WO2009071345A1

WO2009071345A1 - Central control unit for a plurality of assistance systems provided in a motor vehicle, and motor vehicle

Info

Publication number: WO2009071345A1
Application number: PCT/EP2008/058716
Authority: WO
Inventors: Jürgen DIEBOLD
Original assignee: Continental Teves Ag & Co. Ohg
Priority date: 2007-12-04
Filing date: 2008-07-04
Publication date: 2009-06-11
Also published as: DE102007058192A1

Abstract

The invention relates to a central control unit (1) for a plurality of assistance systems (2, 3, 4, 5) provided in a motor vehicle, each operating individually and of which at least one assistance system (2, 3, 4, 5) is equipped with environment sensors. The central control unit (1) is connected to the individual assistance systems (2, 3, 4, 5) and designed to obtain sensor information from the assistance systems (2, 3, 4, 5) and to analyze the same, and to report back status and/or control commands to the assistance systems (2, 3, 4, 5). In order to also be able to make safety-related interventions into the driving dynamics using the assistance systems (2, 3, 4, 5), the invention proposes that the central control unit (1) have a safety control unit (6) that is designed to check non-redundant sensor information of the individual assistance systems (2, 3, 4, 5) by means of analytic redundancies of different sensor information obtained from the central control unit (1).

Description

Central control unit for several provided in a motor vehicle assistance systems and motor vehicle

The invention relates to a central control unit for a plurality of assistance systems provided in a motor vehicle and to a motor vehicle equipped with this control unit. The central control device according to the preamble of claim 1 is a common control device for several, each individually and independently working assistance systems, of which at least one assistance system is equipped with environmental sensors for detecting the vehicle environment. The central control unit is connected to the individual assistance systems and is set up to receive and evaluate sensor information from the assistance systems and to return status and / or control commands to the assistance systems.

Motor vehicles are increasingly being equipped with assistance systems, to which, according to the invention, in particular comfort-oriented driver assistance systems, electronically controllable brake assistance systems, in particular with an emergency brake tenzsystem and telematics systems optionally with an automatic emergency call function include, in addition to on-board sensors for detecting the vehicle speed including environmental sensors. Such environmental sensors can be, for example, radar sensors, cameras, LIDAR sensors (Light Detection And Ranging), which detect the backscattering of emitted light pulses. In the context of the invention, environment sensors are also understood to mean telematics systems which transmit sensor information of adjacent motor vehicles or other devices (for example, barks at the roadside) in a Car2Car or Car2x communication.

Previously known driver assistance systems (FAS or DAS - Driver Assistance System), emergency braking systems, such as the described in WO 2004/085220 Al APIA system, and / or telematics systems, such as from DE 10 2005 037 155 Al known emergency call system or from DE 10 2004 017 602 Al known Car2x system, do not serve exclusively the driver information, but partially initiate automatic interventions in the vehicle system, which are classified under the safety aspect in a critical category. There are safety regulations to be followed for this.

Particularly relevant is the standard IEC 61508, which defines four discrete safety integration levels (SIL, Safety Integrity Level). These levels give upper limits for an average probability of failure of safety functions on demand and the probability of dangerous failure per hour as well certain hardware fault tolerances. According to the aforementioned standard, for example, emergency braking interventions in the vehicle system must at least meet the requirements of the critical category SIL3, which requires the presence of reliable and redundant information on the decision basis.

However, typical environmental sensors used in conjunction with the required assistance systems do not meet these requirements for redundancy according to SIL3 and are usually designed only to SIL2. Thus, data obtained by these environment sensors may not be used as the sole basis for the fully automatic brake intervention in a vehicle system or other safety-relevant interventions. On the basis of these environment sensors, interventions subject to the security level SIL3 can not be carried out arbitrarily.

This will be described below using the example of automatic braking interventions to reduce the stopping distance of the motor vehicle. For example, WO 2005/044652 A1 discloses a brake assistant for motor vehicles, in which, in addition to a control device for preparing or initiating an emergency braking, an evaluation device is provided for detecting the driver's braking request, which includes the signals of an environment sensor in its evaluation and evaluates. The decisive factor is that emergency braking is only initiated if it is also possible to draw conclusions about the driver's braking request. However, this is disadvantageous since still the far more accidents are based on misjudgments of the driver. Therefore, even if the sensor system of the assistance systems present in the vehicle can objectively recognize a situation in which emergency braking is the only sensible reaction to avoid an accident or reduce the consequences of an accident, this system can not necessarily and fully initiate emergency braking when the driver Assessment of the system does not share and, for example, from overestimation of his driving skills, the motor vehicle accelerated even further.

WO 2004/085220 A1 describes an electronic control system for a vehicle and a method for determining at least one driver-independent intervention in a vehicle system. The intervention is implemented as time-limited and / or intensity-limited autonomous braking intervention, whereby here too the driver's intention and a determination of the potential danger for the activation, conditional release or blocking of agency interventions leads. For this purpose, a central electronic control system is proposed, which is connected to many autonomously operating assistance systems that collects sensor data and returns request commands to the individual assistance systems when a dangerous situation is detected. These request commands relate to both passive and active safety and can be used by a brake or emergency brake assist system to initiate pre-braking ("prebrake").

However, even with this system, there is a problem that the reliability of the sensor data used for the determination The regulatory interventions and the complexity of the situation in driving dynamics interventions in the vehicle do not allow autonomous interventions, because the specifications of the corresponding security level can not be met. Therefore, the determining actions determined from the danger computer can only be realized to a limited extent after a rating in an arbitration unit with the driver request ascertained in the driver request module. In particular, triggered brake interventions of the system due to the non-redundant sensor configurations may not be performed arbitrarily, but must be limited in intensity and / or duration of intervention.

The object of the present invention is therefore to propose a possibility with which safety-relevant interventions in the driving dynamics of the vehicle can be realized by acting on assistance systems with a stronger intervention intensity and / or a longer or unlimited intervention duration. In particular, a motor vehicle to be equipped with driver assistance, braking or emergency braking and / or telematics systems that allow largely autonomous intervention in the vehicle dynamics.

According to the invention this object is achieved by a central control device having the features of claim 1.

It is provided that the common central to the assistance systems control unit has a security control unit which is adapted to non-redundant sensor information of the individual assistance systems by means of analytical redundancies different from the Central control unit received sensor information to u berüber- check. This is based on the knowledge that even data supplied by non-redundant sensors can be checked for their reliability by establishing logical relationships in the form of analytical redundancies, so that after successful verification, these sensor data can be assumed to be secure. For this purpose, the sensor data can be checked by data from other sensors and / or the determined sensor data of a non-redundant sensor placed in a temporal context.

The latter is particularly possible with camera shots that extract, for example, from a snapshot of certain sensor information that can be checked again on the basis of a time later taken camera recording. If the camera information is, for example, a vehicle in front, it can be checked by means of speed information whether the camera image recorded later in time and which identifies the same preceding vehicle agrees with the acquired sensor knowledge. If so, the data can be considered safe. Corresponding analytical redundancies can be achieved in addition to the aforementioned example also by many other sensor information, which are set in relation to each other. As a result, originally non-redundant or safe sensor data can be classified as safe after a check and classified as relevant and safe sensor data according to the requirements of the standard IEC 61508 according to the safety integrity level SIL3. Advantageously, non-redundant sensor information is plausible in the security control unit after a successful verification of the analytical redundancies. The correspondingly marked sensor information then complies with the SIL3 standard. For plausibility checking, the analytical redundancy is checked as described above, in particular by comparison with other sensor information. If redundant and safe sensor information is already available, for example from a SIL3 sensor, it will be plausible immediately and without comparison with other sensor data. The plausibility check can be indicated by additional information in the sensor data, for example by an identifier, which can also allow a conclusion to be drawn on the plausibility-carrying out body and / or the data used for the plausibility check.

In particular, all or selected non-redundant sensor information from environmental sensors with the goal of plausibility checking can preferably be checked in the security control unit. The sensor information of the environment sensors play a particularly important role, especially with regard to safety-relevant and dynamic driving interventions in the motor vehicle system.

In order to obtain a particularly high level of security, non-redundant sensor information from an environment sensor can be checked in the security control unit exclusively by sensor information from another environment sensor, which is preferably displayed by the central control unit on another signal path and / or in another Form of writing the environment interpretation were obtained. By a different signal path, for example in a Fahrzugbussystem systematic signal interference are largely excluded. The different description forms can be, for example, different target lists or partially preprocessed object lists, which were created on the basis of the individual sensor information.

Another possibility of checking in the security control unit is that preferably all or selected, non-redundant sensor information by means of a safety card (SafetyMap) are analyzed, the security card at least consists of a navigation map with security-related attributes and preferably stored directly in the central control unit and updated as appropriate in accordance with the information available.

In order to utilize the sensor data after the plausibility check, the central control unit can be set up to generate control commands based on the plausibilized sensor information, in particular plausible sensor information from environmental sensors, and report back to the assistance systems, whereby these control commands can bring about a safety-relevant intervention in the vehicle, without the need for an explicit or implicitly derived driver's consent. These safety-relevant interventions in the vehicle are not necessarily limited in their intensity or duration, so that, for example, in the presence of correspondingly safe and dundanter sensor information from environmental sensors fully automatic emergency braking of the motor vehicle can be performed.

In this case, the control command would thus be an unlimited and / or unconditional emergency brake command to a brake assist system. Of course, the present invention is not limited to control commands to a brake assist system. Other control commands with a likewise safety-relevant intervention in the motor vehicle can be an automatic intervention in a driver assistance system, optionally in the context of an automatic lane check, an automatic distance control, or an automated emergency call transmission in a telematics emergency call system. The control commands can also represent plausible warnings in a Car2Car or Car2x communication, which were generated by third-party systems, for example other motor vehicles, in a plausible manner and interpreted as safe and relevant sensor information of an environmental sensor without their own plausibility check. These data, which are classified as safe and redundant, may also directly effect corresponding interventions by the driving assistance assistance systems. However, the above applications are only examples in which the present invention may be used, and are by no means to be construed as enumeration enumeration. However, the use of the control device according to the invention or running on this process according to the invention for generating an emergency braking command by a brake assist system is an important application. The assistance systems connected to the control unit can preferably be a comfort-oriented driver assistance system, a brake assistance system optionally with emergency brake function, a telematics system optionally with emergency call function and / or any control device, for example an airbag control, which also perform their function independently without the common central control unit can and work autonomously.

In order to be internally redundant, the central control unit preferably has a dual-core processor architecture. This enables redundant signal processing.

Furthermore, the central control unit can have scalable computing resources, in particular modularly scalable memory (RAM / ROM) and / or processor sizes. As a result, the central control unit is also easily adaptable to future, new tasks. For example, such a customer or third-party software can be easily integrated into the central control unit. In an extreme case with small system characteristics, the functionality and the hardware to be integrated can also be integrated in the control unit of the brake assist system (ESP system), in particular if primarily an emergency braking system is to be implemented.

Furthermore, the invention relates to a motor vehicle having assistance systems, in particular comfort-oriented driver assistance systems, brake or emergency braking assistance systems and / or telematics systems, wherein the force vehicle is equipped with the above-described common control unit for the assistance systems.

With the invention, the approaches to a global vehicle control system (GCC, Global Chassis Controler) of all vehicle dynamic systems (longitudinal, transverse, and vertical stabilization) and the approaches for driver assistance and braking systems, such as APIA, make the safety-related interventions, and Implement telematics-based systems in a central control unit that meets the requirements of a SIL3-capable architecture.

Since in this SIL3-capable architecture the individual sensor signals, which are non-redundant (eg the sensor data obtained by a telematics system with Car2Car or Car2Infrastructure (Car2x) communication), are plausibilized among one another working assistance systems stronger and unrestricted system interventions are realized in the motor vehicle, in particular emergency braking interventions based on information provided by telematics systems or environment sensors with increased range and increased reliability.

Thus, a central control unit is provided for the holistic detection of the vehicle environment, the vehicle dynamics and for determining the control interventions as well as the integration of vehicle inertial sensor technology for active and passive safety systems, which meets the high safety requirements of the IEC 61508 standard. Due to the scalable architecture of the control unit, this be adapted to the respective existing tasks.

Further advantages, features and applications of the present invention will become apparent from the following description of an embodiment and the drawing. All described and / or illustrated features alone or in any combination form the subject matter of the present invention, also independent of their summary in the claims or their back references.

The only Fig. 1 shows schematically an inventive central control device for several provided in a motor vehicle assistance systems.

The central control unit 1 is connected to a plurality of assistance systems, which operate individually and independently. In the illustrated example are as assistance systems a driver assistance system 2, a brake assist system 3, which also takes over the function of an emergency braking assistance system, and a telematics system 4 is provided, for example, to send emergency calls as Ecall system and / or communication with others Road users (Car2Car communications) or roadside infrastructure (Car2Infrastructure communications). As a further assistance system 5 or control unit, airbag control units, control units for other active or passive security elements, electronic control systems or the like may be connected to the central control unit 1. A bidirectional communication option is provided between the assistance systems 2, 3, 4, 5 and the central control unit 1, so that the central control unit 1 can receive, in particular, sensor information data from the assistance systems 2, 3, 4, 5 and, for example, send control commands back to them.

The driver assistance system 2 is equipped with three ambient sensors, not shown, for detecting the vehicle surroundings, which are a radar sensor, a camera and a LIDAR sensor which detects the light reflected by an upper surface of a transmitted light pulse / burst. These environmental sensors allow the assistance systems to actively assist the driver of the motor vehicle. Radar sensors detect, for example, the distance to vehicles in front. Camera sensors can be used for lane detection, light detection in the dark, traffic sign recognition or vehicle detection. However, each of these environmental sensors does not generate secure and redundant data, especially because the analysis and recognition of data is often associated with certain uncertainties and misinterpretations of the data can not be excluded. In addition, a technical malfunction of individual sensors is possible. For example, the camera located behind the windshield may temporarily fail if the windshield is frosted or fogged.

For this reason, according to the standard for functional safety IEC 61508, it is not allowed for such Sensors that do not provide safe and redundant information and thus do not belong to the security level SIL3 be used as a basis for automatic and automatic intervention in the driving dynamics of a motor vehicle, especially if the driver does not confirm the proposed by the assistance system response or initiated by the assistance system Intervention is not limited in duration or intensity.

In order to check the sensor information obtained by the environment sensors of the driver assistance system 2, they are therefore transmitted to the central control device 1 in accordance with the method proposed according to the invention and evaluated there in a safety control unit 6. The security control unit 6 is set up to check the non-redundant sensor information of the individual assistance systems 2, 3, 4, 5 by means of analytical redundancies of various sensor information obtained from the central control unit. The sensor information used for the logical check can be sensor information of other sensors connected to the assistance systems 2, 3, 4, 5, in particular of the environment sensors. Furthermore, sensors 7, 8 can be directly connected to the control unit 1, which transmit information about the vehicle dynamics or the airbag system to the central control unit 1, for example. Of course, other sensors can be connected directly to the central control unit 1 and either used as additional information for the analytical redundancies or even be checked. The direct integration of sensors 7, 8 in the central control unit 1 also has the advantage that in Compared to separate sensor clusters for example, the brake or ESP system and the airbag costs can be saved.

An example of such an analytical redundancy check could be that the image information of a camera confirms the measurement data of a beam sensor (radar, lidar), i. form redundant information in the sense of SIL3

(Sensor fusion). However, these data can also deliver erroneous values through de-adjustment. However, this misalignment can be achieved according to the invention e.g. with the help of driving dynamics sensors

(Vertical acceleration and / or rebound travel of an air suspension or a controlled chassis) - ie the horizon determined by the camera with the sensed position of the chassis must be checked for plausibility and checked.

On the one hand, this reduces the error rate and, on the other hand, increases the intervention strength of the autonomous interventions and increases the duration of the interventions.

If the analytical redundancy check has been successfully completed, the tested sensor information is considered redundant and safe. They are then plausibilized by the security control unit 6 or the central control unit 1. For this purpose, a corresponding identifier can be added to the sensor data.

These plausibilized sensor data are sent to the individual assistance systems 2, 3, 4, 5, provided that the relevant assistance system 2, 3, 4, 5 evaluates this data. In a frequent application, the plausibilized sensor information of the environment sensors are supplied to the brake assist system 3, which then builds on this information in a conventional manner then initiates an automatic emergency braking, if the sensor information of the environment sensors and optionally further sensor information that makes plausible by the central control unit 1 indicate a dangerous situation that requires emergency braking. Since emergency braking then takes place on the basis of plausible sensor information that corresponds to safety level SIL3, emergency braking does not have to be actively confirmed by the driver, nor does the system inevitably restrict braking time or braking intensity.

By the assistance systems are enabled by the present invention proposed plausibility check on unsafe and redundant sensor information in the situation to exercise safety-related interventions in the driving dynamics of the motor vehicle, the overall safety in traffic is increased, as just serious dangerous situations, recognized by the sensors undoubtedly can be countered in a positive way.

Furthermore, the central control unit according to the invention can have interfaces for a mobile radio communication 9, a telematics communication 10 with the environment of the motor vehicle, for a satellite navigation 11 and for a safety map (SafetyMap) 12, with a safety device. health card can also be integrated directly into the central control unit 1 and there is immediately updated based on the information available.

With the central control unit 1 according to the invention or a vehicle equipped with this control unit 1, the function of automatic assistance systems present in a motor vehicle can be considerably expanded because the competencies of the assistance systems can be extended as a whole by the plausibility check of safety-relevant sensor information.

List of reference numbers:

1 central control unit

2 driver assistance system

3 Brake / Emergency Brake Assist System

4 telematics system

5 assistance system / control unit

6 security control unit

7 sensor

8 sensor

9 Interface for mobile radio communication

10 interface for telematics communication

11 Interface for satellite navigation

12 Interface for a security card

Claims

Claims:

1. Central control unit for several provided in a motor vehicle assistance systems (2, 3, 4, 5), each working individually and of which at least one assistance system (2, 3, 4, 5) is equipped with environmental sensors, wherein the central control unit ( 1) is connected to the individual assistance systems (2, 3, 4, 5) and is set up to receive and evaluate sensor information from the assistance systems (2, 3, 4, 5) and to send status and / or control commands to the assistance systems (2 , 3, 4, 5), characterized in that the central control unit (1) has a security control unit (6) which is adapted to non-redundant sensor information of the individual assistance systems (2, 3, 4, 5) by means of analytical redundancies various, from the central control unit (1) obtained to verify sensor information.

2. Central control unit according to claim 1, characterized in that non-redundant sensor information in the security control unit (6) are plausibilized after a successful verification of the analytical redundancies.

3. Central control unit according to claim 1 or 2, characterized in that non-redundant sensor information from environment sensors is checked in the safety control unit (6).

4. Central control unit according to one of the preceding claims, characterized in that in the security control unit (6) nichtredundante sensor information of an environment sensor are checked by sensor information of another environmental sensor, preferably by the central control unit (1) on a different signal path and / or in a other description of the environment interpretation.

5. Central control unit according to one of the preceding claims, characterized in that non-redundant sensor information is checked by means of a security card in the security control unit (6), wherein the security card at least consists of a navigation map with security-relevant attributes and is stored in the central control unit.

6. Central control unit according to one of claims 2 to 5, characterized indicates that in the central control unit (1) on the basis of plausible sensor information, in particular plausibilized sensor information from environment sensors ren, generates control commands and returned to the assistance systems (2, 3, 4, 5), wherein the control commands can cause a safety-relevant intervention in the vehicle.

7. Central control unit according to claim 5, characterized in that the control command is an unrestricted and / or unconditional emergency brake command to a brake assist system (3).

8. Central control unit according to one of the preceding claims, characterized in that the assistance systems (2, 3, 4, 5) a comfort-oriented driver assistance system (2), a brake assist system (3), a telematics system (4) and / or a control device (5 ) are.

9. Central control unit according to one of the preceding claims, characterized indicates that the central control unit (1) has a dual-core processor architecture.

10. Central control unit according to one of the preceding claims, characterized indicates that the central control unit (1) scalable computing resources, in particular modular scalable memory and / or processor sizes having.

11. Motor vehicle with assistance systems (2, 3, 4, 5), in particular a comfort-oriented driver assistance system (2), brake assist system (3) and / or telematics system (4), characterized in that the motor vehicle is a common control unit (1) for the assistance systems (2, 3, 4, 5) according to one of claims 1 to 9.