scenarios. [0084] In the event the ESP fails, but the steering is still functional, standstill in its own lane may be viewed as the safe state, which is selected from the plurality of safe states. Should there be a functioning redundant steering system in the vehicle, this state would also be the safe state if the brake and the steering were to fail. [0085] 6) (Straightline) braking [0086] If not only the ESP, but also the steering fails, the vehicle can only be brought to a standstill with the aid of the redundant brake. [0087] Therefore, according to the present invention, the selection of the fallback strategy is a function of the components installed in the vehicle (e.g., automobile) that are functioning or have failed, as well as the traffic situation.