Safety system for a vehicle of a vehicle fleet

A pre-crash system has at least one dummy actuator and an adaptive pre-trigger function that is implemented with different parameter sets as a function of a current degree of validation, and evaluates the acquired physical quantities for pre-crash recognition in order to recognize an unavoidable crash, a first parameter set, which limits the pre-trigger function to a dummy operating mode in which the pre-trigger function produces at least one trigger signal for the dummy actuator if the evaluation of the physical quantities permits the inference of an unavoidable crash, being implemented until the current degree of validation satisfies a specified condition, the pre-trigger function comparing the triggering of the dummy actuator with the behavior of the evaluation and control unit, and, as a function of the comparison, rating the triggering of the dummy actuator as “correct” or as a “false positive.”

FIELD

The present invention is based on a safety system for a vehicle of a fleet of vehicles, and on a corresponding system for validating a pre-trigger function for safety systems in vehicles of a fleet of vehicles.

BACKGROUND INFORMATION

Irreversible actuators of personal protection devices for passive safety systems in vehicles, such as pyrotechnic safety belts and airbags, are today generally triggered on the basis of a contact sensor system. Reversible actuators of personal protection devices, such as electromotoric safety belts, are today triggered already in a pre-crash phase, on the basis of an environmental sensor system such as radar, video, or amalgamated systems. The triggering of the irreversible actuators requires a very high degree of robustness. This is a result of the high safety demands regarding “false triggerings” (false positives) based on the assessment of risk, and of the very low degree of acceptance of false positives, because even apart from the safety risk, false positives require repair, which is costly and exasperating.

A timely recognition of an unavoidable collision required for the irreversible triggering of pyrotechnic actuators in the pre-trigger region of approximately 80 to 40 ms before impact can be realized for many crash situations using today's environmental sensor systems. The basis for this is provided by conventional pre-crash functions and automatic emergency braking functions.

However, these conventional systems are for example designed such that adequate validation performance for avoiding false interventions or false positives requires a standard of less than one time over the life of the vehicle. For pre-trigger functions, a much higher robustness requirement against false positives is indicated, which is at least three orders of magnitude below the current degree of validation for false interventions or false positives.

In conventional so-called black box validation, driving in the field takes place with a prototype system for so many hours that the corresponding degree of robustness can be reliably set when no false positive has occurred in this time span. If the required robustness is for example less than 10−5errors/operating hour, then driving takes place in the field with the prototype system for 105operating hours. For mass production, this cannot be done for the required order of magnitude of the pre-triggering function.

SUMMARY

An example safety system according to the present invention for a vehicle of a vehicle fleet, and an example system according to the present invention for validating a pre-trigger function for safety systems in vehicles of a vehicle fleet may have the advantage that both software components or parameters of the algorithm for crash recognition, and also software components or parameters of the pre-crush function for controlling actuators in the case of a recognized or impending crash, can be activated retroactively, i.e., after installation. Here, the software components for crash recognition basically become active but are evaluated with different parameters using dummy actuators until a specified degree of robustness can be ascertained. When this is the case, the algorithms, with optimal parameterization, are released for intervention with respect to the real actuators.

In the exemplary embodiments of the present invention, algorithms that pursue the goal of recognizing an unavoidable crash are based on the same basic idea, but are differently realized, or parameterized, as a function of required recognition rate, recognition time, and robustness. Thus, given a low degree of validation, the first parameter set enables only uncritical interventions with reversible measures, or interventions with a greater limitation of the field of action, in order to provide a high degree of robustness even when there is a low degree of validation. Given a high degree of validation, the second parameter set enables the activation of interventions having a higher safety risk, or of irreversible measures and interventions with a broader field of action, because these are made secure by the high degree of validation.

Specific embodiments of the present invention provide a safety system for a vehicle of a vehicle fleet having a personal protection device, a contact sensor system for acquiring at least one physical quantity relevant to an impact, a pre-crash system that includes an environmental sensor system for acquiring at least one physical quantity relevant to a crash in the environment of the vehicle, and an evaluation and control unit, which evaluates the physical quantities acquired by the contact sensor system and by the environmental sensor system for impact recognition and for pre-crash recognition, and, as a function of the evaluation and of specified parameters, controls at least one actuator of the personal protection device. According to the present invention, the pre-crash system has at least one dummy actuator and an adaptive pre-trigger function that is implemented with different parameter sets as a function of the current degree of validation, and that evaluates the acquired physical quantities for pre-crash recognition in order to recognize an unavoidable crash, a first parameter set, which limits the pre-trigger function to a dummy operating mode in which the pre-trigger function produces at least one trigger signal for the dummy actuator if the evaluation of the physical quantities permits the inference of an unavoidable crash, being implemented until the current degree of validation satisfies a specified condition, the pre-trigger function comparing the triggering of the dummy actuator with the behavior of the evaluation and control unit, and, as a function of the comparison, rating the triggering of the dummy actuator as “correct” or as a “false positive.”

In the automatic comparison, the triggering that takes place of the dummy actuator is compared for example to the signals of the contact sensor system (inertial sensor system) present in the vehicle. If, after a pre-crash triggering of the dummy actuator by the pre-trigger function, the contact or inertial sensor system has measured an acceleration impulse that has for example caused the evaluation and control unit to trigger a safety belt, this triggering can then be stored as “correct” or as a “true positive” event. If such an acceleration impulse is not present, then a “false triggering” or “false positive” event has occurred, which is stored.

In addition, a system for validating a pre-trigger function for safety systems according to the present invention in vehicles of a vehicle fleet is proposed that includes a central unit having a computer system, a second communication device, and storage device. Here, the computer system communicates with the vehicles of the fleet via the second communication device, and exchanges data with the vehicles. The computer system of the central unit receives the ratings of triggerings of the dummy actuators and/or the sum of the operating hours of vehicles of the vehicle fleet. The computer system stores this information in the storage device. In addition, the computer system evaluates this information in order to calculate the current degree of validation of the pre-trigger function, and to check the first parameter set.

Through the measures and developments described herein, advantageous improvements are possible of the safety system described herein for a vehicle of a fleet and of the system described herein for validating a pre-trigger function for safety systems in vehicles of a fleet.

It is particularly advantageous that the pre-trigger function can include a data recorder that stores the ratings of the triggering of the dummy actuator and sums the operating hours.

In an advantageous embodiment of the safety system according to the present invention, the pre-trigger function can include a first communication device via which the rating of the triggering of the dummy actuator and/or the sum of the operating hours can be transmitted to a central unit. In addition, the first communication device can receive an updated first parameter set or a second parameter set from the central unit and can provide it to the pre-trigger function. Here, the second parameter set enables an operation of the pre-trigger function in accordance with its intended functioning, in which the pre-trigger function produces triggering signals for the at least one actuator of the personal protection device.

In an advantageous embodiment of the system according to the present invention, as needed the computer system can ascertain the number of “false positives” of the dummy actuators in vehicles of the vehicle fleet, and can ascertain the sum of the operating hours of these vehicles of the fleet, and calculates the current degree of validation of the pre-trigger function as the number of “false positives” of the dummy actuators in the vehicles for a time unit. The computer system can compare the calculated current degree of validation of the pre-trigger function with a specified threshold value that represents a required degree of robustness of the pre-trigger function. Here, the computer system can output the second parameter set to vehicles of the vehicle fleet when the number of “false positives” of the dummy actuators in the vehicles for a time unit is below the specified threshold value.

In a further advantageous embodiment of the system according to the present invention, the computer system can communicate with the first communication devices of the vehicles of the vehicle fleet via the second communication device directly, or via a third communication device. The third communication device can for example be located in a workshop and can read out the data recorder of the pre-trigger function via the first communication device during a diagnosis. The communication devices are preferably realized as IP (Internet protocol) nodes. The authorization or parameterization of software components of the pre-trigger function takes place for example via a wireless radio connection with an IP node in the respective vehicle of the vehicle fleet and a download function that can be authorized and that is protected. Alternatively, the authorization or parameterization of software components of the pre-trigger function can take place via a diagnostic tool in the workshop, for example during regular service sessions or facelifts. The reading out of the data collected in the vehicles of the fleet can for example also take place via a wireless radio connection with IP nodes in the respective vehicle of the fleet, or via the diagnostic interface when in the workshop. In addition, the individual vehicles can transmit the collected data periodically or after a triggering of the dummy actuator via a radio connection to a cloud or to a server in the central unit. The central unit can for example be set up by the vehicle manufacturer, a supplier, or a service provider that can continuously evaluate the collected data. Because the authorization or parameterization of software components of the pre-trigger function is an activation of safety-critical functions, the activation takes place in protected fashion and only via an authorized agent, regardless of the form in which it takes place.

An exemplary embodiment of the present invention is shown in the FIGURE and is explained in more detail below. In the FIGURE, identical reference characters designate components or elements that perform the same or analogous functions.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

As can be seen inFIG. 1, a vehicle fleet1comprises a plurality of vehicles of which three vehicles1A,1B,1C are shown as examples. Each of these vehicles1A,1B,1C has a safety system2that is shown in more detail in a first vehicle1A of vehicle fleet1.

As is further visible inFIG. 1, safety system2includes personal protection devices7, a contact sensor system4for acquiring at least one physical quantity relevant to impacts, a pre-crash system10that includes an environmental sensor system3for acquiring at least one crash-relevant physical quantity in the environment surrounding the vehicle, and an evaluation and control unit5.1that evaluates the physical quantities acquired by contact sensor system4and by environmental sensor system3for impact recognition and for pre-crash recognition, and, as a function of the evaluation and of specified parameters, controls at least one actuator14A,14B,14C of personal protection devices7. According to the present invention, pre-crash system10has at least one dummy actuator14D and an adaptive pre-trigger function12that is implemented with different parameter sets as a function of the current degree of validation, and that evaluates the acquired physical quantities for pre-crash recognition in order to recognize an unavoidable crash, a first parameter set, which limits pre-trigger function12to a dummy operating mode in which pre-trigger function12produces at least one triggering signal for dummy actuator14D if the evaluation of the physical quantities permits the inference that a crash is unavoidable, being implemented until the current degree of validation satisfies a specified condition, pre-trigger function12comparing the triggering of dummy actuator14D with the behavior of evaluation and control unit5.1, and, as a function of the comparison, rating the triggering of dummy actuator14D as “correct” or as a “false positive.” In the depicted exemplary embodiment, in the dummy operation enabled by the first parameter set, given a low degree of validation for example only uncritical interventions with reversible measures or interventions with a stronger limitation of the field of action are possible, in order in this way to provide a high degree of robustness of safety system2even when there is a low degree of validation.

In the depicted exemplary embodiment, pre-trigger function12includes a data recorder18that stores the rating of the triggering of dummy actuator14D and that sums the operating hours, and a first communication device16via which the rating of the triggering of dummy actuator14D and/or the sum of the operating hours can be transmitted to a central unit20. In addition, first communication device16receives an updated first parameter set or a second parameter set from central unit20, and provides it to pre-trigger function12. The second parameter set enables operation of pre-trigger function12in accordance with its intended function, in which pre-trigger function12produces triggering signals for the at least one actuator14A,14B,14C of personal protection devices7.

As is also visible inFIG. 1, personal protection devices7include reversible restraint devices7.1such as electromotoric safety belts or active engine hoods that are triggered by a first actuator14A, irreversible restraint devices7.2, such as interior and/or exterior airbags, triggered by a second pyrotechnic actuator14B, and adaptive crash structures7.3triggered by a third actuator14C. In addition, actuators can be provided that carry out active interventions in the vehicle brake system, steering, chassis, and/or suspension system, and/or that produce an additional braking effect.

Environmental sensor system3includes for example radar, video, ultrasound, or lidar systems for acquiring the crash-relevant physical quantities in the environment surrounding the vehicle. Contact sensor system4includes for example pressure and/or acceleration sensors for acquiring the impact-relevant physical quantities. Evaluation and control unit5.1and the components of pre-crash system10are implemented in a common control device5in the depicted exemplary embodiment. In addition, evaluation and control unit5.1and pre-trigger function12can combine arbitrary data from sensor information from environmental sensor system3and from contact sensor system4in order to recognize an impending impact. Thus, for example using an intelligent data fusion of at least two physically redundant sensor signals from environmental sensor system3, such as radar signals, that are suitable for location and speed measurements, and video signals that are suitable for object classification, an adequately good and reliable pre-crash recognition can be provided. However, even if such an estimation shows this possibility of pre-crash recognition, the requirement of secure validation of safety system2according to the present invention against undesired false positives remains.

Therefore, the depicted system for validating a pre-trigger function12for safety systems2in vehicles1A,1B,1C of a fleet of vehicles1includes a central unit20that includes a computer system22, a second communication device24, and storage device28. Computer system22communicates with vehicles1A,1B,1C of vehicle fleet1via second communication device24, and exchanges data with vehicles1A,1B,1C of vehicle fleet1. Computer system22receives the ratings of triggerings of dummy actuators14D and/or the sum of the operating hours of vehicles1A,1B,1C of vehicle fleet1, stores these data in storage device28, and evaluates these data in order to calculate the current degree of validation of pre-trigger function12and to check the first parameter set.

Computer system22ascertains as needed the number of “false positives” of dummy actuators14D in vehicles1A,1B,1C of vehicle fleet1, and the sum of the operating hours of these vehicles1A,1B,1C of vehicle fleet1, and calculates the current degree of validation of pre-trigger function12as the number of “false positives” of dummy actuators14D in vehicles1A,1B,1C of vehicle fleet1for a time unit. Computer system22compares the calculated current degree of validation of pre-trigger function12with a specified threshold value that represents a required degree of robustness of pre-trigger function12. Here, computer system22outputs the second parameter set to vehicles1A,1B,1C of vehicle fleet1if the number of “false positives” of dummy actuators14D in vehicles1A,1B,1C is below the specified threshold value for a time unit. Given a high degree of validation, the second parameter set enables the activation of interventions with a higher safety risk, or of irreversible measures and interventions with a broader field of action, because these are made secure by the high degree of validation.

As can also be seen inFIG. 1, computer system22can communicate with first communication devices16of vehicles1A,1B,1C of vehicle fleet1via second communication device24directly or via a third communication device26. Third communication device26can be situated for example in a workshop, and can read out data recorder18of pre-trigger function12via first communication device16during a diagnosis.

In the depicted exemplary embodiment, communication devices16,24,26are each realized as IP nodes. This advantageously enables the authorization or parameterization of software components of pre-trigger function12through a corresponding communication connection between second communication device24or third communication device26with first communication device16in vehicle1A,1B,1C with an authorized and protected download function. In this way, the parameter sets can be transmitted from central unit20, for example directly via second communication connection24to first communication device16, or indirectly via second communication connection24and third communication connection26to first communication device16. In addition, the data can be exchanged between central unit20and vehicles1A,1B,1C of vehicle fleet1via a cloud. Because this is an activation of safety-critical functions, the data transmission takes place in protected fashion and only through an authorized agent, regardless of the form in which it takes place. Central unit20can for example be set up by the vehicle manufacturer, a supplier, or a service provider that can continuously evaluate the collected data.