WO2016142030A1 - Method and device for operating a vehicle - Google Patents

Abstract

The invention relates to a method for operating a vehicle (1) in an automatic driving mode. According to the invention, during a normal function (NF) of the automatic driving operation, an emergency target trajectory (NT) is continuously determined and stored, which after the occurrence of at least one specified error event (FE) is to be used as a basis for an automated trajectory control of the vehicle (1), and after detection of the occurrence of the at least one predetermined error event (FE), an emergency operating mode (NM) is activated, in which the automatic trajectory control of the vehicle (1) is initiated, and in accordance with the emergency target trajectory (NT) stored prior to the occurrence of the at least one predetermined error event (FE), is carried out for a specified time period (t) and/or until the vehicle (1) comes to a standstill (S), if and as long as no vehicle control takeover (FF) by a driver of the vehicle (1) takes place.

Description

 Method and device for operating a vehicle

The invention relates to a method for operating a vehicle according to the

Features of the preamble of claim 1 and an apparatus for performing the method.

As described in DE 10 2013 003 216 A1, a method for determining a lane for steering regulation of an automatically controlled vehicle is known from the prior art. In this method, a lane with a first system based on detected environmental data is determined and another

Lane is determined by a second system. Starting from a current position, the second lane is determinable independently of the first lane on the basis of a digital map and data obtained by odometry. Process data for determining the lanes calculated by the first and second systems are continuously compared with one another, and if one of the two systems fails, the lane is determined solely on the basis of the remaining and functional system.

The invention is based on the object to provide a comparison with the prior art improved method for operating a vehicle and an apparatus for performing the method.

The object is achieved by a method for operating a vehicle having the features of claim 1 and an apparatus for performing the method with the features of claim 8.

Advantageous embodiments of the invention are the subject of the dependent claims. In a method of operating a vehicle in an automated manner

Driving operation, preferably in a highly automated or autonomous driving operation, according to the invention, an emergency fall trajectory is continuously determined and stored during a normal function of the automated driving operation, wherein the

Emergency Fall trajectory is a trajectory that is to be based on the occurrence of at least one predetermined error event of an automated trajectory control of the vehicle. When the at least one predetermined error event then occurs and is detected, an emergency mode of operation is initiated in which the automated trajectory control of the vehicle is initiated and according to the last emergency trajectory stored prior to the occurrence of the at least one predetermined error event for a predetermined period of time and / or to a standstill of the vehicle is performed, if no vehicle management takeover by a driver of the vehicle. The emergency mode of operation is advantageously terminated prematurely if a vehicle management takeover by the driver of the vehicle.

By an automated trajectory control is here to be understood a control and / or regulation of a longitudinal and transverse movement of the vehicle, by which the vehicle automatically, i. without the assistance of the vehicle driver, along a desired trajectory, in the present case along the emergency rolling trajectory, is performed. The emergency rolling trajectory thereby predefines a desired position desired course, which represents a series of positional points of a location coordinate system, which are to be traversed when the vehicle is traveling in the emergency operating mode, and advantageously additionally specifies with which dynamics this should be done. The dynamics are advantageously set in such a way that the vehicle is delayed in its further travel in the emergency operating mode.

In order to determine the emergency target trajectory, the position desired course to be achieved and a position to be achieved along the position target course are preferably determined

Speed set profile determined. The dynamic range to be achieved in the emergency operating mode of the vehicle is thus specified as a speed setpoint profile, wherein the deceleration with which the vehicle is to be delayed in the emergency operating mode is specified via the speed setpoint profile. Overall, by the

Trajektorienregelung according to the default by the emergency trajectory safe and accurate guidance of the vehicle and a safe braking of the vehicle in Achieved cases in which an automated driving operation due to the occurrence of at least one error event can not be continued.

Such error events, the occurrence of a continuation of the automated driving operation, in particular the highly automated or autonomous driving, is no longer possible and when they are to take action to bring the vehicle in a safe state, for example, be:

 a failure of an environment sensor system required for automated driving

- and / or a failure of one required for automated driving

 Driving control unit, for example, one provided for this purpose

 Main control unit of the vehicle,

 - and / or a failure of at least one primary electrical system of the vehicle

 - and / or the failure of a communication (bus failure) between the

 Driving control unit and the environmental sensor system and / or between the driving control unit and other components of the vehicle,

 for example, other control and / or regulating units and / or actuators.

As measures for coping with such fault events, the emergency operating mode is activated according to the invention upon detection of the occurrence of at least one of these predetermined fault events, and the trajectory control to be carried out in the emergency operating mode is initiated.

The at least one error event is preferably detected as having occurred if it has been continuously present after a predetermined error tolerance time has elapsed. In this way, an unnecessary abort of the normal function of the automated driving and thus an unnecessary change in the

Emergency mode in a short-term, for example, in the millisecond range, existing error event avoided. As an emergency target trajectory, the emergency trajectory last determined and stored before the occurrence of the at least one predetermined error event and thus before the beginning of the error tolerance time is used. In this way, it is ensured that emergency target trajectories, which were determined and stored within the fault tolerance time when the error event already existed, and which therefore could be faulty, are not used for the emergency operating mode. This will ensure a safe guidance of the vehicle

Emergency mode enabled. The solution according to the invention makes it possible to bring the vehicle into a safe state upon the occurrence of a predetermined fault event and is cost-effective and takes up little space in the vehicle, as otherwise redundant design of the driving control unit and redundant connection of the environmental sensor system may be dispensed with.

The predetermined period of time during which the trajectory control is to be carried out is expediently set so long that the driver has sufficient time to react and to be able to take control of the vehicle. If he does not do so, it is his responsibility. However, it is expedient in this case also ensured that the vehicle is safely brought to a standstill.

By activating the emergency operating mode when the occurrence of the at least one predetermined fault event has been detected and by carrying out the trajectory control in the emergency operating mode, a controllable result is achieved even in cases in which the automated driving operation can no longer be continued. This result can preferably be improved by making available a correction of the emergency target trajectory as a function of the environmental information in cases where environmental information, in particular optically detected environmental information, is available when the emergency operating mode is activated. This changes the emergency target trajectory

Adapted to environmental conditions. Preferably, this will be the

Position set course and / or the speed set profile to changed

Adjusted environmental conditions, which are based on the detected

Environmental information has been determined. That way you can

Minimize hazardous situations resulting from unexpected position changes of other road users.

For the trajectory control is the knowledge of the current position of the

Vehicle required. In the emergency mode of operation, the position of the vehicle is preferably determined by dead reckoning, i. H. without consideration of

Ambient sensors and thus without taking into account changes in the

Environmental situation, determined using dead reckoning based on

Sensor signals of an inertial sensor and wheel speed sensor is performed. This sensor is in vehicles that are equipped with a vehicle dynamics control, usually "Fail Operational" executed, ie the sensor signals of this sensor are also available in case of error, so that a position determination of the vehicle is possible even in case of failure.

If environment information, in particular optically recorded environment information, is available in the emergency operating mode, a correction of the sensor signals of the inertial sensor system and wheel speed sensor system based on this environment information is advantageously undertaken. As a result, any signal drifts or calibration errors of the sensor signals can be compensated.

In an advantageous embodiment, upon activation of the emergency operating mode, an audible and / or visual and / or haptic warning message is generated. Such a warning message is expediently in particular as a

Takeover request to the driver trained so that it is informed and warned and can take control of the vehicle within the specified period of time. In addition, such a warning message, for example, be designed as a warning to an external environment of the vehicle.

The vehicle pick-up by the driver is determined, for example, by a haptic and / or acoustic input of the driver,

for example, by a switch operation or by a, in particular significant, driving intervention by the driver, for example by a

Steering wheel operation and / or a pedal operation, for example, an accelerator pedal, brake pedal and / or clutch pedal operation.

A device according to the invention for carrying out the method comprises a driving operation control unit which is set up to perform the automated driving operation and the emergency taxi trajectory during the normal function of the vehicle

automated driving operation continuously to determine and store, and a Trajektorienregelungseinheit, which is set up to carry out the to be carried out in emergency mode automatic trajectory control of the vehicle.

The trajectory control unit is advantageously part of a control unit of the vehicle provided outside the driving control unit. This control unit, which is provided outside the driving control unit, may be, for example, a brake control unit which is usually present in the vehicle and adapted to carry out a vehicle dynamics control, so that this solution does not involve an additional cost, assembly and integration effort, or a higher space requirement or weight of the vehicle connected is. The integration of the Trajektorienregelungseinheit in the brake control unit is also advantageous because the brake control unit and the inertia sensors and wheel speed required by the brake control unit to perform its tasks and the required for performing braking actions actuators are anyway designed such that they have a very high reliability. For one

Safeguarding the functionality of the emergency operating mode, it is therefore sufficient if the Trajektorienregelungseinheit and the actuated thereof actuators are redundant. On a redundant design of the environmental sensor and the driving control unit can thus be dispensed with.

Conceivable, however, are solutions in which it is outside the

Driving control unit provided by a control unit

Navigation control device for locating the vehicle or another

Act controller with sufficient computing power.

Furthermore, an integration of the trajectory control unit in the

Driving control unit conceivable. The trajectory control unit is provided redundantly in such a case in the driving control unit and / or is fed from a redundant running electrical system, so that a high

Resilience of the trajectory control unit is achieved. If the at least one error event occurs, the driving control unit will no longer be able to perform complex tasks such as the normal function of the automated

Driving due to the high reliability of the

However, the trajectory control unit will still be able to do it in the

Emergency Mode to perform simpler tasks such as trajectory control. Thus, the driving control unit, the vehicle even in an error case in which it is not fully functional, lead to a safe state.

Embodiments of the invention are explained in more detail below with reference to drawings. Showing:

1 schematically shows a sequence of a method for operating a vehicle in an automated driving operation,

2 is a schematic of a determined emergency rolling trajectory,

Fig. 3 shows schematically a speed desired profile along the determined

 Notfallsolltrajektorie,

4 schematically shows the vehicle during the execution of the emergency rolling trajectory,

Fig. 5 schematically simplifies a device for carrying out the

 Procedure, and

Fig. 6 shows schematically an interaction of components of the device for

 Implementation of the procedure.

Corresponding parts are provided in all figures with the same reference numerals.

In the following, a method for operating a vehicle 1 in an automated driving operation, in particular in one, will be described with reference to FIGS. 1 to 6

highly automated or autonomous driving, as well as a device 2 for carrying out this method explained in more detail. The vehicle 1 with this

Device 2 for carrying out the method is shown in FIG. 5, for reasons of clarity, greatly simplified.

In such a highly automated or autonomous driving operation done

preferably both a control and / or regulation of a longitudinal movement of the vehicle 1 as well as a control and / or regulation of a transverse movement of the vehicle 1 fully automatically, ie without intervention of a driver. For this purpose, in a normal function NF of the automated driving operation in particular an environment sensor system of the vehicle 1 not shown here required to detect an external environment of the vehicle 1, in particular a roadway FB with their lanes FS and other road users VT. The ambient sensor For example, at least one camera includes, for example, as

Monocamera or stereo camera is formed, and / or at least one

Radar sensor and / or at least one Lidarsensor and / or at least one ultrasonic sensor and / or at least one infrared sensor and / or at least one unit for determining position by means of a satellite-based global

Positioning system, such as GPS. Preferably, the environmental sensor system comprises a combination of all or at least several of the aforementioned units.

An evaluation of detected by means of the environmental sensor sensor results is advantageously carried out in a for the implementation of the automated

Driving operation responsible driving control unit 3, which controls the longitudinal and transverse movement LQ of the vehicle 1 other components of the vehicle 1 and / or regulates, in particular a steering device 4, a brake device 5 and a drive train of the vehicle. 1 This control and / or regulation of the other components takes place either directly or through a communication with control and / or regulating units of these other components, which then perform a corresponding control and / or regulation of the respective component.

In such an automated driving operation, in particular during

highly automated or autonomous driving, it is necessary to take measures that bring the vehicle 1 in a safe condition upon the occurrence of a fault event FE. Such an error event FE is, for example, a failure of the environmental sensor system required for automated driving and / or a failure of the driving control unit 3 required for automated driving, which is expediently designed as a control unit of the vehicle 1 provided for this purpose, and / or a failure of at least one vehicle electrical system of the vehicle 1 and / or a failure of a communication between the

 Driving operation control unit 3 and the environmental sensor system and / or between the driving operation control unit 3 and other components of the vehicle 1, for example, other control and / or regulating units and / or actuators.

By means of the method for operating the vehicle 1 in automated driving mode, in particular in highly automated or autonomous driving mode, this is realized. The sequence of the method is shown schematically in FIG. In this procedure During a normal function NF of the automated driving operation continuously, for example in each computing cycle, an emergency taxi trajectory NT is determined and stored, which the vehicle 1 upon entry of at least one predetermined error event FE for a predetermined period of time t and / or up to a

Standstill S of the vehicle 1 automatically drive on, the vehicle should also be delayed at the same time. Expediently, in addition, respective orientation data of the vehicle 1 with respect to the emergency target trajectory NT are determined and stored, ie. H. in particular a position and orientation, and expediently also a speed v of the vehicle 1, so that these values at the beginning of an emergency operating mode NM and thus at the beginning of the shutdown of

Emergency rolling trajectory NT are available.

Upon successful detection of the occurrence of at least one predetermined

Error event FE, the emergency mode NM is activated, in which an automated, i. Driver independent trajectory control of the vehicle 1 is performed by means of a Trajektorienregelungseinheit. The trajectory control is carried out by a control and / or regulation of the longitudinal and

Transverse movement LQ of the vehicle 1, in particular by a control and / or regulation of the steering device 4 and a control and / or regulation of

Braking device 5, whereby the vehicle 1 along the last determined before the occurrence of at least one predetermined error event FE

Emergency trajectory NT is automatically moved and thereby delayed. The trajectory control is performed for the predetermined time period t and / or until the standstill S of the vehicle 1. The trajectory control is performed if and as long as no vehicle management takeover FF is performed by the vehicle driver, who then moves and controls the vehicle 1 in a vehicle driver's operation FFB, that is, if the driver 1 fails. H. operated manually, in particular the steering device 4, the

Braking device 5 and / or the drive train of the vehicle 1 controlled by its own operation.

The predetermined time t is expediently a driver acceptance time. The predetermined period of time t is expediently set so long that the vehicle driver has sufficient time to react and to be able to take control of the vehicle 1. If he does not do so, it is his responsibility. Preferably, however, the vehicle 1, if no vehicle guide takeover FF is performed by the driver, also after Expiration of the predetermined time period t and thus expediently until standstill S automatically by the trajectory control according to the last determined before the occurrence of at least one predetermined error event FE emergency taxi trajectory NT moves. In this way, an uncontrolled move of the

Vehicle 1 and thus a hazard to vehicle occupants and others

Road users VT at the end of the predetermined period t avoided or at least significantly reduced if no

 Vehicle guide FF takes place by the driver, and it is also ensured in this case that the vehicle 1 is brought to a safe stop S. Since this area of the emergency target trajectory NT, which is traveled after expiration of the predetermined time t, was in the determination of the emergency taxi trajectory NT at a further distance from the vehicle 1 as initial areas of the emergency taxi trajectory NT, and since the vehicle 1 on reaching this last range of

Emergency taxi trajectory NT already over a longer distance in the

Emergency mode NM has moved, an accuracy of the trajectory control after the expiration of the predetermined period t decrease. Nevertheless, the accuracy should nevertheless be sufficient to bring the vehicle 1 to a standstill S with a low risk in the rare cases of an unsuccessful vehicle guidance takeover after the expiry of the predetermined period of time.

The predetermined period of time t is expediently shorter than one

System transfer time during the normal function NF of the automated driving operation. During this normal function NF, it may, for example, due to specific traffic situations, which require the control of the driver,

For example, a driving on a construction site area, to a

Takeover request to the driver. However, since in these situations there is no error event FE and thus the normal function NF of the method and the device 2, such a takeover request has a lower one

Urgency, so that a longer system transfer time is possible. in the

Emergency mode NM is in contrast to a fault event FE before, so that the functionality of one or more components of the device 2, for example, the Umfassungsfassungssensor and / or the

Driving operation control unit 3, is no longer given and thus, to the

To maximize traffic safety, an urgent takeover of control of the vehicle 1 by the driver is required. The vehicle guide transfer FF by the vehicle driver is determined, for example, by a haptic and / or acoustic input of the vehicle driver, for example by a switch operation or by a, in particular significant, driving intervention by the driver, for example by a

Steering wheel operation and / or a pedal operation, for example, an accelerator pedal, brake pedal and / or clutch pedal operation.

Appropriately, in the emergency mode NM a current position of the vehicle 1 is determined by dead reckoning KN, d. H. without consideration and use of environmental sensors and thus without taking into account changes in the environmental situation. As a result, the execution of the emergency operating mode NM is ensured even when one of the abovementioned fault events FE occurs, in particular in the event of a failure of the environmental sensor system or the driving control unit 3, and the vehicle 1 is thus guided safely along the emergency rolling trajectory NT in this emergency operating mode NM, even if the Ambient sensor fails or due to a failure of the driving control unit 3 can not be evaluated.

The dead reckoning KN is made possible by a synthesis of odometry and state information of the vehicle 1 provided by an inertial sensor system, i. H. For the dead reckoning KN, only the inertial sensor system of the vehicle 1, in particular a yaw rate and acceleration sensor system required by the brake system of the vehicle 1 for carrying out a vehicle dynamics control, as well as a wheel speed sensor system are used, whereby a high degree of robustness and also a

Cost savings compared to a redundant running environment sensors is achieved. From wheel speeds determined by means of the wheel speed sensor, it is possible to determine, for example as odometric variables, a speed v of the vehicle 1 and its course as well as a traveled distance. The inertial sensor system preferably comprises acceleration sensors for an x-direction and / or for a y-direction and / or for a z-direction of a vehicle coordinate system and / or yaw rate sensors for rotations of the vehicle 1 about the x-axis x and / or around the y axis. Axis y and / or about the z-axis of the vehicle coordinate system, ie for detecting a roll and / or pitch and / or yaw movement of the vehicle 1. In this case, the x-axis x corresponds to a longitudinal axis of the vehicle 1, the y-axis y corresponds to a transverse axis of the vehicle 1 and the z-axis corresponds to a vertical axis of the vehicle 1. Such a vehicle coordinate system is shown in Figure 2, here however, only in two-dimensional form, so that only the x-axis x and the y-axis y are shown.

As already stated, the trajectory control to be performed in the emergency operating mode NM is carried out by means of the trajectory control unit.

In the present embodiment, the trajectory control is in

Emergency mode NM not by means of the driving control unit. 3

carried out, but by means of a control unit 6, which is not responsible for the implementation of the automated driving operation. That is, the

Trajektorienregelungseinheit is not integrated into the driving operation control unit 3, but in the control unit 6.

In the illustrated preferred embodiment, this is

Control unit 6 to a brake control unit of the vehicle 1, which is set up for the implementation of a vehicle dynamics control. Preferably, the respectively determined emergency target trajectory NT is also stored in this control unit 6. Alternatively, for example, it may also be stored in another control unit of the vehicle 1, which is not responsible for carrying out the automated driving operation. In this way, it is ensured that even if the error event FE the failure of the driving control unit 3 or the

Interruption of the communication of the driving operation control unit 3 to other components of the vehicle 1, the last before the occurrence of this error event FE emergency taxi trajectory NT for carrying out the

Emergency mode NM is available and can be driven automatically by the vehicle 1.

This control unit 6, in the present example the brake control unit of the vehicle 1, is designed to be "fail operational", ie it continues to operate in the event of an error and thus remains operational even in the event of a fault It is advantageously already present in the vehicle 1 anyway, so that there is no additional cost, assembly and integration outlay, no higher costs

Space requirements and no greater weight of the vehicle 1 result. The integration of the trajectory control in the control unit 6 and the storage of the respective Notallsolltrajektorie NT in the control unit 6 is advantageous because in addition to this In the vehicle 1 already existing control unit 6 no further control unit for the emergency mode of operation NM of the inventive method is required. In order to ensure the functionality of the emergency operating mode NM, it is sufficient if the trajectory control unit and the sensors which are required for the trajectory control, ie for the control and / or regulation of the longitudinal and transverse movement LQ of the vehicle 1, in particular for the control and / or or regulation of the steering device 4 and the brake device 5, are redundant. The redundant design of the environmental sensor system and the driving operation control unit 3 can thus be dispensed with.

Advantageously, the emergency target trajectory NT is a position target curve PV, which is shown by way of example in FIG. 2, and a target speed profile GP along the target position profile PV, which is shown by way of example in FIG

Speed v - stopping distance s - diagram is shown, determined and stored. In this way, the emergency target trajectory NT determines both position points P, which the vehicle 1 should reach on its onward travel, and times at which the vehicle 1 should reach the respective position points P. That is, the emergency target trajectory NT determines both a local course of a path on which the vehicle 1 is to move and the target velocity profile GP to be reached on this wheel.

The position target PV is calculated taking into account

Environmental information that is determined with the environmental sensors during the normal function of the automated driving determined. In particular, the position target profile PV is determined such that the vehicle 1 remains in its lane and / or drives past obstacles. The position desired course PV may in particular be defined as a sequence of position points, which are for example spaced approximately five meters apart. A known output lateral deviation Δy and a known output orientation ΔΨ of the vehicle 1 relative to the starting point of the emergency target trajectory NT are implicitly contained therein. The position points, for example, as points in a related to the vehicle 1

Location coordinate system defined.

The speed setpoint GP is a default to the respective

Position points of the position target course PV to be achieved speed. The speed profile GP specifies a target deceleration as a deceleration, with which the vehicle 1 is to be braked in emergency mode. The

Target deceleration is, for example, depending on a respective situation of the vehicle 1, between 3 m / s ² and 6 m / s ² . For example, the

Target deceleration 3 m / s ² at a speed v of the vehicle 1 of, for example, more than 20 m / s. For example, at a speed v of the vehicle 1 of, for example, less than 20 m / s to greater than 5 m / s, the target deceleration is increased linearly from 3 m / s ² to 5 m / s ² . At a speed v of the vehicle 1 of, for example, less than or equal to 5 m / s, the target deceleration is

for example, 5 m / s ² . The target deceleration may, for example, also be higher, for example, the vehicle 1 may be decelerated to the respective traction limit, ie, for example, a full braking is performed, wherein the then achievable maximum deceleration is regulated, for example, by an antilock system of the vehicle 1. The target deceleration results in a stopping distance s of, for example, a maximum of 140 m, depending on an initial speed of the vehicle 1 and the permissible target deceleration.

In addition, longitudinal errors LF and transverse errors QF of the position command curve PV are entered in the region of the position points P of the position command curve PV. H. Deviations of the actual position of the vehicle 1 from the position points P of the position command curve PV, which may result in the emergency operating mode NM. The longitudinal errors LF and transverse errors LQ result, for example, from inaccuracies of an initial position and position determination of the vehicle 1, which is determined by the

Driving operation control unit 3 was made before the activation of the normal operation mode NM. These inaccuracies can result, for example, from an initial unknown yaw deviation, from an initially unknown longitudinal error LF and / or from an initially unknown transverse deviation. Position errors caused by dead reckoning KN or by disturbance and control variables during the emergency mode NM are not included in the longitudinal error LF and lateral error QF.

The transverse errors QF of the position setpoint course PF, possible transverse errors of the

Dead reckoning KN and possible transverse errors due to interference effects on the trajectory control lead to a transverse deviation of the vehicle 1 from a predetermined lateral desired position within the vehicle 1 traveled by the vehicle

Lane FS, in particular from the middle of the lane FS. Preferably, the trajectory control is performed such that the transverse deviation of the vehicle 1 does not exceed a maximum permissible transverse deviation from the predetermined lateral nominal position. With a lane width of, for example, 3.50 m and a vehicle width of, for example, 1.90 m, the lane FS is 1.60 m wider than the vehicle 1. The maximum permissible transverse deviation is then, for example, half of it, ie0.80 m.

FIG. 4 shows a carriageway FB with two lanes FS and a stationary lane SS, with the vehicle 1 driving the right lane FS along the emergency taxi trajectory NT in the emergency operating mode NM. At the beginning of the emergency taxi trajectory NT, the vehicle 1 has a respective initial speed, which is reduced to zero by the deceleration of the vehicle 1 along the emergency taxi trajectory NT. That is, the vehicle 1 is decelerated to standstill S during the emergency operating mode NM when no driver taking FF occurs. On the right lane FS and on the left lane FS in front of the vehicle 1, other road users VT move, which should not be endangered during the emergency mode NM of the vehicle 1. Shown is both the

Emergency case trajectory NT as well as the emergency trajectory NT comprehensive trajector TT. The trajectory hopper TT schematically represents the transverse deviation of the vehicle resulting from transverse errors from the emergency trajectory NT at the respective trajectory point. It indicates a lateral area in which the vehicle 1 will be located with high probability when the emergency taxi trajectory NT is traversed. From the illustration it is clear that the vehicle 1 will not leave its lane FS with high probability during the emergency operating mode NM, so that the other road users VT are not endangered. For this purpose, the unilateral width of the Trajektorietrichters TT, as already explained above, at least until the end of the predetermined period of time t, d. H. until the expiration of the driver acceptance time, preferably until standstill S of the vehicle 1 below the predetermined maximum allowable lateral deviation of, for example, 0.80 m, so that the vehicle 1 does not leave its lane FS.

By specifying the position command curve PV and the speed command curve GV, a safe and precise guidance of the vehicle 1 and a safe braking of the vehicle 1 are achieved in the emergency operating mode NM.

The method can be improved if environmental information, in particular optically recorded environment information, also during the emergency mode of operation NM are available. Then, during the emergency mode of operation NM, this information is advantageously used to detect changes in the emergency mode

Detect vehicle environment and to adjust the emergency target trajectory NT to changing environmental conditions. This makes it possible, for example, to modify the position desired course PV such that the vehicle 1 evades a suddenly occurring obstacle or modifies the speed command curve GV in such a way that it brakes so sharply on an abruptly emerging obstacle that a collision is avoided.

A further improvement is obtained when sensor data of the inertial sensors and wheel speed sensors are corrected. The inertial sensors and wheel speed sensors are usually associated with offset / drift and scale factor errors. During the highly automated driving operation, an error correction of the sensor signals of the inertial sensor system and wheel speed sensor system is undertaken, in which such errors are detected and corrected on the basis of environmental information. To determine the

Driving control unit 3 error correction values and transmits them to the control unit 6. The error correction values are stored in the control unit 6 and used there to correct the sensor signals of inertial sensors and wheel speed sensor. The environmental information used for this correction may be, in particular, optically captured environmental information, such as, e.g. Track history information captured by a camera system, but also localization information captured using, for example, a global navigation satellite system (GPS / GNSS). If those

Environmental information even after the entry of at least one

Error event, i. are available during the emergency mode of operation, then the error correction values stored in the control unit 6 are recommended based on the available during the emergency mode of operation

 To correct environmental information. This makes it possible to correct the sensor signals of the inertial sensor system and wheel speed sensor even during the emergency mode of operation.

In an advantageous embodiment, upon activation of the

Emergency mode NM generates an audible, and / or visual and / or haptic warning message. Such a warning message is expediently

in particular as a takeover request to the vehicle driver so that he is informed and warned and the control of the vehicle 1 t can take over within the specified time period. In addition, such a warning message, for example, as an alert to an external environment of the vehicle 1 may be formed.

Preferably, the entry of the at least one predetermined

Error event FE only after expiration of a predetermined error tolerance time in which the error event FE was present uninterrupted, detected. In this way, an unnecessary termination of the normal function NF of the automated driving operation and thus an unnecessary change in the emergency mode NM in a short-term, for example, in the millisecond range, present error event FE is avoided. Is the error event FE over the entire fault tolerance time of, for example, about 200 ms to 500 ms continuously before and even after the expiry of the

Error tolerance time, the error event FE is detected and thus the

Emergency mode NM activated. As an emergency reference trajectory NT, the emergency approach trajectory NT determined and stored before the occurrence of the at least one predetermined error event FE and thus before the beginning of the error tolerance time is then used. In this way, it is ensured that emergency target trajectories NT, which were determined and stored within the fault tolerance time, when the fault event FE already existed, and which could therefore be faulty for the

Emergency mode NM should not be used. This allows safe guidance of the vehicle 1 in the emergency mode NM.

For example, ten to twenty-five consecutively determined emergency target trajectories NT are stored, in which case, when the maximum number of storable emergency target trajectories NT has been reached, the oldest stored emergency target trajectory NT is determined by the most recent one

Emergency taxi trajectory NT is overwritten. The number of in memory too

saving emergency taxi trajectories NT is expediently specified such that after the fault tolerance time has expired, at least one emergency taxi trajectory NT is available in the memory, which was determined and stored before the occurrence of the fault event FE and thus outside the fault tolerance time. Ie. the specification of the number of emergency case trajectories NT to be stored depends on the

given fault tolerance time and the determination cycle of

Emergency emergency trajectories NT. Within the fault tolerance time, the change in position of the vehicle 1 is expediently determined only by means of dead reckoning KN. After the occurrence of the error event FE has been detected, to determine the positions of the vehicle 1, only the dead reckoning KN during the fault tolerance time is taken into account and the emergency target trajectory, which is calculated before the occurrence of the fault event

Error event FE and thus outside the fault tolerance time was determined and stored in order to rule out a faulty position determination, for example by means of the already during the fault tolerance time may not be working correctly Umfeldfassungssensorik.

The emergency operating mode NM is activated, for example, in the event of a failure of a primary vehicle electrical system of the vehicle 1. In case of such a failure of the primary

Vehicle electrical system of the vehicle 1, the steering device 4 of the vehicle 1 may be degraded, so that it has, for example, only a power of 50% and could fail completely in another error. The device 2 for carrying out the method is expediently designed such that degraded actuators in the highly automated operation of the vehicle 1 after the fault entry at least for the predetermined time t ensure a minimum delay and minimum steering capability, and as a result a minimum stabilization of the vehicle 1. The trajectory control unit provided in the emergency operating mode NM for carrying out the trajectory control and the actuators required for trajectory control are supplied with electrical energy by a secondary electrical system.

The emergency operating mode NM is further activated, for example, in the event of a failure of the environmental sensor system required for automated driving and / or a failure of the procedure required for automated driving

Driving operation control unit 3 and / or in case of failure of the communication between the driving operation control unit 3 and the environmental sensor system and / or between the driving operation control unit 3 and other components of

Vehicle, for example, other control and / or regulating units and / or actuators. In this case, the brake device 5 and the

Steering device 4 of the vehicle 1, for example, continue its full function. The requirements for the braking and steering system of the vehicle 1 then correspond for example to those of a conventional braking and steering system. Errors which do not lead to the activation of the emergency operating mode NM, ie in which the normal function NF is maintained, are, for example, faults outside the driving control unit 3, outside the actuators and outside the vehicle electrical system, for example failures of parts of the environmental sensor system. For this purpose, the requirements for the braking and steering system of the vehicle 1, for example, those of a conventional braking and steering system. Furthermore, the emergency operating mode NM is not activated, for example, in the case of faults in the brake device 5 and / or steering device 4 with resulting degraded brake and / or steering and / or in the event of a failure of the secondary Bornetzes resulting in degraded brake and steering. The device 2 for carrying out the method is expediently designed such that degraded actuators in the highly automated operation of the vehicle 1 ensure at least for the system transfer time a minimum delay and minimum steering ability after the fault entry and, as a result, a minimum stabilization of the vehicle 1. During the normal function NF, the driving state is preferably additionally determined based on the inertial sensor and the wheel speeds, during the emergency mode NM preferably exclusively. Both during the normal function NF and in the emergency mode NB, an autonomous braking function must be functional for which it is designed for "fail operational." In addition, the driver must always be able to brake and steer the vehicle 1 and such vehicle operator interventions must be recognized

Normal function NF need such driver interventions to the

Driving operation control unit 3 are reported.

The apparatus 2 shown in FIG. 5, which is designed and arranged for carrying out the method, has, as already described, the

Driving operation control unit 3, the control unit 6 designed as a brake control unit with the trajectory control unit integrated therein for carrying out the

Trajektorienregelung during the emergency mode of operation NB, the steering device 4 and the braking device 5 on. Furthermore, the device 2 expediently has at least one device 7 for outputting and / or passing on the at least one warning message. This at least one device 7 is, for example, as a man-machine interface, as a brake light of the vehicle 1, as a

Hazard warning system of the vehicle 1 and / or as a

Vehicle-to-vehicle communication interface is formed. The at least one warning message is, for example, at a start, during execution and / or generated at a deactivation of the emergency mode NM and / or at standstill S of the vehicle 1. Preferably, customized warning messages are generated for each of these events. The generation of the at least one warning message or the respective warning message, for example, by the control and / or regulating unit 6, which performs the emergency mode NM. The output then takes place via the at least one device 7 or various such

Facilities 7 of the vehicle 1.

Furthermore, the device 2 comprises the sensors 8 required for the dead reckoning KN, in particular the inertial sensors and wheel speed sensors, which are also required for the vehicle dynamics control of the vehicle 1, as well as a

Vehicle driver intervention sensor system 9. The sensor 8 transmits wheel speeds, accelerations in the x direction, y direction and z direction as well as rotation rates about the three axes of the vehicle coordinate system as sensor data to the control unit 6. From the driving control unit 3 are during the

Normal function NF the respectively determined emergency rolling trajectory NT, d. H. of the

Position setpoint course PV and the speed setpoint profile GP and correction values for the inertial sensor system are transmitted to the control unit 6. Further, the travel operation control unit 3 sets the emergency operation mode NM

Activation signal activated or the control unit 6 activates the

Emergency mode of operation by detecting a failure to detect the

Notfallsolltrajektorie. The architecture of the device 2 is designed so that the Noltfallbetriebmodus is not activated in a momentary error in the control unit 6. From the vehicle driver intervention sensor system 9 vehicle operator interventions, such as a steering operation and / or brake operation and / or a

Pressing the accelerator pedal transmitted. In the emergency operation mode NB, the control unit 6 transmits target values for the steering angle to the steering device 4 and set values for the deceleration to the brake device 5.

The executed in the present case as a brake control unit control unit 6 is coupled, for example, with the secondary electrical system of the vehicle 1. The brake control device is, for example, a so-called secondary brake system, which is provided in addition to a primary brake system as a redundant brake system. For communication of the control unit 6 with the

Steering device 4 is preferably an additional communication channel available which is independent of the communication between the driving control unit 3 and the actuators, in particular steering actuators. For this example, an already existing in the vehicle 1 CAN bus can be used. To increase safety, the emergency operation mode may additionally be performed in the primary brake system of the vehicle 1.

In summary, the method includes an activation, execution and operation monitoring management, the dead reckoning KN, d. H. the synthesis of odometry and inertial sensors for determining, more precisely for estimating, the actual position data and speed data in relation to the emergency target trajectory NT, the control and / or regulation of the longitudinal and lateral movement LQ of the vehicle 1, in particular the speed and tracking control to the emergency target trajectory NT , which also compensates for actuator blurring and external disturbances, vehicle driver takeover and transfer management by monitoring vehicle operator interventions during the emergency mode of operation NM

Steering interventions, the driver assumption FF is allowed and when an accelerator pedal operation, a brake intervention is withdrawn, as well as a hedge, for example by means of the fault tolerance time or by a redundant

Communication to keep erroneous activations of the emergency mode NM within tolerable limits, and further a completion management and a driver handover after completion of the intended duration of operation of the emergency mode NM.

In Figure 6, the interaction of components of the device 2 for performing the method is shown schematically. By means of sensor data of the sensor 8 for the dead reckoning KN, a driving state estimation FZS is performed. In addition, correction values for the inertial sensor system and wheel speed sensor system flow from a reference data memory RDG. In the reference data memory RDG, besides the correction values for the inertial sensor system and wheel speed sensor system, the stored emergency target trajectories NT as well as driving state values during the

Fault tolerance time saved. The driving state values include

Vehicle speeds and rotation rates in the three spatial directions as well as pitch and roll angle. The data of the reference data memory RDG are data of the driving operation control unit 3 and the driving state estimation FZS. From the driving state estimation FZS the Fahrzugstsndswerte the vehicle 1 are transmitted to the dead reckoning KN. From Referenzzdatengedächtnis RDG is the Emergency taxi trajectory NT and a start position, which the vehicle 1 will assume after the fault tolerance time on the emergency taxi trajectory NT and which is determined based on the driving state values, transmitted to the dead reckoning node KN. An operation control BS controls the start, the execution and the termination of the

Emergency mode NM, monitors its operation and generates the at least one warning message, for example, to start and to end the

Emergency mode NM. It receives an activation signal, for example from the driving control unit 3 or activated in case of failure of the

Driving control unit 3, outputs the warning message or warnings, receives driver's interventions, such as steering interventions, a

Brake pedal operation and / or accelerator pedal operation, and activated in

Emergency mode NM the dead reckoning CN and the control and / or regulation of the longitudinal and lateral movement LQ of the vehicle 1. Of the

Dead reckoning KN is a longitudinal and transverse deviation to

Emergency case trajectory NT to the control and / or regulation of the longitudinal and

Transverse movement LQ of the vehicle 1 transmitted, which dictates the steering angle of the steering device 4 and the delay of the braking device 5 resulting therefrom.

In the emergency mode of operation NM of the method is thus one of the

Driving operation control unit 3 previously determined emergency taxi trajectory NT preferably travels to standstill S, wherein the control unit 6, the brake device 5 and the steering device 4 are controlled directly via corresponding interfaces. With the parameters from inertial sensors and odometry, d. H. from the sensor system of the brake system, the relative position to the emergency taxi trajectory NT is determined during the emergency mode NM and the control and / or regulation of the longitudinal and transverse movement LQ of the vehicle 1, in particular a control and / or regulation of the steering device 4 and braking device 5 with the destination carried out not to leave the lane to a stop S. The driver can the

Emergency mode NM at any time by significant interventions, such as steer and / or brake, cancel and, for example, during the

Emergency mode NM corrective intervene, for example, by oversteer or overbraking. The activation, execution and deactivation and / or the

Driver assumption FF is communicated via corresponding interfaces, for example by generation and output of one or more warning messages, so that driver information and / or surroundings information can be provided. As already stated, the trajectory control is implemented in the present embodiment in the control unit 6, that is, the

Carrying out the trajectory control required trajectory control unit is part of the control unit 6, wherein the control unit 6 in turn as

Brake control unit is executed.

Although in an alternative embodiment, the brake control unit is part of the control unit 6, but the trajectory control is implemented in another unit of the vehicle 1, which still have sufficient computing capacity and reliability in the event of an error. By way of example, the trajectory control can be implemented in a localization control device which is provided for locating the vehicle 1 in a global coordinate system and which is still functional in the event of a failure of the primary on-board network.

In a further alternative embodiment, the brake control device is still part of the control unit 6, but the trajectory control is implemented in the driving control unit 3 responsible for the automated driving operation. In this case, the driving operation control unit 3 does not have to have a high degree of reliability with regard to its normal function, namely the execution of the automated driving operation, but it is sufficient if, in cases in which the automated driving operation can not be continued, with respect to a partial function, namely the execution the trajectory control, a high reliability.

To ensure this, the driving operation control unit 3 has a primary control subunit and secondary control subunit, wherein the primary control subunit is fed from the primary on-board electrical system and the secondary control unit is powered from the secondary on-board power supply, and both control subunits or at least the primary control subunit for the implementation of Automated driving is responsible and the secondary control unit is responsible for the implementation of the trajectory control and thus responsible for the implementation of the

Trajektorienregelung responsible trajectory control unit comprises. The two control subunits are advantageously independent of each other

Communication channels connected to the required to carry out the steering and braking operations actuators. If the primary electrical system fails, the primary control unit will not be more functional, so that the automated driving operation can not continue, but the secondary control unit will continue to be functional due to their supply from the secondary electrical system and thus be able to To perform trajectory control. The failure of the primary electrical system leads as the at least one predetermined error event FE to activate the emergency mode NM, with the activation of the emergency mode NM and the secondary

Control unit is activated. The driving control unit 3 is thus partially functional in case of failure of the primary electrical system and performs in such an error in emergency mode NM trajectory control by means of the secondary control subunit. It therefore recommends the one required for the trajectory control

To save emergency taxi trajectory NT in the operating during the emergency mode secondary secondary control unit.

It is also conceivable, however, a solution in which the primary rule subunit additionally for the implementation of trajectory control and for the storage of

Emergency trajectory is responsible. In this solution is the

Trajektorienregelungseinheit in the driving operation control unit 3 redundantly provided, namely once as part of the primary rule subunit and once as part of the secondary rule subunit. This solution is advantageous because the trajectory control can then also be performed in cases in which one of the two control subunits has failed or is not functional due to an interruption of the communication with other components of the vehicle 1. During the emergency mode NM, the task of trajectory control is transferred in such cases to the functional part of the control unit.

Claims

claims 1. A method for operating a vehicle (1) in an automated  Driving,  characterized,  that during a normal function (NF) of the automated driving operation, an emergency taxi trajectory (NT) is continuously determined and stored, which is to be based on the occurrence of at least one predetermined fault event (FE) of an automated trajectory control of the vehicle (1),  and that upon successful detection of the occurrence of the at least one predetermined fault event (FE), an emergency operating mode (NM) is activated in which the automated trajectory control of the vehicle (1) is initiated and according to the prior to the entry of the at least one  predetermined emergency event (NT) for a predetermined period of time (t) and / or to a standstill (S) of the vehicle (1) is performed, if none  Vehicle Guidance Transfer (FF) by a driver of the  Vehicle (1) takes place. 2. The method according to claim 1,  characterized in that To determine the emergency target trajectory (NT), a position desired course (PV) and a desired speed profile (GP) to be achieved along the position desired course (PV) are determined. 3. The method according to claim 2,  characterized in that  the position setpoint course (PV) and / or the speed setpoint profile (GP) in emergency mode of operation (NM) is adapted to changed ambient conditions. 4. The method according to any one of the preceding claims,  characterized in that  In the emergency operating mode (NM), a current position of the vehicle (1) is determined by dead reckoning (KN), wherein the dead reckoning (KN) is performed based on sensor signals of an inertial sensor and wheel speed sensor. 5. The method according to claim 4,  characterized in that  and that the sensor signals of the inertial sensor and wheel speed sensors are corrected in the emergency mode of operation (NM) based on detected environmental information. 6. The method according to any one of the preceding claims,  characterized in that  upon activation of the emergency mode of operation (NM) an audible, and / or visual, and / or haptic warning message is generated. 7. The method according to any one of the preceding claims,  characterized in that  the occurrence of the at least one predetermined error event (FE) after a predetermined error tolerance time, in which the error event (FE) was present uninterrupted, is detected. 8. Device (2) according to one of claims 1 to 7,  characterized in that they have a trajectory control unit for the implementation of the Emergency mode (NM) to be carried out automated trajectory control of the vehicle (1). 9. Apparatus according to claim 8,  characterized in that  it comprises a driving control unit (3) adapted to carry out the automated driving operation and to continuously determine and store the emergency taxi trajectory (NT) during the normal operation (NF) of the automated driving operation, and in that the trajectory control unit is part of an outside of the driving control unit (3 )  Control unit (6) 10. Apparatus according to claim 8,  characterized in that  it comprises a driving control unit (3) arranged to perform the automated driving operation and to continuously determine and store the emergency taxi trajectory (NT) during the normal operation (NF) of the automated driving operation and that the trajectory control unit is part of the driving control unit (3) and this is provided redundantly and / or fed from redundant on-board networks.