Emergency Maneuver Control System and Emergency Maneuver Control Method for a Vehicle

[0001] The invention relates to an emergency maneuver control system and emergency maneuver control method for a vehicle.

[0002] From the prior art, various driver assistance systems are known which can perform certain driving tasks or control the vehicle autonomously. In order to ensure the necessary high availability of the highly automated driving functions, various concepts are known which make fail safety possible by way of one or more redundancy levels.

[0003] In the present document, a driver assistance system is to be understood to mean a system which, by implementation in software and/or hardware, is designed to, in a manner dependent on data ascertained by way of one or more sensors, intervene in the guidance of the vehicle or even permanently or at least temporarily take over full control.

[0004] If, in the event of a fault, it is not possible to continue to execute the respective driver assistance function, an emergency maneuver is generally initiated which brings the vehicle into a safe state.

[0005] One known concept for an emergency braking maneuver provides for example that, in the event of an emergency maneuver situation, a defined emergency maneuver trajectory is implemented by way of a control unit for longitudinal guidance. However, in the execution of such an emergency maneuver in which only the longitudinal guidance is controlled, there is the risk that the vehicle leaves the traffic lane laterally, in particular if the vehicle is presently situated at the beginning or end of a cornering maneuver.

[0006] The invention is based on the object of making available an emergency maneuver control system and an emergency maneuver control method for a vehicle which at least partially overcome the disadvantages in the prior art.

[0007] The object is achieved by the claimed invention.

[0008] A first aspect of the invention relates to an emergency maneuver control system for a vehicle, wherein the vehicle is operable at least in a driver-controlled operating mode and in a highly automated or autonomous operating mode and has at least one longitudinal guidance actuator and at least one lateral guidance actuator. Here, the emergency maneuver control system has:

[0009] a path planning control device which is designed to, in the highly automated or autonomous operating mode of the vehicle, ascertain an emergency maneuver trajectory;

[0010] a longitudinal guidance actuator control device which is coupled to the path planning control device and which is designed to make available longitudinal guidance control commands derived from the emergency maneuver trajectory and, in the event of an emergency maneuver situation, cause the at least one longitudinal guidance actuator to execute the longitudinal guidance control commands; and

[0011] a lateral guidance actuator control device which is coupled to the path planning control device and which is designed to make available lateral guidance control commands derived from the emergency maneuver trajectory and, in the event of an emergency maneuver situation, cause the at least one lateral guidance actuator to execute the lateral guidance control commands.

[0012] A second aspect of the invention relates to an emergency maneuver control method for a vehicle, wherein the vehicle is operable at least in a driver-controlled operating mode and in a highly automated or autonomous operating mode and has at least one longitudinal guidance actuator and at least one lateral guidance actuator. Here, the emergency maneuver control method comprises:

[0013] ascertaining an emergency maneuver trajectory in the highly automated or autonomous operating mode of the vehicle;

[0014] deriving longitudinal guidance control commands and lateral guidance control commands from the ascertained emergency maneuver trajectory;

[0015] making available the longitudinal guidance control commands and lateral guidance control commands;

[0016] in the event of an emergency maneuver situation, outputting the longitudinal guidance control commands at least to the one longitudinal guidance actuator and outputting the lateral guidance control commands at least to the one lateral guidance actuator, and executing the longitudinal guidance control commands by way of at least the one longitudinal guidance actuator and executing the lateral guidance control commands by way of at least the one lateral guidance actuator.

[0017] In the context of the present document, a vehicle is to be understood to mean any type of vehicle by way of which persons and/or goods can be transported. Possible examples of these are: motor vehicles, heavy goods vehicles, land vehicles, buses, mobile cabins, cable car cabins, elevator cabins, rail vehicles, watercraft (for example ships, boats, submarines, diving bells, hovercrafts, hydrofoils), and aircraft (airplanes, helicopters, ground-effect vehicles, airships, balloons).

[0018] The vehicle is preferably a motor vehicle. In this context, a motor vehicle is a land vehicle which is moved by machine power without being bound to rails. In this context, a motor vehicle encompasses a motor car, a motorcycle and a truck tractor.

[0019] The vehicle, in particular the motor vehicle, is operable in a driver-controlled operating mode and in a highly automated or autonomous operating mode. In other words, a driver can themselves perform the driving task (driver-controlled operating mode), or the driving task is performed partially or entirely by a system (highly automated or autonomous operating mode), for example a driver assistance system.

[0020] If the highly automated or autonomous operating mode of the vehicle functions in a fault-free manner, this is controlled by way of a main channel. The main channel comprises a planning system, a sensor arrangement system and an execution system. In other words, the highly automated or autonomous driving functions are controlled and executed by way of the systems of the main channel.

[0021] If, for example, a system of the main channel fails or loses communication with another device, the highly automated or autonomous driving functions can be controlled and executed, in part to a limited degree, by way of one or more redundancy channels. Here, the one or more redundancy channels likewise comprise a planning system, a sensor arrangement system and an execution system.

[0022] A planning system of the main channel and/or of a redundancy channel may comprise the above-described path planning control device. An execution system of the main channel and/or of a redundancy channel may comprise the above-described longitudinal guidance actuator control device and/or the above-described lateral guidance actuator control device.

[0023] The expression “emergency maneuver” as used in the present document is not used to mean a maneuver such as is executed by emergency driver assistance functions, for example an emergency braking assistant or an emergency stop assistant. Such emergency driver assistance functions can be controlled and executed for example by the systems of the main channel and/or the systems of a redundancy channel. Such emergency driver assistance functions make use, in some cases, of a surroundings sensor arrangement that is present in the vehicle in order to initiate and/or carry out certain maneuvers (for example an emergency stop). In the context of the present document, an emergency maneuver thus differs significantly from an automated driving function.

[0024] In the present document, the expression “emergency maneuver” refers only to maneuvers that are necessitated by an emergency maneuver situation. An emergency maneuver situation is present for example if at least two of the following faults are present at the same time, such that both the main channel and one or more redundancy channels have failed:

[0025] failure of a planning system of the main channel;

[0026] failure of a planning system of a redundancy channel;

[0027] failure of a sensor arrangement system of the main channel;

[0028] failure of a sensor arrangement system of a redundancy channel;

[0029] failure of an execution system of the main channel;

[0030] failure of an execution system of a redundancy channel;

[0031] failure of the communication capability of a planning system of the main channel;

[0032] failure of the communication capability of a planning system of a redundancy channel;

[0033] failure of the communication capability of an execution system of the main channel;

[0034] failure of the communication capability of an execution system of a redundancy channel;

[0035] failure of the power supply of the vehicle; and

[0036] failure of a mechanical component of the vehicle.

[0037] In the context of the present document, the surroundings sensor arrangement is not used in the execution of an emergency maneuver. Specifically, depending on which faults trigger such an emergency maneuver, no sensor data whatsoever would be available, for example because the communication between sensors and control unit has broken down.

[0038] Thus, in the context of the present document, it is possible neither for the surroundings of the vehicle to be ascertained by a sensor, nor for a reaction to the surroundings to occur, in the execution of an emergency maneuver. Accordingly, during such an emergency maneuver, control commands are executed without use being made of a surroundings sensor arrangement in the process. A driver intervention is however possible at all times during the execution of an emergency maneuver.

[0039] An emergency maneuver is advantageously executed in order to bring the vehicle into a safe state. If, during highly automated or autonomous driving of the vehicle, at least two of the above-stated faults occur such that both the main channel and one or more redundancy channels fail, that is to say an emergency maneuver situation arises, then the time until the driver can themselves take over control of the vehicle is bridged by way of the emergency maneuver or the emergency maneuver trajectory. A typical takeover time of a driver is approximately 5 to 10 seconds. During this time, by way of the emergency maneuver control system and emergency maneuver control method described herein, the vehicle is brought into a safe state, proceeding from which the driver can safely take over the driving task.

[0040] The vehicle described herein is preferably a vehicle equipped with a system and/or with vehicle functions which make an automated driving mode possible. The expression “automated driving mode” is used to mean a partially automated driving mode, highly automated driving mode or fully automated or autonomous driving mode. Here, the automated driving modes correspond to the degrees of automation defined by the German Federal Highway Research Institute (BASt) (see the BASt publication “Forschung kompakt” [“Research compact”], edition 11/2012). In the case of partially automated driving (PAD), the system takes over the longitudinal guidance and lateral guidance for a certain time period and/or in specific situations, wherein the driver must permanently monitor the system. In the case of highly automated driving (HAD), the system takes over the longitudinal guidance and lateral guidance for a certain time period without the driver having to permanently monitor the system; the driver must however be capable of taking over the control of the vehicle within a certain time. In the case of fully automated driving (FAD), the system can, for a specific usage case, handle the driving task automatically in all situations; for this usage case, there is no longer a need for a driver. The above-stated degrees of automation according to the definition by the BASt correspond to the SAE levels 2 to 4 of the SAE J3016 standard (SAE—Society of Automotive Engineering). For example, highly automated driving (HAD) according to the BASt corresponds to level 3 of the SAE J3016 standard. Furthermore, in SAE J3016, the SAE level 5 is also provided as a highest degree of automation, which is not included in the definition by the BASt. The SAE level 5 corresponds to driverless driving, in the case of which the system can, during the entire journey, handle all situations automatically in the manner of a human driver; a driver is generally no longer necessary. In the present document, the degree of automation “fully automated” is intended to include the case of driverless driving.

[0041] The emergency maneuver control system may be arranged—at least partially—within or outside a vehicle. This thus means that there may also be embodiments of the emergency maneuver control system for a vehicle in the case of which parts of the emergency maneuver control system are arranged within the vehicle and/or parts of the emergency maneuver control system are arranged outside the vehicle. For example, the path planning control device and/or the longitudinal guidance actuator control device and/or the lateral guidance actuator control device may be arranged outside the vehicle, whereas the longitudinal guidance actuator and the lateral guidance actuator are arranged within the vehicle.

[0042] The path planning control device may be a vehicle-internal or vehicle-external device. The path planning control device is designed to plan the path that the vehicle is intended to travel along, from the start to the destination. Here, the area through which the path leads may be known or at least partially unknown. Furthermore, the path planning is advantageously performed such that no contact with obstructions occurs. The path planning control device may for example comprise a processing unit and optionally additionally a memory unit.

[0043] The path planning control device and/or the longitudinal guidance actuator control device and/or the lateral guidance actuator control device may be a device in a vehicle, for example an on-board computer, navigation unit, infotainment system etc. Alternatively, the path planning control device and/or the longitudinal guidance actuator control device and/or the lateral guidance actuator control device, or individual parts thereof, may be an external unit, for example a static unit (PC, cloud server) and/or a mobile terminal.

[0044] During the fault-free highly automated or autonomous operating mode of the vehicle, the path planning control unit ascertains an emergency maneuver trajectory. The expression “emergency maneuver trajectory” is used to mean a trajectory of an emergency maneuver. For example, an emergency braking maneuver trajectory may be an emergency maneuver trajectory. The emergency maneuver trajectory is thus ascertained continuously without an emergency maneuver situation being present. Only when an emergency maneuver situation ultimately arises is the emergency maneuver also executed. For this situation, however, an emergency maneuver trajectory is continuously ascertained in advance.

[0045] Longitudinal guidance control commands are derived from the emergency maneuver trajectory, and made available in the event that an emergency maneuver is to be carried out, by way of the longitudinal guidance actuator control device. In the event of an emergency maneuver situation, the longitudinal guidance actuator control device then causes the at least one longitudinal guidance actuator to execute the longitudinal guidance control commands.

[0046] The longitudinal guidance actuator is designed to receive and execute the longitudinal guidance control commands output by the longitudinal guidance actuator control device. In this way, the longitudinal guidance actuator is caused to execute the emergency maneuver trajectory. In other words, in the event of an emergency maneuver situation, the longitudinal guidance actuator executes the longitudinal-guidance-specific control commands in relation to the emergency maneuver trajectory.

[0047] Lateral guidance control commands are derived from the emergency maneuver trajectory, and made available in the event that an emergency maneuver is to be carried out, by way of the lateral guidance actuator control device. In the event of an emergency maneuver situation, the lateral guidance actuator control device then causes the at least one lateral guidance actuator to execute the lateral guidance control commands.

[0048] The lateral guidance actuator is designed to receive and execute the lateral guidance control commands output by the lateral guidance actuator control device. In this way, the lateral guidance actuator is caused to execute the emergency maneuver trajectory. In other words, in the event of an emergency maneuver situation, the lateral guidance actuator executes the lateral-guidance-specific control commands in relation to the emergency maneuver trajectory.

[0049] Both the longitudinal guidance actuator control device and the lateral guidance actuator control device are coupled to the path planning control device.

[0050] In the context of the present document, the coupling is used to mean a communicative connection. The communicative connection may be wireless (for example Bluetooth, WLAN, mobile radio) or wired (for example by way of a USB interface, data cable etc.).

[0051] In one embodiment, which may be combined with one or more of the embodiments described herein, the longitudinal guidance actuator control device is furthermore designed to, in the event of an emergency maneuver situation, cause the at least one longitudinal guidance actuator to execute the longitudinal guidance control commands independently of the lateral guidance control commands; the lateral guidance actuator control device is furthermore designed to, in the event of an emergency maneuver situation, cause the at least one lateral guidance actuator to execute the lateral guidance control commands independently of the longitudinal guidance control commands.

[0052] In other words, the longitudinal guidance actuator is caused to execute the longitudinal-guidance-specific control commands in relation to the emergency maneuver trajectory and, in so doing, give no consideration to the execution of the lateral-guidance-specific control commands in relation to the emergency maneuver trajectory by the lateral guidance actuator. Likewise, the lateral guidance actuator is caused to execute the lateral-guidance-specific control commands in relation to the emergency maneuver trajectory and, in so doing, give no consideration to the execution of the longitudinal-guidance-specific control commands in relation to the emergency maneuver trajectory by the longitudinal guidance actuator.

[0053] If the longitudinal guidance control commands are for example setpoint braking torques, then the longitudinal guidance actuator is caused to implement particular setpoint braking torques over a particular period of time, such as 15 seconds. Here, the longitudinal guidance actuator acts independently of the lateral guidance actuator. This thus means that the longitudinal guidance actuator, in executing a particular setpoint braking torque, does not wait for the parallel execution of a lateral-guidance-specific control command by the lateral guidance actuator. The execution of a particular longitudinal guidance control command is not dependent on the execution of a particular lateral guidance control command. Since the emergency maneuver trajectory comprises both longitudinal-guidance-specific and lateral-guidance-specific control commands, these control commands are processed by the respective control devices.

[0054] In one embodiment, which may be combined with one or more of the embodiments described herein, during the execution of the longitudinal guidance control commands and of the lateral guidance control commands, no communication occurs between the longitudinal guidance actuator control device and the lateral guidance actuator control device; alternatively or in addition, during the execution of the longitudinal guidance control commands and of the lateral guidance control commands, no communication occurs between the longitudinal guidance actuator and the lateral guidance actuator.

[0055] Communication between the longitudinal guidance actuator control device and the lateral guidance actuator control device, or communication between the longitudinal guidance actuator and the lateral guidance actuator, in order to realize mutual coordination of the longitudinal guidance control commands and lateral guidance control commands, is thus not necessary. In other words, the longitudinal guidance actuator control device and the lateral guidance actuator control device process the respective control commands in parallel.

[0056] In one embodiment, which may be combined with one or more of the embodiments described herein, the emergency maneuver trajectory is ascertained in a manner dependent on the respective present and/or future driving situation of the vehicle.

[0057] The present and/or future driving situation of the vehicle may be determined by operating parameters of the vehicle and/or by surroundings parameters of the vehicle. Operating parameters of the vehicle are for example the speed of the vehicle, the vehicle mass or the condition (fault-free/partially defective/fully defective) of vehicle components. Surroundings parameters of the vehicle are for example the condition of the roadway, the curvature of the roadway or the topography of the route to be driven.

[0058] The emergency maneuver trajectory is preferably ascertained continuously in a manner dependent on the respective present and/or future driving situation of the vehicle. In other words, the emergency maneuver trajectory is ascertained or updated at predetermined time intervals. These predetermined time intervals may be 1 ms to 30 s, preferably 1 to 100 ms, more preferably 1 to 60 ms.

[0059] In the fault-free highly automated or autonomous operating mode of the vehicle, the emergency maneuver trajectory is thus ascertained or updated continuously and then, in the event of an emergency maneuver, that is to say at the beginning of the emergency maneuver, the continuously updated longitudinal guidance control commands and lateral guidance control commands are used for causing the at least one longitudinal guidance actuator and the at least one lateral guidance actuator to execute the most recently updated longitudinal guidance control commands and lateral guidance control commands respectively.

[0060] In other words, longitudinal guidance control commands and lateral guidance control commands are constantly updated in the fault-free operating mode and, at the beginning of the emergency maneuver, said commands are frozen and subsequently executed. This thus means that, in the event of an emergency maneuver situation, the most recently updated emergency maneuver trajectory is traveled along in a manner controlled by the longitudinal guidance actuator control device and the longitudinal guidance actuator and by way of the lateral guidance actuator control device and the lateral guidance actuator.

[0061] By way of the controlled and coordinated emergency maneuver, the likelihood is increased that, in an emergency maneuver situation, for example in the event of a communication failure which results in both a failure of the main channel and a failure of one or more redundancy channels, the vehicle does not leave the traffic lane during the highly automated driving operation.

[0062] In one embodiment, which may be combined with one or more of the embodiments described herein, the present and/or future driving situation of the vehicle is defined by at least one longitudinal guidance parameter and/or at least one lateral guidance parameter.

[0063] Here, the at least one longitudinal guidance parameter is advantageously selected from the following:

[0064] present and/or future friction coefficient of the roadway;

[0065] present and/or future ascending gradient of the roadway;

[0066] present and/or future descending gradient of the roadway;

[0067] present vehicle mass;

[0068] present and/or future longitudinal speed of the vehicle; in particular, the present longitudinal speed is ascertained by way of a longitudinal sensor unit;

[0069] present and/or future change in longitudinal speed of the vehicle; in particular, the present change in longitudinal speed is ascertained by means of a longitudinal sensor unit.

[0070] The present and/or future longitudinal speed or change in longitudinal speed of the vehicle may be made available to the longitudinal guidance actuator control device by a vehicle component and/or a vehicle function, such as an autonomous cruise control function.

[0071] Alternatively, the present and/or future longitudinal speed or change in longitudinal speed of the vehicle is ascertained by way of a longitudinal sensor unit.

[0072] It is advantageously the case that the emergency maneuver control system has the longitudinal sensor unit. The longitudinal sensor unit is advantageously arranged on or integrated into the lateral guidance actuator control device. Alternatively, the longitudinal sensor unit is arranged on or integrated into the longitudinal guidance actuator control device. As a result of the integration of the longitudinal sensor unit either in the lateral guidance actuator control device or the longitudinal guidance actuator control device, the existing sensor arrangement can be utilized, and no additional components are required. The data of the longitudinal sensor unit can be made available on a bus system.

[0073] The longitudinal sensor unit may comprise a longitudinal acceleration sensor. Additionally, the longitudinal sensor unit may comprise a processing unit which is designed to store and/or process and/or output the ascertained sensor data.

[0074] Alternatively, the longitudinal sensor unit may be not arranged on the lateral guidance actuator control device or the longitudinal guidance actuator control device but coupled to the lateral guidance actuator control device or the longitudinal guidance actuator control device.

[0075] Alternatively or in addition, at least one of the lateral guidance parameters is selected from the following:

[0076] present and/or future curvature of a traffic lane of a driving route of the vehicle;

[0077] present and/or future change in a curvature of a traffic lane of a driving route of the vehicle;

[0078] present and/or future side forces acting on the vehicle; and

[0079] present and/or future lateral acceleration of the vehicle; the present lateral acceleration is ascertained in particular by way of a lateral sensor unit;

[0080] present and/or future change in lateral acceleration of the vehicle; the present change in lateral acceleration is ascertained in particular by way of a lateral sensor unit;

[0081] present and/or future steering angle of the vehicle;

[0082] present and/or future change in a steering angle of the vehicle.

[0083] The present and/or future lateral acceleration of the vehicle may be made available to the lateral guidance actuator control device by a vehicle component and/or a vehicle function, such as a lane keeping assistant function.

[0084] Alternatively, the present and/or future lateral acceleration of the vehicle is ascertained by way of a lateral sensor unit.

[0085] It is advantageously the case that the emergency maneuver control system has the lateral sensor unit. The lateral sensor unit is advantageously arranged on or integrated into the longitudinal guidance actuator control device. Alternatively, the lateral sensor unit is arranged on or integrated into the lateral guidance actuator control device. As a result of the integration of the lateral sensor unit either in the lateral guidance actuator control device or the longitudinal guidance actuator control device, the existing sensor arrangement can be utilized, and no additional components are required. The data of the lateral sensor unit can be made available on a bus system.

[0086] The lateral sensor unit may comprise a lateral acceleration sensor. Additionally, the lateral sensor unit may comprise a processing unit which is designed to store and/or process and/or output the ascertained sensor data.

[0087] Alternatively, the lateral sensor unit may be not arranged on the lateral guidance actuator control device or the longitudinal guidance actuator control device but coupled to the lateral guidance actuator control device or the longitudinal guidance actuator control device.

[0088] In one embodiment, which may be combined with one or more of the embodiments described herein, the longitudinal guidance control commands comprise at least one setpoint longitudinal guidance parameter, in particular as a function of a profile with respect to time; the lateral guidance control commands comprise at least one setpoint lateral guidance parameter, in particular as a function of a profile with respect to time. The at least one setpoint longitudinal guidance parameter preferably comprises at least one setpoint braking torque. The at least one setpoint lateral guidance parameter preferably comprises at least one setpoint steering angle.

[0089] In other words, particular setpoint longitudinal guidance parameters are executed at a particular point in time and may differ at the particular points in time. For example, a setpoint braking torque at a first point in time is lower than the setpoint braking torque at a later point in time.

[0090] For example, the longitudinal guidance control commands may be a series of setpoint longitudinal guidance parameters as a function of a profile with respect to time (for example a setpoint braking torque that changes over a particular period of time) and the lateral guidance control commands may be a single setpoint lateral guidance parameter (for example a setpoint steering angle). In other words, it is for example the case that a single value is provided for the setpoint lateral guidance parameter, which is then, in the event of an emergency maneuver situation, handed over to the at least one lateral guidance actuator for execution. For example, a particular setpoint steering angle is determined which is then executed by way of the lateral guidance actuator in the event of an emergency maneuver situation.

[0091] In one embodiment, which may be combined with one or more of the embodiments described herein, the path planning control device and/or the longitudinal guidance actuator control device are furthermore designed to ascertain an emergency maneuver target speed and/or a maximum emergency maneuver duration of the emergency maneuver trajectory. The longitudinal guidance actuator control device is furthermore designed to, in the event of an emergency maneuver situation, cause the at least one longitudinal guidance actuator to execute the longitudinal guidance control commands until such time as the present speed of the vehicle is lower than or equal to the emergency maneuver target speed or until such time as the duration of the emergency maneuver has reached the maximum emergency maneuver duration.

[0092] The path planning control device and the longitudinal guidance actuator control device may be formed as one control unit.

[0093] If the emergency maneuver target speed and/or the maximum emergency maneuver duration have been reached, the emergency maneuver is ended.

[0094] The longitudinal guidance actuator control device is advantageously furthermore designed to configure longitudinal guidance control commands derived from the emergency maneuver trajectory such that a predetermined braking pattern can be executed. A predetermined braking pattern means a specified sequence of particular braking torques or particular brake pressures. In particular, the predetermined braking pattern means a specified sequence of particular braking torques or particular brake pressures for a particular period of time.

[0095] In other words, the braking pattern is specified and is not varied, for example readjusted, during the execution of the longitudinal guidance control commands. This thus means that the braking pattern is independent of the present vehicle reaction (for example acceleration). In this way, feedback that could lead to an opposing action of the system counter to a possible driver intervention is avoided.

[0096] For example, the braking pattern may provide a constant brake pressure and/or a constant braking torque for a particular period of time.

[0097] Alternatively or in addition, the braking pattern may be selected so as to result in a so-called stutter effect. The stutter effect is achieved for example by virtue of particular braking moments or particular brake pressures being implemented repeatedly for a short period of time.

[0098] The longitudinal guidance actuator control device is advantageously furthermore designed to receive the predetermined braking pattern from a brake system of the vehicle. The predetermined braking pattern is advantageously ascertained in a manner dependent on the respective present and/or future driving situation of the vehicle.

[0099] The longitudinal guidance actuator control device then makes available the corresponding longitudinal guidance control commands in a manner dependent on the predetermined braking pattern. In other words, the longitudinal guidance control commands are both derived from the emergency maneuver trajectory and configured in a manner dependent on the predetermined braking pattern. The longitudinal guidance control commands can subsequently, in the event of an emergency maneuver situation, be transmitted to the at least one longitudinal guidance actuator for execution.

[0100] The emergency maneuver is ended when a predetermined emergency maneuver target speed is reached or undershot or when a maximum emergency maneuver duration is reached or overshot.

[0101] This has the advantage that a cancelling-out of a driver-induced acceleration by the braking operation is avoided, even if communication between the brake system and the other control units of the vehicle is not possible. In the event of a fault that leads to an emergency maneuver, it may for example be the case that the executing vehicle system cannot communicate, or can communicate only to a limited degree, with other systems, for example a sensor system, for example because the bus system of the vehicle has failed. During such an emergency maneuver, it would then not be possible to identify a takeover by a driver. If the driver takes over for example during an autonomous emergency braking operation carried out by the brake system of the vehicle, by virtue of said driver actuating the accelerator pedal on the basis of an acceleration demand, the driver action cannot be detected during the emergency maneuver owing to the fault. In this case, the brake system would continue to carry out the autonomous emergency braking operation, counter to the acceleration demand of the driver. If the vehicle is braked to a standstill counter to the demand of the driver, the following traffic may give rise to a hazardous situation. By contrast, if the emergency maneuver is limited by an emergency maneuver target speed or a maximum emergency maneuver duration being reached, the driver can take over control of the vehicle again already before the vehicle reaches an absolute standstill, whereby hazardous situations can be avoided.

[0102] In one embodiment, which may be combined with one or more of the embodiments described herein, the emergency maneuver target speed and/or the maximum emergency maneuver duration are ascertained in a manner dependent on the respective present and/or future driving situation of the vehicle.

[0103] In one embodiment, which may be combined with one or more of the embodiments described herein, the present and/or future driving situation of the vehicle is defined by at least one longitudinal guidance parameter and/or at least one lateral guidance parameter.

[0104] For the description of the present and/or future driving situation of the vehicle and of the at least one longitudinal guidance parameter and/or of the at least one transverse guidance parameter, reference is made to the statements further above.

[0105] The emergency maneuver target speed and/or the maximum emergency maneuver duration are preferably continuously ascertained in a manner dependent on the respective present and/or future driving situation of the vehicle. In other words, the emergency maneuver target speed and/or the maximum emergency maneuver duration are ascertained or updated at predetermined time intervals. These predetermined time intervals may be 1 ms to 30 s, preferably 1 to 100 ms, more preferably 1 to 60 ms.

[0106] In the fault-free highly automated or autonomous operating mode of the vehicle, the emergency maneuver target speed and/or the maximum emergency maneuver duration are thus ascertained or updated continuously and then, in the event of an emergency maneuver, that is to say at the beginning of the emergency maneuver, the most recently updated emergency maneuver target speed and/or the maximum emergency maneuver duration are used for causing the at least one longitudinal guidance actuator to execute the longitudinal guidance control commands.

[0107] In other words, the emergency maneuver target speed and/or the maximum emergency maneuver duration are constantly updated in the fault-free highly automated or autonomous operating mode of the vehicle and, at the beginning of the emergency maneuver, are frozen and subsequently correspondingly executed.

[0108] The emergency maneuver target speed and/or the maximum emergency maneuver duration are ascertained by the path planning control device. Here, the ascertainment of the emergency maneuver target speed and/or of the maximum emergency maneuver duration includes the possibility that the emergency maneuver target speed and/or the maximum emergency maneuver duration are calculated by another device, for example by the longitudinal guidance actuator control device, and transmitted to the path planning control device.

[0109] In one embodiment, which may be combined with one or more of the embodiments described herein, the emergency maneuver target speed and/or the maximum emergency maneuver duration are calculated by a brake system of the vehicle and transmitted to the path planning control device. Preferably, the emergency maneuver target speed and/or the maximum emergency maneuver duration are calculated and/or stored in the longitudinal guidance actuator control device and/or in the brake system of the vehicle at the beginning of the emergency maneuver. The maximum maneuver duration is stored in the brake system at the beginning of the emergency maneuver. Said maximum maneuver duration is preferably calculated at the beginning of the emergency maneuver.

[0110] In one advantageous example, the maximum emergency maneuver duration is calculated by virtue of the braking maneuver duration required to brake a vehicle to the emergency maneuver target speed with a given brake pressure or braking torque under standardized conditions being multiplied by a factor of between 1.0 and 3.0, preferably between 1.2 and 3.0. Standardized conditions are to be understood to mean standardized parameters, such as for example a flat roadway, medium loading of the vehicle, normal brake parameters etc.

[0111] In one embodiment, which may be combined with one or more of the embodiments described herein, the present speed of the vehicle is ascertained by way of a sensor system and transmitted to the longitudinal guidance actuator control device. The longitudinal guidance actuator control device is furthermore designed to, in the event that the present speed of the vehicle can be ascertained, in the event of an emergency maneuver situation, cause the at least one longitudinal guidance actuator to execute the longitudinal guidance control commands until such time as the present speed of the vehicle is lower than or equal to the emergency maneuver target speed; and in the event that the present speed of the vehicle cannot be ascertained, in the event of an emergency maneuver situation, cause the at least one longitudinal guidance actuator to execute the longitudinal guidance control commands until such time as the duration of the emergency maneuver reaches the maximum emergency maneuver duration.

[0112] The sensor system is advantageously the longitudinal sensor unit described further above. Alternatively, the sensor system may be a further device of the emergency maneuver control system or of the vehicle.

[0113] If an emergency maneuver is limited by an emergency maneuver target speed and/or a maximum emergency maneuver duration, the vehicle can be braked with sufficient accuracy. At the same time, it is however ensured that the driver can themselves intervene in the emergency maneuver, for example by way of the accelerator pedal. This is the case even if communication is no longer possible between brake system and accelerator pedal. In this way, a minimization of risk is made possible with regard to the conflicting aims of “general hazard reduction”, “controllability by the following traffic” and “controllability by the driver”.

[0114] As discussed above, the highly automated or autonomous operating mode of the vehicle is controlled by way of a main channel. The main channel comprises a planning system, a sensor arrangement system and an execution system. In the event of a failure of the main channel, the highly automated or autonomous operating mode of the vehicle is controlled by way of at least one redundancy channel which comprises a planning system, a sensor arrangement system and an execution system. In the event of a failure of the main channel, the one or the multiple redundancy channels are placed into a waiting condition for a predetermined waiting duration. During the predetermined waiting duration, a switch from the main channel to the one or the multiple redundancy channels is attempted. If the predetermined waiting duration has expired and a switch from the main channel to the one or the multiple redundancy channels has not occurred, the longitudinal guidance control commands are executed by way of at least the one longitudinal guidance actuator and the lateral guidance control commands are executed by way of at least the one lateral guidance actuator. A failure of the main channel is present for example if at least one system of the main channel (for example a planning system, a sensor arrangement system and/or an execution system) fails or the communication of said system of the main channel with another device fails.

[0115] The event of an emergency maneuver situation is present when both the main channel and one or more redundancy channels have failed.

[0116] It is advantageously the case that an emergency maneuver target speed and/or a maximum emergency maneuver duration of the emergency maneuver trajectory is ascertained at least in the highly automated or autonomous operating mode of the vehicle. If the predetermined waiting duration expires, and if a switch from the main channel to the one or the multiple redundancy channels has not occurred, the emergency maneuver is executed by virtue of the longitudinal guidance control commands being executed by way of the at least one longitudinal guidance actuator until such time as the duration of the emergency maneuver has reached the maximum emergency maneuver duration and/or until such time as the present speed of the vehicle is lower than or equal to the emergency maneuver target speed.

[0117] Problems arise if, after an initial fault in the main channel, the switch to a redundancy channel does not occur, for example owing to a consequential fault or a second fault in the switching logic or a failure of the redundancy channel that is to be activated. It is then not possible for the highly automated or autonomous operating mode to be continued. In this case, without steering and brake actuation, the vehicle would continue to roll with undiminished speed, without the driver even being able to take over the vehicle guidance. An accident in this situation would result in extremely severe consequences for the occupants and the surrounding traffic.

[0118] In other words, the channel switching (switching from main channel to redundancy channel) is configured such that, in the event of failure of the main channel, the failed main channel and/or the at least one redundancy channel that has not yet been activated assume a special state “await successful switch to the redundancy channel” and, in this state, await a successful channel switching operation.

[0119] If the switch to the at least one redundancy channel then does not occur within a predefined period of time (within the predetermined waiting duration), it is to be assumed that a severe fault is present. In this case, an emergency maneuver is then initiated which makes it easier for the driver to take over the guidance of the vehicle and minimizes the severity of damage in the event of an accident.

[0120] The emergency maneuver may however also be initiated in one redundancy channel or multiple redundancy channels and also outside the main channel. The emergency maneuver may comprise an activation of parking brake actuators and/or pre-crash measures (for example adaptation of the seat position, the window closing position, etc.) and/or a warning to the surrounding traffic, for example by way of hazard warning flashers.

[0121] As a result of the initiation of an emergency maneuver if a successful channel switching operation has not occurred after a predefined period of time, the uncontrolled vehicle state after an initial fault without successful switching to a redundancy channel can be avoided. Thus, the accident and injury risk for the vehicle occupants and the surrounding traffic is considerably reduced. As a result of a reduction in speed of the vehicle, there is the resulting advantage in this situation that a driver is given more time to orient themselves and take over the guidance of the vehicle.

[0122] The above statements relating to the emergency maneuver control system according to the invention for a vehicle according to the first aspect of the invention correspondingly also apply to the emergency maneuver control method for a vehicle according to the second aspect of the invention and vice versa; advantageous exemplary embodiments of the method according to the invention correspond to the described advantageous exemplary embodiments of the system according to the invention. Advantageous exemplary embodiments of the method according to the invention that are not explicitly described at this juncture correspond to the described advantageous exemplary embodiments of the system according to the invention.

[0123] Further advantages, features and details of the invention will emerge from the following description of a preferred exemplary embodiment and on the basis of the drawing. The features and feature combinations mentioned above in the description, and the features and feature combinations mentioned below in the description of the figures and/or shown only in the figures, may be used not only in the respectively specified combination but also in other combinations or individually without departing from the scope of the invention.

[0124] The invention will be described below on the basis of exemplary embodiments with the aid of the appended drawings.

[0129] FIG. 1 schematically shows an emergency maneuver control system 1 for a vehicle. The emergency maneuver control system 1 has a path planning control device 2, a longitudinal guidance actuator control device 3 and a lateral guidance actuator control device 4. The path planning control device 2 continuously calculates an emergency maneuver trajectory NT for the vehicle. Here, the emergency maneuver trajectory NT describes the trajectory of a particular emergency maneuver. Below, an emergency braking operation will be discussed as an example for an emergency maneuver. However, the emergency maneuver control system described in the present document, and the described emergency maneuver control method, are not intended to be restricted to an emergency braking operation. Setpoint braking torques 33 are derived by way of the longitudinal guidance actuator control device 3, and setpoint steering angles 44 are derived by way of the lateral guidance actuator control device 4, from the emergency braking operation trajectory NT. The emergency braking operation trajectory NT and the setpoint braking torques 33 and the setpoint steering angles 44 are in this case ascertained continuously during highly automated or autonomous driving of the vehicle. The derived control commands (setpoint braking torques 33 and setpoint steering angles 44) are made available by the control devices 3 and 4 for further processing.

[0130] In the event of an emergency maneuver situation, the longitudinal guidance actuator control device 3 causes a brake system 30 of the vehicle 10, and the lateral guidance actuator control device 4 causes a steering system 40 of the vehicle 10, to carry out the emergency braking operation. This situation is illustrated in FIG. 2. For this purpose, the longitudinal guidance actuator control device 3 causes the brake system 30 to implement the setpoint braking torques 33. The lateral guidance actuator control device 4 causes the steering system 40 to implement the setpoint steering angles 44.

[0131] FIG. 3 shows an example for an emergency maneuver control system 1 for a vehicle 10, in the case of which a longitudinal acceleration sensor 41 is arranged on the lateral guidance actuator control device 4. The present speed of the vehicle 10 is continuously ascertained by way of the longitudinal acceleration sensor 41. For the event of an emergency maneuver situation, the setpoint steering angles 44 can be adapted through the continuous ascertainment of the speed of the vehicle. For example, if an emergency braking operation is initiated at the beginning of a corner, then the speed of the vehicle 10 is reduced owing to the setpoint braking torques 33 that are implemented or to be implemented. A slower turn-in is required in the case of a decelerating vehicle than in the case of a non-decelerating vehicle. Therefore, in the case of the deceleration of the vehicle being realized by way of the brake system, a slower turn-in is simultaneously realized by way of the steering system. The setpoint steering angles 44 are thus adapted to the setpoint braking torques 33 in relation to the route, in this case a corner.

[0132] If an emergency maneuver situation were to arise as a result of a failure of the brake system 30 of the vehicle 10 in addition to a fault that has already occurred, it would not be possible for the setpoint braking torques 33 to be implemented by way of the brake system 30. This would have the result that the vehicle 10 continues to move with a virtually unchanged speed. If, in this case, the setpoint steering angles 44 were implemented as described above, the slower turn-in would lead to a departure from the lane in the direction of the outside of the corner. By way of the longitudinal acceleration sensor 41, however, it is possible to measure a lower deceleration of the vehicle 10 and adapt the setpoint steering angle 44 correspondingly. The likelihood of the vehicle 10 remaining in the lane is thus increased. Thus, by way of the controlled and coordinated emergency maneuver corrected by way of the longitudinal acceleration, the likelihood is increased that the driving lane is not departed from in the event of an emergency maneuver situation during highly automated driving.

[0133] FIG. 4 schematically shows an emergency maneuver control method for a vehicle 10. In this method, firstly, an emergency maneuver trajectory NT is ascertained during the highly automated or autonomous operating mode of the vehicle 10. In FIG. 4, this is denoted by the reference designation 200. The reference designation 300 denotes the deriving of longitudinal guidance control commands 33 and lateral guidance control commands 44 from the ascertained emergency maneuver trajectory NT. The provision of the longitudinal guidance control commands 33 and of the lateral guidance control commands 44 is denoted by the reference designation 400. In the event of an emergency maneuver situation, the longitudinal guidance control commands 33 are output at least to the one longitudinal guidance actuator 30 and the lateral guidance control commands 44 are output at least to the one lateral guidance actuator 40. This is denoted by the reference designation 500. The execution of the longitudinal guidance control commands 33 by way of at least the one longitudinal guidance actuator 30 and the execution of the lateral guidance control commands 44 by way of at least the one lateral guidance actuator 40 are denoted by reference designation 600.