(19)
(11)EP 3 410 239 B1

(12)EUROPEAN PATENT SPECIFICATION

(45)Mention of the grant of the patent:
25.03.2020 Bulletin 2020/13

(21)Application number: 16900220.1

(22)Date of filing:  10.11.2016
(51)Int. Cl.: 
G05B 19/04  (2006.01)
G05D 1/00  (2006.01)
(86)International application number:
PCT/CN2016/105316
(87)International publication number:
WO 2017/185712 (02.11.2017 Gazette  2017/44)

(54)

VEHICLE CONTROL METHOD AND SYSTEM

FAHRZEUGSTEUERUNGSVERFAHREN UND -SYSTEM

PROCÉDÉ ET SYSTÈME DE COMMANDE DE VÉHICULE


(84)Designated Contracting States:
AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

(30)Priority: 27.04.2016 CN 201610270320

(43)Date of publication of application:
05.12.2018 Bulletin 2018/49

(73)Proprietor: Huawei Technologies Co., Ltd.
Longgang District Shenzhen, Guangdong 518129 (CN)

(72)Inventor:
  • LIN, Yangbo
    Shenzhen Guangdong 518129 (CN)

(74)Representative: Körber, Martin Hans 
Mitscherlich PartmbB Patent- und Rechtsanwälte Sonnenstrasse 33
80331 München
80331 München (DE)


(56)References cited: : 
CN-A- 103 693 038
CN-A- 104 079 669
CN-A- 104 890 595
US-A1- 2014 277 896
US-A1- 2015 120 124
CN-A- 104 064 050
CN-A- 104 477 167
US-A1- 2012 277 947
US-A1- 2014 365 062
  
      
    Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention).


    Description

    TECHNICAL FIELD



    [0001] The present invention relates to the field of vehicle control technologies, and in particular, to a control method and system for a vehicle.

    BACKGROUND



    [0002] An ITS (Intelligent Transportation System) is a real-time, accurate, efficient comprehensive transportation management system that can function in all aspects over a wide area, and is established by effectively integrating advanced information technologies, data communication transmission technologies, electronic sensing technologies, control technologies, computer technologies, and the like together and applying them to an entire ground transportation-associated system.

    [0003] Automated driving is an important part of the ITS. Automated driving can effectively make up for deficiencies of human drivers in judgments, reactions, and operations, to help improve transportation security. During automated driving, information and resources provided by a transportation system can be better utilized, to help improve transportation efficiency. An automatically driven vehicle is referred to as an automated vehicle.

    [0004] The technical development and market introduction of automated driving are implemented at different stages. Initially, automated driving starts from a DAS (Driver Assistance System) that provides information and alerts to human drivers, and then gradually transits to an ADS (Automated Driving System) that can take over a growing quantity of dynamic driving tasks from human drivers. Finally, complete automatic vehicle control is implemented without intervention of human drivers.

    [0005] Intelligence development of vehicles and enhancement of transportation systems need to take a relatively long period of time. In this period, human drivers are indispensable to processing of some special, complex, or unpredictable cases. In addition, for some particular scenarios or requirements, for example, when a failure occurs on a vehicle or the ITS or when security detection or functional verification is performed, a human driver may be needed to control the vehicle.

    [0006] It can be learned that, in different scenarios, vehicle control may be performed by non-human drivers (such as, the ITS and the ADS), human drivers, or a combination thereof, and these complex and variable cases have important impact on vehicle control. To satisfy flexibility of vehicle control, ensure security of the ITS, and adapt to development of vehicle intelligence and Internet of vehicles, how to effectively coordinate vehicle control behaviors of non-human drivers and human drivers becomes an urgent problem to be resolved.

    [0007] Document US 2015/0120124 A1 discloses a method and apparatus for activating or deactivating an automatic driving function of a technical system for assisting the driver of a motor vehicle based on system states of the motor vehicle.

    SUMMARY



    [0008] The present invention is defined by a control method for a vehicle according to independent claim 1, and a control system for a vehicle according to independent claim 6 to effectively coordinate vehicle control behaviors of a non-human driver or a human driver.

    BRIEF DESCRIPTION OF DRAWINGS



    [0009] To describe the technical solutions in the embodiments of the present invention or in the prior art more clearly, the following briefly describes the accompanying drawings required for describing the embodiments or the prior art. Apparently, a person of ordinary skill in the art may still derive other drawings from these accompanying drawings without creative efforts.

    FIG. 1 is a schematic diagram of an architecture of a control system for a vehicle according to an embodiment of the present invention;

    FIG. 2 is a schematic flowchart of a control method for a vehicle according to an embodiment of the present invention;

    FIG. 3 is a schematic flowchart of another control method for a vehicle according to an embodiment of the present invention;

    FIG. 4 is a schematic flowchart of still another control method for a vehicle according to an embodiment of the present invention;

    FIG. 5 is a schematic flowchart of another control method for a vehicle according to an embodiment of the present invention;

    FIG. 6 is a schematic flowchart of another control method for a vehicle according to an embodiment of the present invention;

    FIG. 7 is a block diagram of a control system for a vehicle according to an embodiment of the present invention; and

    FIG. 8 is a block diagram of another control system for a vehicle according to an embodiment of the present invention.


    DESCRIPTION OF EMBODIMENTS



    [0010] To make a person skilled in the art understand the technical solutions in the present invention better, the following clearly and completely describes the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention.

    [0011] Referring to FIG. 1, FIG. 1 is a schematic diagram of an architecture of a control system for a vehicle according to an embodiment of the present invention. As shown in FIG. 1, the control system for a vehicle includes: an in-vehicle controller, for example, On-board Control Center (OCC) 110, a vehicle-to-everything (V2X) module 120, an automated driving system (ADS) 130, a driver assistance system (DAS) 140, a direction execution unit 150, a speed execution unit 160, and a human machine interface (HMI) 170.

    [0012] The in-vehicle controller 110 is responsible for managing all control functions of the vehicle. The in-vehicle controller 110 interacts with a human driver or a passenger by using the human machine interface 170. The human machine interface 170 may include a physical button, a pressure touch panel, an audio-video collector, a display screen, a speaker, and the like.

    [0013] The in-vehicle controller 110 interacts with another function entity in an ITS by using the vehicle-to-everything module 120. The V2X is a key technology in a future intelligent transportation system, and enables communication between vehicles, communication between a vehicle and a base station, and communication between base stations, so as to obtain traffic information such as a real-time road condition, road information, or pedestrian information, thereby improving driving security, reducing traffic jams, improving transportation efficiency, providing in-vehicle infotainment information, and the like.

    [0014] When the vehicle is in a non-automated driving mode, the driver assistance system 140 may assist a human driver in controlling the direction execution unit 150 and the speed execution unit 160.

    [0015] When the vehicle is in an automated driving mode, the automated driving system 130 controls the direction execution unit 150 and the speed execution unit 160.

    [0016] The direction execution unit 150 is configured to execute a direction control instruction of the vehicle, to control a direction of the vehicle; and the speed execution unit 160 is configured to execute a speed control instruction of the vehicle, to control a speed of the vehicle.

    [0017] Referring to FIG. 1 and FIG. 2, FIG. 2 is a schematic flowchart of a control method for a vehicle according to an embodiment of the present invention. The method is applied to the control system for a vehicle shown in FIG. 1. As shown in FIG. 2, the control method for a vehicle may include the following steps.

    [0018] S110. An in-vehicle controller receives a vehicle control instruction, and determines a function level to which a control function corresponding to the vehicle control instruction belongs.

    [0019] Control functions of the vehicle are classified into different function levels according to flexibility of customizing the control functions and impact of the control functions on security of the control system for a vehicle.

    [0020] Flexibility of customizing a control function is flexibility that different vehicle controllers are allowed to perform an operation. When more vehicle controllers are allowed to perform an operation, the flexibility of customizing the control function is higher. Flexibility of customizing a control function is related to impact of the control function on security of a vehicle system. For example, when a control function has relatively great impact on the security of the vehicle system, flexibility of customizing the control function is relatively low; or if a control function has relatively small impact on the security of the vehicle system, flexibility of customizing the control function is relatively high.

    [0021] For example, the function levels may include: a negotiation level, a control level, a limited level, and the like.

    [0022] A control function that can allow a non-current vehicle controller to participate in control belongs to the negotiation level. A controller with a higher priority may make a decision using an opinion of a controller with a lower priority as a reference. Usually, a priority of controlling the function by each related vehicle control party may be flexibly changed as needed. For example, a driving path may be determined by an ITS using traffic information learned by the ITS as a reference, and then the vehicle is instructed to travel according to the driving path. Alternatively, a driving path may be determined by a human driver (a user) according to a personal intention, and then the vehicle is instructed to travel according to the driving path.

    [0023] A control function that allows only a current vehicle controller to perform control belongs to the control level. In a particular scenario, a priority of controlling the function by each possible controller is usually fixed. Usually, only a controller with a higher priority can control a control function at the control level, and a controller with a lower priority is not allowed to control the control function at the control level unless the vehicle cannot normally work in a current controller due to an accident. For example, direction control and speed control are performed by an ADS when the vehicle is in an automated driving mode, and direction control and speed control are performed by a human driver when the vehicle is in a non-automated driving mode. It should be noted that a priority of controlling the control function at the control level is related to a driving mode and a level of the control function. For example, for the control function at the control level, a priority of a controller corresponding to the current driving mode is higher than a priority of another vehicle controller. For example, in the automated driving mode, a priority of the ADS is higher than a priority of the human driver.

    [0024] A control function that even does not allow the current vehicle controller to perform control belongs to the limited level. Control of the function is preset according to a specified rule. For example, a highest speed limit (which may be different in different scenarios) is preset for a vehicle speed of the vehicle before delivery, or the ITS instructs to set a highest speed limit (which may be different in different scenarios) when the ITS participates in an activity or a transaction. The vehicle is not allowed to exceed the speed limit regardless of a controller that controls the vehicle.

    [0025] S120. The in-vehicle controller determines, according to the function level to which the control function corresponding to the vehicle control instruction belongs and an instruction sending controller that sends the vehicle control instruction, whether the vehicle control instruction is valid; and
    if determining that the vehicle control instruction is valid, the in-vehicle controller performs S130; or if determining that the vehicle control instruction is invalid, the in-vehicle controller performs S140.

    [0026] The instruction sending controller may be a human driver or a non-human driver (such as, the ADS or the ITS).

    [0027] For example, a function at the negotiation level may be determined by means of negotiation by each related control party. For a function at the control level, it is further determined, using a priority of a vehicle controller as a reference, whether the vehicle control instruction sent by the instruction sending controller is valid. For a function at the limited level, no controller has control permission for the control function. That is, a vehicle control instruction corresponding to the function at the limited level is invalid.

    [0028] S130. The in-vehicle controller instructs an execution unit to execute the vehicle control instruction.

    [0029] S140. The in-vehicle controller instructs an execution unit to ignore the vehicle control instruction.

    [0030] The execution unit in S130 and S140 includes the direction execution unit 150 and the speed execution unit 160 in FIG. 1.

    [0031] According to the control method for a vehicle provided in this embodiment, vehicle control functions are classified in advance into different function levels. After receiving the vehicle control instruction, the in-vehicle controller obtains the function level to which the vehicle control instruction belongs, and then determines, according to the function level corresponding to the vehicle control instruction and the instruction sending controller, whether the vehicle control instruction is valid. If the vehicle control instruction is valid, the in-vehicle controller instructs the execution unit to execute the vehicle control instruction; or if the vehicle control instruction is invalid, the in-vehicle controller instructs the execution unit to ignore the vehicle control instruction. In the control method for a vehicle, the in-vehicle controller does not simply determine that the vehicle control instruction that is sent by the current vehicle controller corresponding to a current driving mode of the vehicle is valid. Instead, the in-vehicle controller determines, using the function level to which the control function corresponding to the vehicle control instruction belongs as a reference and the instruction sending controller, whether the vehicle control instruction is valid, so as to coordinate vehicle control behaviors of an ITS, an ADS, and a human driver, thereby satisfying flexibility of vehicle control, that is, all vehicle controllers are possible to control the vehicle regardless of the current driving mode of the vehicle, and ensuring security of the control system for a vehicle.

    [0032] Referring to FIG. 1 and FIG. 3, FIG. 3 is a schematic flowchart of another control method for a vehicle according to an embodiment of this application. A control function in this embodiment includes: a negotiation level, a control level, and a limited level. As shown in FIG. 3, the method includes the following steps.

    [0033] S210. An in-vehicle controller receives a vehicle control instruction.

    [0034] If the vehicle control instruction is initiated by a human driver, the human driver may send, to the in-vehicle controller, a corresponding vehicle control request by using a human machine interface.

    [0035] S220. The in-vehicle controller determines a function level corresponding to the vehicle control instruction.

    [0036] In some embodiments of the present invention, the function level to which a control function belongs may include: a negotiation level, a control level, and a limited level. If the control function corresponding to the vehicle control instruction belongs to the negotiation level, S230 is performed; or if the control function corresponding to the vehicle control instruction belongs to the control level, S260 is performed; or if the control function corresponding to the vehicle control instruction belongs to the limited level, S280 is performed.

    [0037] S230. The in-vehicle controller compares a priority of an instruction sending controller with a priority of a current vehicle controller, and if the priority of the instruction sending controller is higher than or equal to the priority of the current vehicle controller, performs S240, or if the priority of the instruction sending controller is lower than the priority of the current vehicle controller, performs S250.

    [0038] Usually, a control function at the negotiation level may be determined by a controller with a higher priority using an opinion of a controller with a lower priority as a reference. A priority of a vehicle controller is related to a level of the control function and the function level corresponding to the vehicle control instruction. For example, priorities of controlling path planning in descending order are sequentially: a user, an ITS, and an ADS.

    [0039] For example, when the vehicle starts and is ready to move, the user (a human driver or a passenger) may send, to an in-vehicle controller 110, a path planning request by using a human machine interface 170, and provide destination information, waypoints, a possible preference, and other information (for example, highway is preferred). The in-vehicle controller 110 determines that path planning belongs to a function at the negotiation level, and therefore, may make a decision in combination with information and opinions of the user, the ADS, and the ITS.

    [0040] S240. The in-vehicle controller determines that the vehicle control instruction is valid and is used as a primary control instruction, and controls the vehicle using another secondary control instruction as a reference.

    [0041] The in-vehicle controller 110 uses path planning formulated by the user, as the primary control instruction, and may make a final decision using a path planned route formulated by the ITS or the ADS as a reference.

    [0042] For example, the in-vehicle controller 110 requests the ITS for a path planning service by using a vehicle-to-everything module 120, and supplements a destination, the possible preference, and other information. After formulating path planning according to learned traffic information, the ITS feeds back the path planning to the in-vehicle controller 110 by using the vehicle-to-everything module 120. If no path planning service can be obtained from the ITS, the in-vehicle controller 110 may instruct a DAS or the ADS to formulate path planning according to map information configured by the vehicle. The in-vehicle controller 110 notifies, by using the human machine interface 170, the user of the path planning formulated by the ITS or the DAS/ADS. If a plurality of options that can completely satisfy a user requirement exist, or if no option completely satisfies a user requirement but alternative options that partially satisfy the user requirement are available, the user further needs to make a selection. The user may select one path as final path planning by using the human machine interface 170, and provide the final path planning to the in-vehicle controller 110. The in-vehicle controller 110 uses a path planning option finally selected by the user, as final path planning.

    [0043] For another example, if the user wants to change a route during driving of the vehicle, the user may send a path planning update request to the in-vehicle controller by using the human machine interface 170, and provide an updated destination, updated waypoints, and other information. The in-vehicle controller 110 determines that path planning belongs to a function at the negotiation level, and obtains information about updated path planning by interacting with the ITS by using a vehicle-to-everything module 120, or instructs a DAS/the ADS to update the path planning according to map information configured by the vehicle. Then, the in-vehicle controller interacts, by using the human machine interface 170, with the user to confirm the updated path planning, and instructs the ADS to adjust a direction and a speed according to the confirmed new path planning.

    [0044] S250. The in-vehicle controller determines that the vehicle control instruction is valid and is used as a secondary control instruction, and controls the vehicle using the secondary control instruction as a reference according to a primary control instruction generated by the controller with the higher priority.

    [0045] After receiving path planning formulated by the ITS or the ADS, the in-vehicle controller 110 determines that the path planning belongs to the secondary control instruction, uses path planning formulated by the user as the primary control instruction, and determines final path planning using the secondary control instruction as a reference.

    [0046] S260. The in-vehicle controller compares a priority of an instruction sending controller with a priority of a current vehicle controller, and if the priority of the instruction sending controller is higher than or equal to the priority of the current vehicle controller, performs S270, or if the priority of the instruction sending controller is lower than the priority of the current vehicle controller, performs S280.

    [0047] The current vehicle controller is a controller corresponding to a current driving mode of the vehicle. If the vehicle is currently in an automated driving mode, the current vehicle controller is the ADS; or if the vehicle is currently in a non-automated driving mode, the current vehicle controller is the human driver.

    [0048] A function at the control level allows only the current vehicle controller to perform an operation. In a particular scenario, a priority of controlling the function at the control level by each controller is usually fixed. A priority of controlling a control function at the control level is related to a driving mode and a level of the control function. For example, for the control function at the control level, a priority of a controller corresponding to the current driving mode is higher than a priority of another vehicle controller.

    [0049] For example, if the in-vehicle controller 110 receives direction and speed operation instructions, the in-vehicle controller 110 determines that direction and speed operations belong to functions at the control level. The in-vehicle controller 110 continues to determine the current driving mode of the vehicle, and determines priorities of the instruction sending controller and the current vehicle controller for the control function at the control level according to the driving mode. For example, if the current driving mode is the automated driving mode, a priority of the ADS is higher than a priority of the human driver; or if the current driving mode is the non-automated driving mode, a priority of the human driver is higher than a priority of the ADS.

    [0050] S270. The in-vehicle controller determines that the vehicle control instruction is valid, and instructs an execution unit to execute the vehicle control instruction.

    [0051] When determining that the vehicle control instruction sent by the instruction sending controller is valid, the in-vehicle controller 110 instructs the execution unit (a direction execution unit 150 and a speed execution unit 160) to execute the vehicle control instruction.

    [0052] S280. The in-vehicle controller determines that the vehicle control instruction is invalid, and instructs an execution unit to ignore the vehicle control instruction.

    [0053] If the sent vehicle control instruction is invalid, the in-vehicle controller 110 instructs the execution unit to reject execution of the vehicle control instruction.

    [0054] For example, when the vehicle is in the automated driving mode, if the user performs a direction operation or an acceleration operation by accident or performs an operation on a braking apparatus by accident, the in-vehicle controller 110 determines that direction and speed operations belong to functions at the control level, and the vehicle is currently in the automated driving mode. For control of a direction, a speed, or the braking apparatus, the priority of the ADS is higher than the priority of the human driver. Therefore, the in-vehicle controller 110 determines that a vehicle control instruction that is sent by the user (the human driver) for controlling the direction, the speed, or braking of the vehicle is invalid, and instructs the execution unit (the direction execution unit 150 and the speed execution unit 160) to ignore a user-related operation. Further, warning information may be sent by using the human machine interface 170, to prompt that the user is not authorized to perform speed and direction operations.

    [0055] For another example, when the vehicle is in the non-automated driving mode, the human driver controls a direction and a speed of the vehicle. When the human driver performs an acceleration operation, the in-vehicle controller 110 determines that the speed operation belongs to a function at the control level. Therefore, a control priority of the human driver is higher than a priority of a non-human driver; and it is determined that an operation of controlling the speed of the vehicle by the human driver is valid, and the acceleration operation of the human driver is allowed. However, if the human driver makes an operation error, when over-acceleration may cause the vehicle to exceed a preset highest speed limit, the in-vehicle controller 110 determines that over-speed driving belongs to a limited function in a common use scenario of the vehicle. The preset highest speed limit is not allowed to be exceeded regardless of a controller that controls the vehicle. Therefore, an acceleration operation of the human driver is restricted, and warning information is output by using the human machine interface 170, to prompt the user that the vehicle may exceed the highest speed limit. If the human driver does not take any corrective action and causes the vehicle to finally reach the highest speed limit, the in-vehicle controller 110 instructs the execution unit (the speed execution unit 160) to ignore an acceleration control instruction of the human driver, so that it is ensured that the vehicle speed cannot exceed the highest speed limit.

    [0056] Likewise, if the vehicle is in the automated driving mode, the ADS controls a direction and a speed of the vehicle. If an operation error occurs in the ADS (for example, the system encounters a failure or is broken into by a hacker), when over-acceleration may cause the vehicle to exceed a preset highest speed limit, the in-vehicle controller performs determining and processing similar to those performed when the human driver drives the vehicle. Details are not described herein.

    [0057] Similarly, if the vehicle controller (the human driver or the ADS) incorrectly controls the direction of the vehicle or performs over-acceleration, causing the vehicle to collide with some objects, the in-vehicle controller 110 determines that a collision belongs to a function at the limited level in a common use scenario of the vehicle, and is prohibited regardless of a controller that controls the vehicle.

    [0058] If the vehicle controller is the human driver, the in-vehicle controller 110 limits direction and speed operations of the human driver, and outputs warning information by using the human machine interface 170, to prompt the user that the vehicle may collide with an obstacle. If the human driver does not take any corrective action, the in-vehicle controller 110 instructs the speed execution unit to decelerate or stop the vehicle. If the human driver repeatedly makes the error, the in-vehicle controller 110 may instruct the direction execution unit and the speed execution unit to ignore direction and speed control of the human driver to ensure driving security of the vehicle. A process in a scenario in which the vehicle controller is the ADS is similar to the foregoing process, and details are not described herein.

    [0059] According to the control method for a vehicle provided in this embodiment, control functions of the vehicle are classified into different function levels according to flexibility of customizing the control functions and impact of the control functions on security of a control system for a vehicle. For example, the function levels may include: the negotiation level, the control level, and the limited level. Then, it is determined, according to the level of the control function performed by the controller, whether the vehicle control instruction is valid. In the control method for a vehicle, the in-vehicle controller does not simply determine that the vehicle control instruction that is sent by the current vehicle controller corresponding to the current driving mode of the vehicle is valid. Instead, the in-vehicle controller determines, using the function level to which the control function corresponding to the vehicle control instruction belongs as a reference and the instruction sending controller, whether the vehicle control instruction is valid, so as to coordinate vehicle control behaviors of the ITS, the ADS, and the human driver, thereby satisfying flexibility of vehicle control, that is, all vehicle controllers are possible to control the vehicle regardless of the current driving mode of the vehicle, and ensuring security of the control system for a vehicle.

    [0060] Referring to FIG. 4, FIG. 4 is a schematic flowchart of still another control method for a vehicle according to an embodiment of this application. Based on the embodiment shown in FIG. 2, the method further includes the following steps.

    [0061] S310. When the current vehicle controller cannot control the vehicle, the in-vehicle controller requests, according to priorities, another vehicle controller to participate in vehicle control.

    [0062] When the current vehicle controller is a human driver, the another vehicle controller is an ADS or an ITS; or when the current vehicle controller is an ADS, the another vehicle controller is a human driver or an ITS.

    [0063] For example, the ADS has difficulty in controlling a direction and a speed of the vehicle for driving (such as a system failure or an information mismatch) according to already determined path planning, and the ADS reports the case to the in-vehicle controller 110 or the in-vehicle controller 110 learns the case by monitoring the ADS. Assuming that it is preset in such a manner that a priority of the human driver is higher than a priority of the ITS, the in-vehicle controller 110 requests, by using a human machine interface 170, a user with a higher priority to take over vehicle control. If the user cannot take over vehicle control, the in-vehicle controller 110 may continue to request the ITS to take over vehicle control.

    [0064] S320. When determining that the another vehicle controller can control the vehicle, the in-vehicle controller determines that a vehicle control instruction sent by the another vehicle controller is valid, and instructs the execution unit to execute the vehicle control instruction sent by the another vehicle controller.

    [0065] Still using the example in S310, if there is a human driver that can take over vehicle control, the human driver may return an accept response message to the in-vehicle controller by using the human machine interface 170, and the vehicle is switched to a non-automated driving mode. The in-vehicle controller 110 instructs the execution unit to execute a vehicle control instruction of the human driver, and the human driver controls the direction and the speed of the vehicle.

    [0066] If the vehicle is in a non-automated driving mode, and the in-vehicle controller receives an accept response message of the ADS, an automated driving mode is switched to, and the execution unit is instructed to accept a vehicle control instruction sent by the ADS.

    [0067] S330. When determining that the another vehicle controller cannot control the vehicle, the in-vehicle controller instructs the execution unit to perform emergency handling.

    [0068] Still using the example in S310, in an application scenario, if no human driver can take over vehicle control (such as, no accept response message is received from the user within first preset duration, or a reject response message returned by the user is received), the in-vehicle controller 110 instructs the ADS to control the direction and the speed execution unit to perform emergency handling, for example, search for a secure place nearby for parking. In another application scenario, if no human driver can take over vehicle control, the in-vehicle controller 110 may continue to request the ITS to take over vehicle control, and if the ITS cannot take over vehicle control either, the in-vehicle controller 110 instructs the ADS to perform emergency handling.

    [0069] If the vehicle is in the non-automated driving mode, the human driver frequently makes operation errors, and the ADS also encounters a failure and cannot control the vehicle, the in-vehicle controller 110 instructs the execution unit to take a security measure for emergency handling, to ensure driving security of the vehicle.

    [0070] According to the control method for a vehicle provided in this embodiment, when the current vehicle controller cannot control the vehicle due to a failure, the in-vehicle controller requests, in descending order of the priorities, the another vehicle controller to intervene in vehicle control. If the another vehicle controller can take over vehicle control, the driving mode of the vehicle is switched, so that the another vehicle controller controls the vehicle. If the another vehicle controller cannot take over the vehicle, a security measure is taken for emergency handling, for example, deceleration is performed or a secure place nearby for parking is searched for, to fully ensure security of a control system for a vehicle.

    [0071] Referring to FIG. 5, FIG. 5 is a schematic flowchart of another control method for a vehicle according to an embodiment of the present invention. The method is applied to an in-vehicle controller, the in-vehicle controller pre-stores an instruction relationship, and the instruction relationship is used to represent an execution selection that is made by the in-vehicle controller from contrary instructions of at least two controllers. As shown in FIG. 5, the method includes the following steps.

    [0072] S410. The in-vehicle controller receives a first instruction and a second instruction.

    [0073] The first instruction is sent by a first controller, and the second instruction is sent by a second controller. The first controller and the second controller belong to different types of controllers. A vehicle controller includes a human driver, an automated driving system (ADS), and an intelligent transportation system (ITS). For example, the first controller is the human driver, and the second controller is the ADS or the ITS.

    [0074] S420. The in-vehicle controller determines a vehicle control instruction according to the instruction relationship, the first instruction, and the second instruction.

    [0075] The in-vehicle controller selects, according to the instruction relationship, at least one instruction from the first instruction and the second instruction as the vehicle control instruction for execution.

    [0076] In some embodiments of the present invention, the instruction relationship pre-stored in the in-vehicle controller may be determined according to priorities of controllers that send instructions. For example, the in-vehicle controller always chooses to execute an instruction sent by a controller with a higher priority.

    [0077] For example, the priorities in descending order of the controllers that send instructions are sequentially the human driver, the ADS, and the ITS. If the controller that sends the first instruction is the human driver, and the controller that sends the second instruction is the ITS, the in-vehicle controller determines, according to the instruction relationship, the first instruction that is sent by the human driver with a higher priority, as the vehicle control instruction, and controls the vehicle according to the vehicle control instruction.

    [0078] In some embodiments of the present invention, when the first instruction and the second instruction are contrary, the in-vehicle controller determines the vehicle control instruction according to the execution selection that is made from the first instruction and the second instruction based on the instruction relationship.

    [0079] That the first instruction and the second instruction are contrary includes: results that are generated by executing the first instruction and the second instruction conflict with each other. For example, the first instruction is controlling the vehicle to accelerate, but the second instruction is controlling the vehicle to decelerate.

    [0080] In some other embodiments of the present invention, when the first instruction and the second instruction are not contrary, the in-vehicle controller determines that the first instruction and the second instruction are both vehicle control instructions.

    [0081] That the first instruction and the second instruction are not contrary includes: results that are obtained by executing the first instruction and the second instruction do not conflict with each other. For example, the first instruction is controlling the vehicle to accelerate, and the second instruction is also controlling the vehicle to accelerate; or the first instruction is determining a destination, and the second instruction is determining path planning for driving to the destination.

    [0082] In some embodiments of the present invention, if the in-vehicle controller cannot execute the first instruction, in this application scenario, the in-vehicle controller determines the second instruction as the vehicle control instruction.

    [0083] For example, when the controller that sends the first instruction is the ADS, and the in-vehicle controller detects that the ADS has difficulty in controlling a direction and a speed of the vehicle for driving, a control instruction (the second instruction) sent by another vehicle controller is selected in descending order of priorities according to the foregoing priority relationship of the controllers for control instructions.

    [0084] According to the control method for a vehicle provided in this embodiment, when instructions conflicting with each other that are sent from different controllers are received, it is determined, according to the instruction relationship pre-stored in the in-vehicle controller, which instruction is to be executed, so as to coordinate vehicle control behaviors of an ITS, an ADS, and a human driver, thereby ensuring security of a control system for a vehicle.

    [0085] It should be understood that, for an illustration purpose, different instructions of only two controllers are used as an example in this embodiment of the present invention, and according to an actual situation, there may be a plurality of different instructions of more than two controllers. This is not limited. In other embodiments, a quantity of controllers that send instructions is not limited either, and details are not described again.

    [0086] Referring to FIG. 6, FIG. 6 is a schematic flowchart of yet another control method for a vehicle according an embodiment of the present invention. The method may include the following steps.

    [0087] S510. An in-vehicle controller receives a first instruction and a second instruction.

    [0088] S520. The in-vehicle controller adjusts an instruction relationship according to a vehicle parameter.

    [0089] The vehicle parameter includes at least one of a driving mode (an automated driving mode and a non-automated driving mode) of the vehicle, a running status, a maintenance status, or performance of the vehicle.

    [0090] In the instruction relationship, when an instruction execution selection is determined according to priorities of instruction sending controllers, the priorities of the instruction sending controllers are adjusted according to the vehicle parameter, including dynamic adjustment and static adjustment.

    [0091] The dynamic adjustment may be detecting, in a running process of the vehicle, that the vehicle parameter changes, and dynamically adjusting the priorities of the instruction sending controllers according to a change of the vehicle parameter, so that a vehicle control instruction is determined according to an adjusted instruction relationship. For example, when a vehicle status, a road condition, or the driving mode changes, the instruction relationship is adjusted in time according to a changed running status.

    [0092] The static adjustment may be adjusting the instruction relationship according to a change of the vehicle parameter when it is detected, before the vehicle is started, that the vehicle parameter changes or the vehicle parameter is manually changed, and determining a vehicle control instruction according to the adjusted instruction relationship.

    [0093] S530. The in-vehicle controller determines a vehicle control instruction according to the instruction relationship, the first instruction, and the second instruction.

    [0094] S540. When the vehicle control instruction determined by the in-vehicle controller satisfies a preset condition, the in-vehicle controller ignores the vehicle control instruction, where the preset condition includes at least one of a speed limit, a direction limit, a distance limit, or an instruction limit.

    [0095] The speed limit means that execution of the vehicle control instruction by the in-vehicle controller may cause the vehicle to exceed a specified highest speed. Therefore, the in-vehicle controller ignores the vehicle control instruction. The direction limit means that execution of the vehicle control instruction by the in-vehicle controller may cause the vehicle to violate a traffic rule or collide with an obstacle. Therefore, the in-vehicle controller ignores the vehicle control instruction

    [0096] The distance limit means that execution of the vehicle control instruction by the in-vehicle controller may cause the vehicle to collide with an obstacle. Therefore, the in-vehicle controller ignores the vehicle control instruction.

    [0097] The instruction limit means that execution of the vehicle control instruction by the in-vehicle controller violates an operational provision of the vehicle. For example, a brake but not a clutch is directly stepped on during driving of the vehicle, and this case is not allowed to occur. Therefore, the in-vehicle controller directly ignores the vehicle control instruction.

    [0098] The instruction limit further includes an instruction that is preset and that the vehicle is not allowed to execute personalized prohibited operations during driving of the vehicle, for example, it is not allowed to ignite a cigarette lighter or open a sunroof. The in-vehicle controller directly ignores the vehicle control instruction according to a user requirement.

    [0099] S550. The in-vehicle controller outputs warning information.

    [0100] The warning information is used to warn at least one (which is usually a sender of the determined vehicle control instruction) of a controller that sends the first instruction or a controller that sends the second instruction.

    [0101] For related content of the warning information, refer to the related description in S280 in the embodiment corresponding to FIG. 3. Details are not described herein.

    [0102] According to the control method for a vehicle provided in this embodiment, when instructions conflicting with each other that are sent from different controllers are received, it is determined, according to the instruction relationship pre-stored in the in-vehicle controller, which instruction is to be executed, so as to coordinate vehicle control behaviors of an ITS, an ADS, and a human driver. In addition, if it is determined that the vehicle control instruction satisfies the preset condition, the vehicle control instruction is ignored, to avoid a danger caused by execution of the vehicle control instruction to the vehicle, thereby improving security of a control system for a vehicle.

    [0103] Corresponding to the embodiments of the control methods for a vehicle in FIG. 2 to FIG. 4, the present invention further provides an embodiment of a control system for a vehicle.

    [0104] Referring to FIG. 7, FIG. 7 is a block diagram of a control system for a vehicle according to an embodiment of the present invention. As shown in FIG. 7, the control system for a vehicle includes an in-vehicle controller 710 and an execution unit 720.

    [0105] The in-vehicle controller 710 is configured to: receive a vehicle control instruction, and determine a function level to which a control function corresponding to the vehicle control instruction belongs; and determine, according to the function level to which the control function corresponding to the vehicle control instruction belongs and an instruction sending controller that sends the vehicle control instruction, whether the vehicle control instruction is valid.

    [0106] In some embodiments of the present invention, the function level to which the control function of the vehicle belongs includes: a negotiation level, a control level, and a limited level.

    [0107] When determining, according to the function level to which the control function corresponding to the vehicle control instruction belongs and the instruction sending controller that sends the vehicle control instruction, whether the vehicle control instruction is valid, the in-vehicle controller 710 is specifically configured to:

    if the control function corresponding to the vehicle control instruction belongs to the limited level, determine that the vehicle control instruction is invalid; or

    if the control function corresponding to the vehicle control instruction belongs to the control level, compare a priority of the instruction sending controller with a priority of a current vehicle controller, and if the priority of the instruction sending controller is higher than or equal to the priority of the current vehicle controller, determine that the vehicle control instruction is valid, or if the priority of the instruction sending controller is lower than the priority of the current vehicle controller, determine that the vehicle control instruction is invalid; or

    if the control function corresponding to the vehicle control instruction belongs to the negotiation level, compare a priority of the instruction sending controller with a priority of a current vehicle controller, and if the priority of the instruction sending controller is higher than or equal to the priority of the current vehicle controller, determine that the vehicle control instruction is valid and is used as a primary control instruction, so that the in-vehicle controller controls the vehicle according to the primary control instruction and using another secondary control instruction as a reference, or if the priority of the instruction sending controller is lower than the priority of the current vehicle controller, determine that the vehicle control instruction is valid and is used as a secondary control instruction, so that the in-vehicle controller controls the vehicle according to a primary control instruction using the secondary control instruction as a reference.



    [0108] The in-vehicle controller 710 is further configured to: when the current vehicle controller cannot control the vehicle, request, according to priorities, another vehicle controller to participate in vehicle control; when determining that the another vehicle controller can participate in vehicle control, determine that a vehicle control instruction sent by the another vehicle controller is valid; and when determining that no other vehicle controllers can participate in vehicle control, perform emergency handling, where the priority of the vehicle controller is determined according to a driving mode of the vehicle and the function level to which the control function corresponding to the vehicle control instruction belongs, and the driving mode includes automated driving and non-automated driving.

    [0109] The in-vehicle controller 710 is further configured to: if execution of the vehicle control instruction causes the vehicle to be in danger, determine that the vehicle control instruction is invalid.

    [0110] The in-vehicle controller 710 is further configured to: when the vehicle control instruction is invalid, output warning information, where the warning information is used to warn the instruction sending controller.

    [0111] The execution unit 720 is configured to: execute the vehicle control instruction when the in-vehicle controller determines that the vehicle control instruction is valid; or ignore the vehicle control instruction when the in-vehicle controller determines that the vehicle control instruction is invalid.

    [0112] According to the control system for a vehicle provided in this embodiment, control functions of the vehicle are classified into different function levels according to flexibility of customizing the control functions and impact of the control functions on security of the control system for a vehicle. For example, the function levels may include: the negotiation level, the control level, and the limited level. Then, it is determined, according to the level of the control function performed by the controller, whether the vehicle control instruction is valid. In the control system for a vehicle, the in-vehicle controller does not simply determine that the vehicle control instruction that is sent by the current vehicle controller corresponding to the current driving mode of the vehicle is valid. Instead, the in-vehicle controller determines, with reference to the function level to which the control function corresponding to the vehicle control instruction belongs and the instruction sending controller, whether the vehicle control instruction is valid, so as to coordinate vehicle control behaviors of an ITS, an ADS, and a human driver, thereby satisfying flexibility of vehicle control, that is, all vehicle controllers are possible to control the vehicle regardless of the current driving mode of the vehicle, and ensuring security of the control system for a vehicle.

    [0113] Referring to FIG. 8, FIG. 8 is a block diagram of another control system for a vehicle according to an embodiment of the present invention. As shown in FIG. 8, the system includes a receiver 810 and an in-vehicle controller 820. The in-vehicle controller 820 pre-stores an instruction relationship, and the instruction relationship is used to represent an execution selection that is made by the in-vehicle controller from contrary instructions of at least two controllers.

    [0114] The receiver 810 is configured to receive a first instruction and a second instruction.

    [0115] The in-vehicle controller 820 is configured to determine a vehicle control instruction according to the instruction relationship, the first instruction, and the second instruction.

    [0116] In some embodiments of the present invention, when determining the vehicle control instruction according to the instruction relationship, the first instruction, and the second instruction, the in-vehicle controller 820 is specifically configured to: when the first instruction and the second instruction are contrary, determine the vehicle control instruction according to the execution selection that is made from the first instruction and the second instruction based on the instruction relationship.

    [0117] In some other embodiments of the present invention, when determining the vehicle control instruction according to the instruction relationship, the first instruction, and the second instruction, the in-vehicle controller 820 is specifically configured to: when the first instruction and the second instruction are not contrary, determine that the first instruction and the second instruction are both vehicle control instructions.

    [0118] In some embodiments of the present invention, the in-vehicle controller 820 is further configured to adjust the instruction relationship according to a vehicle parameter.

    [0119] In some embodiments of the present invention, the vehicle parameter includes at least one of a driving mode of the vehicle, a running status of the vehicle, a maintenance status of the vehicle, or performance of the vehicle.

    [0120] In some other embodiments of the present invention, the in-vehicle controller 820 is further configured to: when the vehicle control instruction satisfies a preset condition, ignore the vehicle control instruction, where the preset condition includes at least one of a speed limit, a direction limit, a distance limit, or an instruction limit of the vehicle.

    [0121] In some other embodiments of the present invention, the in-vehicle controller 820 is further configured to: output warning information after ignoring the vehicle control instruction, where the warning information is used to warn at least one of a sender that sends the first instruction or a sender that sends the second instruction.

    [0122] In some other embodiments of the present invention, the in-vehicle controller 820 is further configured to: when the first instruction cannot be executed, determine the second instruction as the vehicle control instruction; or when neither the first instruction nor the second instruction can be executed, perform emergency handling, where the emergency handling includes at least one of parking, starting, speed changing, or direction changing.

    [0123] According to the control system for a vehicle provided in this embodiment, when instructions conflicting with each other that are sent from different controllers are received, it is determined, according to the instruction relationship pre-stored in the in-vehicle controller, which instruction is to be executed, so as to coordinate vehicle control behaviors of an ITS, an ADS, and a human driver, thereby ensuring security of the control system for a vehicle.

    [0124] The embodiments in this specification are all described in a progressive manner, for same or similar parts in the embodiments, refer to these embodiments, and each embodiment focuses on a difference from other embodiments. Especially, apparatus or system embodiments are basically similar to a method embodiment, and therefore are described briefly; for related parts, refer to partial descriptions in the method embodiment. The described apparatus and system embodiments are merely examples. The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solutions of the embodiments. A person of ordinary skill in the art may understand and implement the embodiments of the present invention without creative efforts.

    [0125] The present invention can be described in the general context of executable computer instructions executed by a computer, for example, a program module. Generally, the program unit includes a routine, program, object, component, data structure, and the like for executing a particular task or implementing a particular abstract data type. The present invention may also be practiced in distributed computing environments in which tasks are performed by remote processing devices that are connected through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.

    [0126] It should be noted that in this specification, relational terms such as first and second are only used to distinguish one entity or operation from another, and do not necessarily require or imply that any actual relationship or sequence exists between these entities or operations. Moreover, the terms "include", "comprise", or their any other variant is intended to cover a non-exclusive inclusion, so that a process, a method, an article, or an apparatus that includes a list of elements not only includes those elements but also includes other elements which are not expressly listed, or further includes elements inherent to such process, method, article, or apparatus. An element preceded by "includes a ..." does not, without more constraints, preclude the existence of additional identical elements in the process, method, article, or apparatus that includes the element.

    [0127] The foregoing descriptions are merely specific implementations of the present invention. It should be noted that a person of ordinary skill in the art may make several improvements or polishing without departing from the principle of the present invention as defined by the appended claims.


    Claims

    1. A control method for a vehicle, wherein the vehicle comprises an in-vehicle controller and an execution unit; and the method comprises:

    receiving (S110, S210), by the in-vehicle controller, a vehicle control instruction, and determining (S220) a function level to which a control function corresponding to the vehicle control instruction belongs;

    determining (S1120), by the in-vehicle controller, according to the function level to which the control function corresponding to the vehicle control instruction belongs and an instruction sending controller that sends the vehicle control instruction, whether the vehicle control instruction is valid; and

    if the vehicle control instruction is valid, instructing (S130), by the in-vehicle controller, the execution unit to execute the vehicle control instruction; or if the vehicle control instruction is invalid, ignoring(S140), by the in-vehicle controller, the vehicle control instruction, the control method characterised in that the function level to which the control function corresponding to the vehicle control instruction belongs comprises: a negotiation level, a control level, and a limited level; and

    the determining (S220), by the in-vehicle controller, according to the function level to which the control function corresponding to the vehicle control instruction belongs and an instruction sending controller that sends the vehicle control instruction, whether the vehicle control instruction is valid comprises:

    if the control function corresponding to the vehicle control instruction belongs to the limited level, determining (S280) that the vehicle control instruction is invalid; or

    if the control function corresponding to the vehicle control instruction belongs to the control level, comparing (S260) a priority of the instruction sending controller with a priority of a current vehicle controller, and if the priority of the instruction sending controller is higher than or equal to the priority of the current vehicle controller, determining (S270) that the vehicle control instruction is valid, or if the priority of the instruction sending controller is lower than the priority of the current vehicle controller, determining (S280) that the vehicle control instruction is invalid; or

    if the control function corresponding to the vehicle control instruction belongs to the negotiation level, comparing (S230) a priority of the instruction sending controller with a priority of a current vehicle controller, and if the priority of the instruction sending controller is higher than or equal to the priority of the current vehicle controller, determining (240) that the vehicle control instruction is valid and is used as a primary control instruction, so that the in-vehicle controller controls the vehicle according to the primary control instruction using a secondary control instruction as a reference, or if the priority of the instruction sending controller is lower than the priority of the current vehicle controller, determining (S250) that the vehicle control instruction is valid and is used as a secondary control instruction, so that the in-vehicle controller controls the vehicle according to a primary control instruction generated by the controller with the higher priority using the secondary control instruction as a reference.


     
    2. The method according to claim 1, wherein the method further comprises:

    when the current vehicle controller cannot control the vehicle, requesting (S310), by the in-vehicle controller according to priorities, another vehicle controller to participate in vehicle control;

    when determining that the another vehicle controller can participate in vehicle control, determining (S320), by the in-vehicle controller, that a vehicle control instruction sent by the another vehicle controller is valid; and

    when determining that no other vehicle controllers can participate in vehicle control, performing (S330), by the in-vehicle controller, emergency handling.


     
    3. The method according to any one of claims 1 to 2, wherein the method further comprises:
    if execution of the vehicle control instruction causes the vehicle to be in danger, determining, by the in-vehicle controller, that the vehicle control instruction is invalid.
     
    4. The method according to any one of claims 1 to 2, wherein the method further comprises:
    if the vehicle control instruction is invalid, outputting, by the in-vehicle controller, warning information, wherein the warning information is used to warn the instruction sending controller.
     
    5. The method according to any one of claims 1 to 2, wherein all of the current vehicle controller, another vehicle controller and the instruction sending controller comprise: a human machine interface (170) used by a human driver to control the vehicle, an automated driving system (130), or an intelligent transportation system.
     
    6. A control system for a vehicle, comprising an in-vehicle controller (710) and an execution unit (720), wherein
    the in-vehicle controller (710) is configured to: receive a vehicle control instruction, and determine a function level to which a control function corresponding to the vehicle control instruction belongs; and determine, according to the function level to which the control function corresponding to the vehicle control instruction belongs and an instruction sending controller that sends the vehicle control instruction, whether the vehicle control instruction is valid; and
    the execution unit (720) is configured to: execute the vehicle control instruction when the in-vehicle controller (710) determines that the vehicle control instruction is valid; or ignore the vehicle control instruction when the in-vehicle controller (710) determines that the vehicle control instruction is invalid, the control system characterised in that the function level to which the control function of the vehicle belongs comprises: a negotiation level, a control level, and a limited level; and
    when determining, according to the function level to which the control function corresponding to the vehicle control instruction belongs and the instruction sending controller that sends the vehicle control instruction, whether the vehicle control instruction is valid, the in-vehicle controller (710) is specifically configured to:

    if the control function corresponding to the vehicle control instruction belongs to the limited level, determine that the vehicle control instruction is invalid; or

    if the control function corresponding to the vehicle control instruction belongs to the control level, compare a priority of the instruction sending controller with a priority of a current vehicle controller, and if the priority of the instruction sending controller is higher than or equal to the priority of the current vehicle controller, determine that the vehicle control instruction is valid, or if the priority of the instruction sending controller is lower than the priority of the current vehicle controller, determine that the vehicle control instruction is invalid; or

    if the control function corresponding to the vehicle control instruction belongs to the negotiation level, compare a priority of the instruction sending controller with a priority of a current vehicle controller, and if the priority of the instruction sending controller is higher than or equal to the priority of the current vehicle controller, determine that the vehicle control instruction is valid and is used as a primary control instruction, so that the in-vehicle controller (710) is adapted to control the vehicle according to the primary control instruction using a secondary control instruction as a reference, or if the priority of the instruction sending controller is lower than the priority of the current vehicle controller, determine that the vehicle control instruction is valid and is used as a secondary control instruction, so that the in-vehicle controller (710) is adapted to control the vehicle according to a primary control instruction generated by the controller with the higher priority using the secondary control instruction as a reference.


     
    7. The system according to claim 6, wherein the in-vehicle controller (710) is further configured to:

    when the current vehicle controller cannot control the vehicle, request, according to priorities, another vehicle controller to participate in vehicle control;

    when determining that the another vehicle controller can participate in vehicle control, determine that a vehicle control instruction sent by the another vehicle controller is valid; and

    when determining that no other vehicle controllers can participate in vehicle control, perform emergency handling, wherein

    the priority of the vehicle controller is determined according to a driving mode of the vehicle and the function level to which the control function corresponding to the vehicle control instruction belongs, and the driving mode comprises automated driving and non-automated driving.


     
    8. The system according to any one of claims 6 to 7, wherein the in-vehicle controller (710) is further configured to:
    if execution of the vehicle control instruction causes the vehicle to be in danger, determine that the vehicle control instruction is invalid.
     
    9. The system according to any one of claims 6 to 7, wherein the in-vehicle controller (710) is further configured to:
    when the vehicle control instruction is invalid, output warning information, wherein the warning information is used to warn the instruction sending controller.
     


    Ansprüche

    1. Steuerungsverfahren für ein Fahrzeug, wobei das Fahrzeug eine fahrzeuginterne Steuerung und eine Ausführungseinheit umfasst; und das Verfahren Folgendes umfasst:

    Empfangen (S110, S210), durch die fahrzeuginterne Steuerung, einer Fahrzeugsteueranweisung, und Bestimmen (S220) einer Funktionsebene, zu der eine der Fahrzeugsteueranweisung entsprechende Steuerfunktion gehört;

    Bestimmen (S120), durch die fahrzeuginterne Steuerung, gemäß der Funktionsebene, zu der die der Fahrzeugsteueranweisung entsprechende Steuerfunktion gehört, und einer Befehlssendesteuerung, die die Fahrzeugsteueranweisung sendet, ob die Fahrzeugsteueranweisung gültig ist; und

    wenn die Fahrzeugsteueranweisung gültig ist, Anweisen (S130), durch die fahrzeuginterne Steuerung, der Ausführungseinheit, die Fahrzeugsteueranweisung auszuführen; oder wenn die Fahrzeugsteueranweisung ungültig ist, Ignorieren (S140), durch die fahrzeuginterne Steuerung, der Fahrzeugsteueranweisung,

    wobei das Steuerverfahren dadurch gekennzeichnet ist, dass:

    die Funktionsebene, zu der die der Fahrzeugsteueranweisung entsprechende Steuerfunktion gehört, umfasst: eine Verhandlungsebene, eine Steuerungsebene und eine eingeschränkte Ebene; und

    das Bestimmen (S220), durch die fahrzeuginterne Steuerung, gemäß der Funktionsebene, zu der die der Fahrzeugsteueranweisung entsprechende Steuerfunktion gehört, und einer Befehlssendesteuerung, die die Fahrzeugsteueranweisung sendet, ob die Fahrzeugsteueranweisung gültig ist, umfasst: wenn die der Fahrzeugsteueranweisung entsprechende Steuerfunktion zur eingeschränkten Ebene gehört, Bestimmen (S280), dass die Fahrzeugsteueranweisung ungültig ist; oder

    wenn die der Fahrzeugsteueranweisung entsprechende Steuerfunktion zur Steuerungsebene gehört, Vergleichen (S260) einer Priorität der Befehlssendesteuerung mit einer Priorität einer aktuellen Fahrzeugsteuerung, und wenn die Priorität der Befehlssendesteuerung höher oder gleich der Priorität der aktuellen Fahrzeugsteuerung ist, Bestimmen (S270), dass die Fahrzeugsteueranweisung gültig ist, oder wenn die Priorität der Befehlssendesteuerung niedriger ist als die Priorität der aktuellen Fahrzeugsteuerung, Bestimmen (S280), dass die Fahrzeugsteueranweisung ungültig ist; oder

    wenn die der Fahrzeugsteueranweisung entsprechende Steuerfunktion zur Verhandlungsebene gehört, Vergleichen (S230) einer Priorität der Befehlssendesteuerung mit einer Priorität einer aktuellen Fahrzeugsteuerung, und wenn die Priorität der Befehlssendesteuerung höher oder gleich der Priorität der aktuellen Fahrzeugsteuerung ist, Bestimmen (240), dass die Fahrzeugsteueranweisung gültig ist und als primäre Steueranweisung verwendet wird, so dass die fahrzeuginterne Steuerung das Fahrzeug gemäß der primären Steueranweisung unter Verwendung einer sekundären Steueranweisung als Referenz steuert, oder wenn die Priorität der Befehlssendesteuerung niedriger ist als die Priorität der aktuellen Fahrzeugsteuerung, Bestimmen (S250), dass die Fahrzeugsteueranweisung gültig ist und als sekundäre Steueranweisung verwendet wird, so dass die fahrzeuginterne Steuerung das Fahrzeug gemäß einer von der Steuerung mit der höheren Priorität erzeugten primären Steueranweisung unter Verwendung der sekundären Steueranweisung als Referenz steuert.


     
    2. Verfahren nach Anspruch 1, wobei das Verfahren ferner umfasst:

    wenn die aktuelle Fahrzeugsteuerung das Fahrzeug nicht steuern kann, Anfordern (S310), durch die fahrzeuginterne Steuerung gemäß Prioritäten, einer anderen Fahrzeugsteuerung zur Teilnahme an der Steuerung des Fahrzeugs;

    wenn bestimmt wird, dass die andere Fahrzeugsteuerung an der Steuerung des Fahrzeugs teilnehmen kann, Bestimmen (S320), durch die fahrzeuginterne Steuerung, dass eine von der anderen Fahrzeugsteuerung gesendete Fahrzeugsteueranweisung gültig ist; und

    wenn bestimmt wird, dass keine anderen Fahrzeugsteuerungen an der Steuerung des Fahrzeugs teilnehmen können, Durchführen (S330), durch die fahrzeuginterne Steuerung, von Notfallbehandlung.


     
    3. Verfahren nach einem der Ansprüche 1 bis 2, wobei das Verfahren ferner umfasst:
    wenn die Ausführung der Fahrzeugsteueranweisung dazu führt, dass das Fahrzeug in Gefahr ist, Bestimmen, durch die fahrzeuginterne Steuerung, dass die Fahrzeugsteueranweisung ungültig ist.
     
    4. Verfahren nach einem der Ansprüche 1 bis 2, wobei das Verfahren ferner umfasst:
    wenn die Fahrzeugsteueranweisung ungültig ist, Ausgeben, durch die fahrzeuginterne Steuerung, von Warninformationen, wobei die Warninformationen dazu verwendet werden, die Befehlssendesteuerung zu warnen.
     
    5. Verfahren nach einem der Ansprüche 1 bis 2, wobei alle von der aktuellen Fahrzeugsteuerung, einer anderen Fahrzeugsteuerung und der Befehlssendesteuerung umfassen: eine Mensch-Maschine-Schnittstelle (170), die von einem menschlichen Fahrer zum Steuern des Fahrzeugs verwendet wird, ein automatisiertes Fahrsystem (130) oder ein intelligentes Transportsystem.
     
    6. Steuerungssystem für ein Fahrzeug, umfassend eine fahrzeuginterne Steuerung (710) und eine Ausführungseinheit (720), wobei
    die fahrzeuginterne Steuerung (710) für Folgendes ausgelegt ist: Empfangen einer Fahrzeugsteueranweisung, und Bestimmen einer Funktionsebene, zu der eine der Fahrzeugsteueranweisung entsprechende Steuerfunktion gehört; und Bestimmen, gemäß der Funktionsebene, zu der die der Fahrzeugsteueranweisung entsprechende Steuerfunktion gehört, und einer Befehlssendesteuerung, die die Fahrzeugsteueranweisung sendet, ob die Fahrzeugsteueranweisung gültig ist; und die Ausführungseinheit (720) für Folgendes ausgelegt ist: Ausführen der Fahrzeugsteueranweisung, wenn die fahrzeuginterne Steuerung (710) bestimmt, dass die Fahrzeugsteueranweisung gültig ist; oder Ignorieren der Fahrzeugsteueranweisung, wenn die fahrzeuginterne Steuerung (710) bestimmt, dass die Fahrzeugsteueranweisung ungültig ist, wobei das Steuersystem dadurch gekennzeichnet ist, dass
    die Funktionsebene, zu der die Steuerfunktion des Fahrzeugs gehört, umfasst: eine Verhandlungsebene, eine Steuerungsebene und eine eingeschränkte Ebene; und beim Bestimmen, gemäß der Funktionsebene, zu der die der Fahrzeugsteueranweisung entsprechende Steuerfunktion gehört, und der Befehlssendesteuerung, die die Fahrzeugsteueranweisung sendet, ob die Fahrzeugsteueranweisung gültig ist, die fahrzeuginterne Steuerung (710) spezifisch für Folgendes ausgelegt ist:

    wenn die der Fahrzeugsteueranweisung entsprechende Steuerfunktion zur eingeschränkten Ebene gehört, Bestimmen, dass die Fahrzeugsteueranweisung ungültig ist; oder

    wenn die der Fahrzeugsteueranweisung entsprechende Steuerfunktion zur Steuerungsebene gehört, Vergleichen einer Priorität der Befehlssendesteuerung mit einer Priorität einer aktuellen Fahrzeugsteuerung, und wenn die Priorität der Befehlssendesteuerung höher oder gleich der Priorität der aktuellen Fahrzeugsteuerung ist, Bestimmen, dass die Fahrzeugsteueranweisung gültig ist, oder wenn die Priorität der Befehlssendesteuerung niedriger ist als die Priorität der aktuellen Fahrzeugsteuerung, Bestimmen, dass die Fahrzeugsteueranweisung ungültig ist; oder

    wenn die der Fahrzeugsteueranweisung entsprechende Steuerfunktion zur Verhandlungsebene gehört, Vergleichen einer Priorität der Befehlssendesteuerung mit einer Priorität einer aktuellen Fahrzeugsteuerung, und wenn die Priorität der Befehlssendesteuerung höher oder gleich der Priorität der aktuellen Fahrzeugsteuerung ist, Bestimmen, dass die Fahrzeugsteueranweisung gültig ist und als primäre Steueranweisung verwendet wird, so dass die fahrzeuginterne Steuerung (710) zum Steuern des Fahrzeugs gemäß der primären Steueranweisung unter Verwendung einer sekundären Steueranweisung als Referenz eingerichtet ist, oder wenn die Priorität der Befehlssendesteuerung niedriger ist als die Priorität der aktuellen Fahrzeugsteuerung, Bestimmen, dass die Fahrzeugsteueranweisung gültig ist und als sekundäre Steueranweisung verwendet wird, so dass die fahrzeuginterne Steuerung (710) zum Steuern des Fahrzeugs gemäß einer von der Steuerung mit der höheren Priorität erzeugten primären Steueranweisung unter Verwendung der sekundären Steueranweisung als Referenz eingerichtet ist.


     
    7. System nach Anspruch 6, wobei die fahrzeuginterne Steuerung (710) ferner für Folgendes ausgelegt ist: wenn die aktuelle Fahrzeugsteuerung das Fahrzeug nicht steuern kann, Anfordern, gemäß Prioritäten, einer anderen Fahrzeugsteuerung zur Teilnahme an der Steuerung des Fahrzeugs;
    wenn bestimmt wird, dass die andere Fahrzeugsteuerung an der Steuerung des Fahrzeugs teilnehmen kann, Bestimmen, dass eine von der anderen Fahrzeugsteuerung gesendete Fahrzeugsteueranweisung gültig ist; und
    wenn bestimmt wird, dass keine anderen Fahrzeugsteuerungen an der Steuerung des Fahrzeugs teilnehmen können, Durchführen von Notfallbehandlung, wobei die Priorität der Fahrzeugsteuerung gemäß einer Fahrbetriebsart des Fahrzeugs und der Funktionsebene, zu der die der Fahrzeugsteueranweisung entsprechende Steuerfunktion gehört, bestimmt wird, und die Fahrbetriebsart automatisiertes Fahren und nicht-automatisiertes Fahren umfasst.
     
    8. System nach einem der Ansprüche 6 bis 7, wobei die fahrzeuginterne Steuerung (710) ferner für Folgendes ausgelegt ist:
    wenn die Ausführung der Fahrzeugsteueranweisung dazu führt, dass das Fahrzeug in Gefahr ist, Bestimmen, dass die Fahrzeugsteueranweisung ungültig ist.
     
    9. System nach einem der Ansprüche 6 bis 7, wobei die fahrzeuginterne Steuerung (710) ferner für Folgendes ausgelegt ist:
    wenn die Fahrzeugsteueranweisung ungültig ist, Ausgeben von Warninformationen, wobei die Warninformationen dazu verwendet werden, die Befehlssendesteuerung zu warnen.
     


    Revendications

    1. Procédé de commande pour un véhicule, le véhicule comprenant un dispositif de commande embarqué et une unité d'exécution ; et le procédé comprenant :

    la réception (S110, S210), par le dispositif de commande embarqué, d'une instruction de commande de véhicule, et la détermination (S220) d'un niveau de fonction auquel appartient une fonction de commande correspondant à l'instruction de commande de véhicule ;

    la détermination (S 120), par le dispositif de commande embarqué, en fonction du niveau de fonction auquel appartient la fonction de commande correspondant à l'instruction de commande de véhicule et d'un dispositif de commande d'envoi d'instructions qui envoie l'instruction de commande de véhicule, du fait que l'instruction de commande de véhicule est valide ou non ; et

    si l'instruction de commande de véhicule est valide, le fait de donner pour instruction (S130), par le dispositif de commande embarqué, à l'unité d'exécution d'exécuter l'instruction de commande de véhicule ; ou si l'instruction de commande de véhicule est invalide, le fait d'ignorer (S1140), par le dispositif de commande embarqué, l'instruction de commande de véhicule,

    le procédé de commande étant caractérisé en ce que

    le niveau de fonction auquel appartient la fonction de commande correspondant à l'instruction de commande de véhicule comprend : un niveau de négociation, un niveau de commande et un niveau limité ; et

    la détermination (S220), par le dispositif de commande embarqué, en fonction du niveau de fonction auquel appartient la fonction de commande correspondant à l'instruction de commande de véhicule et d'un dispositif de commande d'envoi d'instructions qui envoie l'instruction de commande de véhicule, du fait que l'instruction de commande de véhicule est valide ou non comprend :

    si la fonction de commande correspondant à l'instruction de commande de véhicule appartient au niveau limité, la détermination (S280) que l'instruction de commande de véhicule est invalide ; ou

    si la fonction de commande correspondant à l'instruction de commande de véhicule appartient au niveau de commande, la comparaison (S260) d'une priorité du dispositif de commande d'envoi d'instructions avec une priorité d'un dispositif de commande de véhicule actuel, et si la priorité du dispositif de commande d'envoi d'instructions est supérieure ou égale à la priorité du dispositif de commande de véhicule actuel, la détermination (S270) que l'instruction de commande de véhicule est valide, ou si la priorité du dispositif de commande d'envoi d'instructions est inférieure à la priorité du dispositif de commande de véhicule actuel, la détermination (S280) que l'instruction de commande de véhicule est invalide ; ou

    si la fonction de commande correspondant à l'instruction de commande de véhicule appartient au niveau de négociation, la comparaison (S230) d'une priorité du dispositif de commande d'envoi d'instructions avec une priorité d'un dispositif de commande de véhicule actuel, et si la priorité du dispositif de commande d'envoi d'instructions est supérieure ou égale à la priorité du dispositif de commande de véhicule actuel, la détermination (240) que l'instruction de commande de véhicule est valide et est utilisée comme instruction de commande primaire, de sorte que le dispositif de commande embarqué commande le véhicule en fonction de l'instruction de commande primaire en utilisant une instruction de commande secondaire comme référence, ou si la priorité du dispositif de commande d'envoi d'instructions est inférieure à la priorité du dispositif de commande de véhicule actuel, la détermination (S250) que l'instruction de commande de véhicule est valide et est utilisée comme instruction de commande secondaire, de sorte que le dispositif de commande embarqué commande le véhicule en fonction d'une instruction de commande primaire générée par le dispositif de commande avec la priorité supérieure, en utilisant l'instruction de commande secondaire comme référence.


     
    2. Procédé selon la revendication 1, le procédé comprenant en outre :

    lorsque le dispositif de commande de véhicule actuel ne peut pas commander le véhicule, la demande (S310), par le dispositif de commande embarqué en fonction de priorités, à un autre dispositif de commande de véhicule de participer à la commande de véhicule ;

    lors de la détermination que l'autre dispositif de commande de véhicule peut participer à la commande de véhicule, la détermination (S320), par le dispositif de commande embarqué, qu'une instruction de commande de véhicule envoyée par l'autre dispositif de commande de véhicule est valide ; et

    lors de la détermination qu'aucun autre dispositif de commande de véhicule ne peut participer à la commande de véhicule, la réalisation (S330), par le dispositif de commande embarqué, d'un traitement d'urgence.


     
    3. Procédé selon l'une quelconque des revendications 1 et 2, le procédé comprenant en outre :
    si l'exécution de l'instruction de commande de véhicule amène le véhicule à être en danger, la détermination, par le dispositif de commande embarqué, que l'instruction de commande de véhicule est invalide.
     
    4. Procédé selon l'une quelconque des revendications 1 et 2, le procédé comprenant en outre :
    si l'instruction de commande de véhicule est invalide, l'émission, par le dispositif de commande embarqué, d'informations d'avertissement, les informations d'avertissement étant utilisées pour avertir le dispositif de commande d'envoi d'instructions.
     
    5. Procédé selon l'une quelconque des revendications 1 et 2, tous les dispositifs de commande parmi le dispositif de commande de véhicule actuel, un autre dispositif de commande de véhicule et le dispositif de commande d'envoi d'instructions comprenant : une interface homme-machine (170) utilisée par un conducteur humain pour commander le véhicule, un système de conduite automatique (130), ou un système de transport intelligent.
     
    6. Système de commande pour un véhicule, comprenant un dispositif de commande embarqué (710) et une unité d'exécution (720),
    le dispositif de commande embarqué (710) étant configuré pour : recevoir une instruction de commande de véhicule, et déterminer un niveau de fonction auquel appartient une fonction de commande correspondant à l'instruction de commande de véhicule ; et déterminer, en fonction du niveau de fonction auquel appartient la fonction de commande correspondant à l'instruction de commande de véhicule et d'un dispositif de commande d'envoi d'instructions qui envoie l'instruction de commande de véhicule, si l'instruction de commande de véhicule est valide ; et
    l'unité d'exécution (720) étant configurée pour : exécuter l'instruction de commande de véhicule lorsque le dispositif de commande embarqué (710) détermine que l'instruction de commande de véhicule est valide ; ou ignorer l'instruction de commande de véhicule lorsque le dispositif de commande embarqué (710) détermine que l'instruction de commande de véhicule est invalide, le système de commande étant caractérisé en ce que
    le niveau de fonction auquel appartient la fonction de commande du véhicule comprend : un niveau de négociation, un niveau de commande et un niveau limité ; et lors de la détermination, en fonction du niveau de fonction auquel appartient la fonction de commande correspondant à l'instruction de commande de véhicule et du dispositif de commande d'envoi d'instructions qui envoie l'instruction de commande de véhicule, du fait que l'instruction de commande de véhicule est valide ou non, le dispositif de commande embarqué (710) est configuré spécifiquement pour :

    si la fonction de commande correspondant à l'instruction de commande de véhicule appartient au niveau limité, déterminer que l'instruction de commande de véhicule est invalide ; ou

    si la fonction de commande correspondant à l'instruction de commande de véhicule appartient au niveau de commande, comparer une priorité du dispositif de commande d'envoi d'instructions avec une priorité d'un dispositif de commande de véhicule actuel, et si la priorité du dispositif de commande d'envoi d'instructions est supérieure ou égale à la priorité du dispositif de commande de véhicule actuel, déterminer que l'instruction de commande de véhicule est valide, ou si la priorité du dispositif de commande d'envoi d'instructions est inférieure à la priorité du dispositif de commande de véhicule actuel, déterminer que l'instruction de commande de véhicule est invalide ; ou

    si la fonction de commande correspondant à l'instruction de commande de véhicule appartient au niveau de négociation, comparer une priorité du dispositif de commande d'envoi d'instructions avec une priorité d'un dispositif de commande de véhicule actuel, et si la priorité du dispositif de commande d'envoi d'instructions est supérieure ou égale à la priorité du dispositif de commande de véhicule actuel, déterminer que l'instruction de commande de véhicule est valide et est utilisée comme instruction de commande primaire, de sorte que le dispositif de commande embarqué (710) est adapté pour commander le véhicule en fonction de l'instruction de commande primaire en utilisant une instruction de commande secondaire comme référence, ou si la priorité du dispositif de commande d'envoi d'instructions est inférieure à la priorité du dispositif de commande de véhicule actuel, déterminer que l'instruction de commande de véhicule est valide et est utilisée comme instruction de commande secondaire, de sorte que le dispositif de commande embarqué (710) est adapté pour commander le véhicule en fonction d'une instruction de commande primaire générée par le dispositif de commande avec la priorité supérieure en utilisant l'instruction de commande secondaire comme référence.


     
    7. Système selon la revendication 6, le dispositif de commande embarqué (710) étant en outre configuré pour :

    lorsque le dispositif de commande de véhicule actuel ne peut pas commander le véhicule, demander, en fonction de priorités, à un autre dispositif de commande de véhicule de participer à la commande de véhicule ;

    lors de la détermination que l'autre véhicule peut participer à la commande de véhicule, déterminer qu'une instruction de commande de véhicule envoyée par l'autre dispositif de commande de véhicule est valide ; et

    lors de la détermination qu'aucun autre dispositif de commande de véhicule ne peut participer à la commande de véhicule, réaliser un traitement d'urgence,

    la priorité du dispositif de commande de véhicule étant déterminée en fonction d'un mode de conduite du véhicule et du niveau de fonction auquel appartient la fonction de commande correspondant à l'instruction de commande de véhicule, et le mode de conduite comprenant la conduite automatique et la conduite non-automatique.


     
    8. Système selon l'une quelconque des revendications 6 et 7, le dispositif de commande embarqué (710) étant en outre configuré pour :
    si l'exécution de l'instruction de commande de véhicule amène le véhicule à être en danger, déterminer que l'instruction de commande de véhicule est invalide.
     
    9. Système selon l'une quelconque des revendications 6 et 7, le dispositif de commande embarqué (710) étant en outre configuré pour :
    lorsque l'instruction de commande de véhicule est invalide, émettre des informations d'avertissement, les informations d'avertissement étant utilisées pour avertir le dispositif de commande d'envoi d'instructions.
     




    Drawing


















    REFERENCES CITED IN THE DESCRIPTION



    This list of references cited by the applicant is for the reader's convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard.

    Patent documents cited in the description