Vehicle control device and vehicle control system

Abstract

Vehicle control device (2) which performs control of a vehicle and includes a detection device (6) which includes a sensor provided on a carrier vehicle and a communication device (3) which performs communication to the outside, wherein the vehicle control device (2) comprises the following: a control module (601) for automatic driving that generates path information using input information from the detection device (6) and / or the communication device (3); and a safety prediction module (602) that is independent of the automatic driving control module (601) that performs a safety determination based on path information generated by the automatic driving control module (601) and a safety prediction map as a result of a behavior prediction of a surrounding object using input information from the detection device (6) and / or the communication device (3), outputs path information if a result of the safety determination is safe, and safety prediction path information, which is path information generated based on input information from the detection device (6) and / or the communication device (3), and outputs the safety prediction map if a result of the safety determination is not safe, wherein the vehicle control device (2) is characterized in that, for predicting the behavior of a surrounding object, only a behavior prediction necessary for determining safety is carried out by the safety prediction module (602), in comparison to a behavior prediction of a surrounding object in the control module (601) for automatic driving.

Description

Technical field

[0001] The present invention relates to a vehicle control device and a vehicle control system. Technical background

[0002] As technical background in the present technical field, JP 2018-62244 A (PTL 1) is available. This PTL 1 has the task of "calculating an ideal driving route that is superior in terms of driving efficiency and comfort during automatic driving or driver assistance" and discloses as one solution a vehicle control device, wherein "a vehicle control device 10 is mounted on a carrier vehicle 11 and is configured to perform automatic driving or driver assistance. This vehicle control device 10 includes a left / right boundary line generation unit 100, which calculates a left and a right boundary line LB and RB in a motion path along which the carrier vehicle 11 moves."Furthermore, the vehicle control device 10 has a generating unit 110 for ideal routes, which sets a restriction point X, which the carrier vehicle 11 passes, within a region of the left and right boundary lines LB and RB, and furthermore calculates an ideal route IDR on which the curvature, distance traveled, and difference from the centerline with the restriction point X as a dependency condition are minimized. PTL 2 further describes a collision detection device for vehicles on curved planned routes. It uses a polar coordinate system whose origin is located at the center of the arc.

[0003] A fan-shaped cover representing the vehicle contour is defined, and it is determined whether the object's path enters the temporal occupancy area of ​​this cover with respect to the radius vector and subsequently with respect to the polar angle, in order to detect a collision. PTL 3 describes a transmitter and receiver for driver assistance information. A transmitter uses sensors to detect the environment and calculates "safe zones" at various times, in which no obstacles are suspected. Instead of transmitting the entire area, it calculates the change in the safe zone over time. This change information is sent along with position and time data to reduce the amount of communication data. PTL 4 describes a method for managing driving mode changes in vehicles. Both vehicle dynamics control units (e.g., steering, engine) and environmental control units (e.g., lights, sound) receive a request to change the mode.Each device independently selects criteria for modification. Dynamic devices validate feasibility based on their state and stability / comfort conditions (such as steering torque / angle fluctuations). Reference list. Patent literature PTL 1: JP 2018-62244 A PTL 2: JP 2017 - 154 516 A PTL 3: JP 2017 - 091042 A PTL 4: JP 6 740 248 B2 Summary of the invention: Technical problem

[0004] The aforementioned state of the art does not describe a method for improving the reusability of the system by making all structures of a logical architecture of a layered system for automated driving independently operable.

[0005] In particular, in an automated driving system and a driver assistance system, the aspect of safety is important, and it is important to reuse a module with regard to safety between several products, to reduce development costs and to improve reliability through operational results.

[0006] Furthermore, since the control processing of an automatic driving system is complex, there is a possibility that an error may be present, and it is important to ensure safety even if such an error occurs.

[0007] The present invention was made in view of the above circumstances and an object of the present invention is to provide a vehicle control device and a vehicle control system that ensure the safety of an automatic driving system and enable the construction of an automatic driving system that can be easily reused. Solution to the problem

[0008] The invention relates to a vehicle control device comprising the features of claims 1, 6 and 7, and a vehicle control system comprising the features of claim 10. Advantageous embodiments of the invention are the subject of the dependent claims. Advantageous effects of the invention

[0009] According to the present invention for a logical architecture, by combining a control module for automatic driving that outputs path information for performing automatic driving, a safety prediction module that is independent of the control module for automatic driving, performs a behavior prediction of an object and performs a safety determination of the path information output by the control module for automatic driving or of user operating information, and a safety condition determination module that performs a safety condition determination for the path information output from the safety prediction module and outputs path information, it is possible to create an automatic driving system in which reuse is simple and the safety of an automatic driving system can be provided as needed.

[0010] A task, a configuration and an advantageous effect other than those described above are explained in the description of embodiments described below. Brief description of the drawings [ Fig. 1] Fig. 1 is an example of a vehicle system. [ Fig. 2] Fig. Figure 2 is an example of a physical architecture of a vehicle control system. [ Fig. 3] Fig. 3 is a configuration example of an ECU. [ Fig. 4] Fig. 4 is a configuration example of a software component. [ Fig. 5] Fig. 5 is an example of a logical architecture of the vehicle control system. [ Fig. 6] Fig. 6(a) is an example of environment detection and Fig. 6(b) is an example of an environment detection map. [ Fig. 7] Fig. 7 is an example of railway information. [ Fig. 8] Fig. 8(a) is an example of railway information and Fig. 8(b) is an example of route guidance area information and railway information. [ Fig. 9] Fig. 9 is an example of environment detection. [ Fig. 10] Fig. 10 is an example of a security forecast map. [ Fig. 11] Fig. 11 is an example of safety forecast orbit information. [ Fig. 12] Fig. 12 is an example of a flowchart for a security prediction determination unit. [ Fig. 13] Fig. Figure 13 is an example of a logical architecture of a vehicle control system based on a change in a module configuration. [ Fig. 14] Fig. Figure 14 is another example of the logical architecture of the vehicle control system based on a change in a module configuration. [ Fig. 15] Fig. 15(a) and Fig. 15(b) are examples of the arrangement of the logical architecture of the vehicle control system in the physical architecture. [ Fig. 16] Fig. Figure 16 is an example of the logical architecture of the vehicle control system according to a second embodiment. Description of the embodiments

[0011] An embodiment (an example) suitable for the present invention is described below with reference to the drawings. The present embodiment mainly describes an evaluation device for a vehicle control system and is suitable for performing the evaluation of a vehicle system equipped with the vehicle control system. However, its use for other purposes is not prohibited. [First embodiment]<Konfiguration des Fahrzeugsteuersystems>

[0012] A configuration of a vehicle control system (a vehicle control device) for evaluation is shown. Fig. Figure 1 is an overview of a vehicle system comprising the vehicle control system (the vehicle control device) according to the present embodiment.

[0013] The diagram shows a vehicle system 1, which includes an internal vehicle control system, such as a passenger car; a vehicle control system 2, which includes, for example, an in-vehicle network (a control unit area network (CAN), a flexible data rate CAN (CANFD), Ethernet (registered trademark), and the like) and a control unit (an electronic control unit (ECU), and the like); a communication device 3, which enables communication with the outside of the vehicle system 1 using a radio communication protocol (e.g., cellular communication, wireless LAN, WAN, C2X (vehicle-to-X: communication between vehicles or between vehicles and infrastructure)), and the like.of the carrier vehicle) or performs communication using the Global Positioning System (GPS) and the Global Navigation Satellite System (GNSS) to acquire, transmit, and the like of external information (from infrastructure, other vehicles, a map) or information relating to the carrier vehicle, or has a diagnostic port (OBD), an Ethernet port, a port for an external recording medium (e.g., a USB storage device, an SD card, or the like), and the like, and performs communication with the vehicle control system 2, a vehicle control system 4 formed from a network using a protocol that is different from or the same as that of, for example, the vehicle control system 2, a drive device 5 such as an actuator that drives a machine, and an electrical device (e.g.,a power unit, a transmission, a wheel, a brake, a steering device, or the like), which controls vehicle movement under the control of the vehicle control system 2; a detection device 6, which consists of an external sensor such as a camera, radar, light detection and distance measurement (LIDAR), ultrasonic sensor, or the like, which detects the information input from outside and outputs information to generate information; and a dynamic sensor that detects a state (a state of motion, position information, acceleration, wheel speed, or the like) of the vehicle system 1; an output device 7 such as a liquid crystal display, a warning light, a loudspeaker, or the like, which is connected to a network system via a wired or wireless connection, receives data sent by the network system, and outputs required information such as...Displays or outputs message data (e.g., an image, sound) and the like, an input device 8, e.g., a steering wheel, a pedal, a button, a lever, a touch-sensitive control panel, or the like, for generating an input signal so that the user can input an intention and an instruction for operation to the vehicle control system 2, and a notification device 9, such as a lamp, an LED, a loudspeaker, or the like, so that the vehicle system 1 can communicate a status of the vehicle and the like to the outside.

[0014] The vehicle control system 2 is connected to other units, namely the vehicle control system 4, the communication device 3, the drive device 5, the detection device 6, the output device 7, the input device 8, the notification device 9 and the like, which are provided in the vehicle system 1 (i.e. the carrier vehicle), and sends and receives information to and from them respectively. <Physikalische Architektur>

[0015] Fig. Figure 2 shows an example of a physical architecture of the vehicle control system 2. A physical architecture 300 is also referred to as a hardware configuration (H / W configuration).

[0016] A network connection 301 connects network devices in a vehicle-internal network and is, for example, a network connection such as a CAN bus. An ECU 302 is connected to the network connection 301, the drive device 5, the detection device 6, and a network connection (containing a permanently assigned line) other than the network connection 301. The ECU controls the drive device 5 and the detection device 6, acquires information, and sends and receives data to and from the network. The ECU also acts as a gateway (hereinafter referred to as GW), connecting multiple network connections 301 and sending and receiving data to and from each network connection.

[0017] Examples of network topologies include not only the example of the bus type in which multiple ECUs are connected via two buses, as in Fig. Figure 2 shows not only the star type, in which several ECUs are directly connected to the gateway, but also the link type, in which ECUs are connected in a ring configuration via a series of links, the mixed type, in which the types exist side by side and which is composed of several networks, and the like. Based on data received from a network, the ECU 302 performs control processing, such as outputting a control signal to the drive device 5, acquiring information from the detection device 6, outputting a control signal and information to the network, changing the internal state, and the like.

[0018] Fig. Figure 3 shows an example of the internal configuration of the ECU 302. Fig. Figure 3 shows a processor 401, such as a CPU, which has memory elements such as a buffer and a register and performs control functions; an input / output device (I / O) 402, which transmits and receives data to and from the network connection 301 or the drive device 5 and / or the detection device 6, which are connected by a network or a dedicated line; a timer 403, which manages the time using a clock (not shown); a read-only memory (ROM) 404, which stores a program and non-volatile data; a read / write memory (RAM) 405, which stores a program and volatile data; and an internal bus 406, which is used for communication within the ECU 302. A logic function, which will be described later, is executed by the processor 401.

[0019] Then shows Fig. 4 the configuration of the software component that operates in the 401 processor. Fig. Figure 4 shows a communication management unit 502, which manages the operation and status of the input / output device 402 and gives instructions to the input / output 402 via the internal bus 406; a time management unit 503, which manages the timer 403 to acquire and control time-related information; a control unit 501, which acquires and analyzes data from the input / output 402 and controls the entire software component; a data table 504, which holds information such as an environment detection map, which will be described later; and a buffer 505, which temporarily holds data.

[0020] The configuration that is in Fig. Figure 4 shows the concept of operation in the processor 401 and the data required for operation are appropriately acquired from the ROM 404 and the RAM 405 or appropriately written to the ROM 404 and the RAM 405, such that the operation is carried out.

[0021] Each function of the vehicle control system 2, which will be described later, is performed by the control unit 501. <Logische Architektur>

[0022] Fig. Figure 5 shows an example of a logical architecture of the vehicle control system 2. Fig. Figure 5 shows a case in which the vehicle control system 2 has three layers, i.e., a control module for automatic driving, a safety prediction module, and a safety condition determination module, which will be described later and are modules that can operate independently.

[0023] Fig. Figure 5 shows a complete logical architecture 600 with respect to the present embodiment of the vehicle control system 2. Fig. Figure 5 shows a control module 601 for automatic driving, which acquires information (input information) from one or more detection devices 6 and / or communication devices 3 and generates path information (path information for performing automatic driving), which will be described later; a safety prediction module 602, which acquires information (input information) from one or more detection devices 6 and / or communication devices 3; and also an input of path information by the control module 601 for automatic driving or a user operation (the user operation will be described later based on Fig. 13 (described in detail) receives, performs a determination of a safety prediction, which will be described later, and outputs path information (safety prediction path information), a safety condition determination module 603, which acquires information (input information) from one or more detection devices 6 and / or communication devices 3, and also an input of the path information by the safety prediction module 602 or a user operation (the user operation will be described later based on Fig. 14 described in detail), receives, performs a condition safety determination which is described later and outputs path information, and a vehicle motion control unit 604 which calculates a motion control value from the path information from the safety condition determination module 603 and the vehicle motion information from the detection device 6 and outputs control information to drive the vehicle to the drive device 5.

[0024] Furthermore, the control module 601 for automatic driving is formed from a peripheral detection unit 611, which acquires information from the detection device 6 and / or the communication device 3, performs peripheral detection processing, which will be described later, and outputs environment detection information, which will be described later; a cognitive processing unit 612, which acquires the environment detection information from the peripheral detection unit 611, performs cognitive processing, which will be described later, and outputs an environment detection map, which will be described later; and a path generation unit 613, which acquires the environment detection map from the cognitive processing unit 612, generates path information, and outputs the path information to a safety prediction determination unit 623.

[0025] Furthermore, the safety prediction module 602 comprises a safety prediction detection unit 621, which acquires information from the detection device 6 and / or the communication device 3, performs peripheral detection processing, and outputs environmental detection information; a safety prediction planning unit 622, which acquires the environmental detection information output by the safety prediction detection unit 621 and outputs a safety prediction map and safety prediction trajectory information, which will be described later; and the safety prediction determination unit 623, which uses the safety prediction map and safety prediction trajectory information from the safety prediction planning unit 622 and the trajectory information output by the trajectory generation unit 613, or trajectory information by a user operation (the user operation will be described later based on Fig. 13 (described in detail) receives, performs a determination of a safety prediction, which will be described later, and outputs suitable orbit information to a safety condition determination unit 633 and the like.

[0026] Furthermore, the safety condition determination module 603 comprises a safety condition detection unit 631, which acquires information from the detection device 6 and / or the communication device 3, performs peripheral detection processing and outputs environmental detection information; a safety condition planning unit 632, which acquires the environmental detection information output by the safety condition detection unit 631 and outputs safety condition control path information, which will be described later, for performing control according to a determination of a safety condition, which will be described later; and the safety condition determination unit 633, which processes the safety condition control path information output by the safety condition planning unit 632 and the path information output by the safety prediction control unit 623.or railway information through a user action (the user action will later be based on , Fig. 14 (described in detail), receives, performs a determination of a safety condition, which will be described later, and outputs suitable path information to a vehicle motion control unit 604 and the like. <Peripherieerkennung (Peripherieerkennungseinheit 611, Sicherheitsprognoseerkennungseinheit 621, Sicherheitsbedingungserkennungseinheit 631)>

[0027] The types of detection devices 6 provided in the vehicle system 1 are as described in the configuration of the vehicle control system 2, and environmental detection information, which will be described later, is acquired by the operating principle according to the type of detection device. For example, the outside world (the environment) is measured using a sensor contained in the detection device 6, a specific algorithm (e.g., an image recognition algorithm for the acquired image) is applied to the measured value, and the environmental detection information is acquired.

[0028] A measurement range for each detection device is predetermined (e.g., in the case of a camera, a recording direction and vertical and horizontal angles, a long-range detection limit based on the number of pixels; and in the case of radar, a radio wave beam angle and reception angle, and a range) or an adjustment (calibration) is performed to account for changes in the environment in order to measure and determine a measurement range. By combining the environmental detection information acquired by each detection device, the environmental situation of vehicle system 1 can be examined.

[0029] An example of environmental perception is in Fig. Figure 6(a) shows an example in which the detection device 6 of the vehicle system 1 acquires the external information. The environmental detection information output by the detection device 6 makes it possible to check what type of object is present in the environment.

[0030] Accordingly, the environmental perception information can also be acquired from the communication device 3, which is provided in the vehicle system 1. It is possible to acquire the environmental perception information of an object located on the far side of an obstacle, such as a shadow that cannot be observed by the detection device 6, together with the position information from the communication device 3 and to check the object's position.

[0031] Furthermore, the environmental detection information acquired by the communication device 3 includes environmental map information (topography, road, lane information), road traffic conditions (traffic density, under construction, and the like), and railway information calculated by another object itself, or railway information of another object calculated by the other object. <Umgebungserkennungsinformationen (Peripherieerkennungseinheit 611, Sicherheitsprognoseerkennungseinheit 621, Sicherheitsbedingungserkennungseinheit 631)>

[0032] The environmental detection information is information that represents an object observed by the detection device 6 or an object received by the communication device 3.Examples of environmental sensing information include an object type (stationary object (a wall, a white line, a signal, a separation zone, a tree, or the like), dynamic object (a pedestrian, a passenger car, a two-wheeled vehicle, a bicycle, or the like), whether driving (entering an area) is possible or not, or other property information), relative position information (direction / distance) of an object, absolute position information (coordinates or the like) of an object and the vehicle itself, an object's speed, a direction (a direction of movement, a direction of area), an acceleration, an existence probability (a probability), map information, road traffic conditions, the time at which environmental sensing information is measured, an identifier of the sensing device performing the measurement, an expected trajectory of an object, and the like. <Kognitive Verarbeitung (kognitive Verarbeitungseinheit 612)>

[0033] Based on the environmental perception information, the cognitive processing unit 612 performs a behavior prediction, which will be described later, and generates an environmental perception map. <Verhaltensvorhersage (kognitive Verarbeitungseinheit 612)>

[0034] The environment perception map, described later, can be created not only using currently perceived environment perception information, but also by making a prediction (a behavioral prediction) from previous environment perception information. For example, after a certain period of time, it is very likely that a stationary object will be present at the same position (the same position on the road surface, not the position relative to the vehicle), and it is possible to predict the position of a dynamic object after a certain period of time from its position immediately before, its speed, acceleration, and so on. Cognitive processing unit 612 uses the environment perception information in this way to perform a behavioral prediction of an object. <Umgebungserkennungskarte (kognitive Verarbeitungseinheit 612)>

[0035] Information that integrates the environmental perception information output by multiple detection devices is called an environmental perception map. An example of an environmental perception map is given with reference to Fig. 6(b) described. Here shows Fig. 6(b) an example in which object information for each area is arranged in relation to an orthogonal coordinate system (grid) (see Fig. 6(a)). The object information is, for example, the content obtained by removing the positional information from the environmental perception information mentioned above, and is arranged in each grid. By recording the information about an object that is present in each grid, it is possible to reconstruct the current situation of the outside world or a future situation based on the behavioral prediction from the environmental perception map. <Bahninformationen (Bahnerzeugungseinheit 613)>

[0036] Trajectory information is information that expresses a path, and the trajectory is represented, for example, by a set of coordinates of the carrier vehicle's position at regular time intervals. Furthermore, in another example, the trajectory can be represented by a set of motion control values ​​(a target acceleration and a target yaw rate) at regular time intervals, a vector value (a direction and a velocity) of the carrier vehicle at regular time intervals, a time interval for traveling a certain distance, and so on. An example of the trajectory is in Fig. Figure 7 shows a path 801 which specifies a set of (future) coordinates of the carrier vehicle position at regular time intervals in a case where the vehicle system 1, which is the carrier vehicle, changes lanes to the right lane. <Bahninformationserzeugung ohne Verwendung von Fahrtführungsbereichsinformationen (Bahnerzeugungseinheit 613)>

[0037] The following describes a process for generating the track (information).

[0038] The orbit generation unit 613 generates the orbit information using the environment perception map output by the cognitive processing unit 612. A method for generating the orbit information based on the environment perception map is described. The orbit is generated in such a way that it satisfies a safety constraint that allows the vehicle system 1, which is the carrier vehicle, to move safely (e.g., the possibility of colliding with other obstacles is low), and a motion constraint, such as acceleration and deceleration, yaw rate, and the like, that can be achieved by the vehicle system 1.

[0039] An example of track generation, in which the carrier vehicle moves to the right-hand lane, is given with reference to Fig. 7 described. Here is an example of changing the lane to the right lane. First, the carrier vehicle fulfills the movement restriction and creates a path (801 in Fig. 7), which moves towards the right lane. Then, based on the predicted path of other dynamic objects (e.g., the actual speed and position after a certain period at the assumed acceleration) and the path of the carrier vehicle, it is calculated whether a collision will occur, and the path is generated and the safety constraints are calculated accordingly.

[0040] With regard to calculation methods for safety restrictions, a method (a no-entry area method) for setting an area, which is assumed to be a no-entry area from the actual speed and an assumed acceleration and a assumed deceleration of a dynamic object as described above, and a method (a potential method) for generating a map in which a high potential (a risk value in this case) is provided for the type, speed and direction of movement of each object and the risk value is gradually reduced around the object, and calculating the risk value, are known.In the case of using the potential method, a path that has the lowest potential in the generated potential map and does not enter a potential area that has a certain value or more is generated, and a path that meets the movement restriction of the carrier vehicle is set as a generated path.

[0041] For the no-entry zone, the behavior of a dynamic object needs to be predicted. A method exists for this behavior prediction, defining a specific area around the point towards which the object is moving with its current speed, acceleration, and direction as the no-entry zone. By defining this specific area as the no-entry zone in this way, a complex prediction calculation is unnecessary.

[0042] As described above, a path is created based on the direction in which the vehicle is moving, the movement restriction and the safety restriction, and the safety condition determination unit 633 transmits the generated path to the vehicle motion control unit 604 (which is described later). <Bahnbestimmung unter Verwendung von Fahrtführungsbereichsinformationen (Bahnerzeugungseinheit 613)>

[0043] Then, the processing of a path determination using the route guidance area information is described.

[0044] The guidance area information is information about the area in which the vehicle is to move and is, for example, a driving area (e.g., a lane) that is determined on the basis of information from a lane control, a traffic jam, a moving vehicle, and the like, if lane information and an obstacle are present, from information from a route that shows the route the carrier vehicle travels from the current point to a destination point.

[0045] The path generation unit 613 receives the route guidance area information as a result of its creation by the cognitive processing unit 612 from the environment recognition map or from another control system (not shown) or the like, and generates a path using the received route guidance area information and the environment recognition map output by the cognitive processing unit 612.

[0046] This section deals with a case where the guidance area is a drivable area. First, it is assumed that the guidance area information is given as the guidance area, as defined by 903 in Fig. 8(b) in a situation containing a path 901, as in Fig. 8(a) is shown, is indicated.

[0047] In such a situation, the path generation unit 613 performs processing such that the generated path lies within the guidance area 903. For example, several path candidates are generated in a forward direction, and one of these, which does not collide with an object in the environment detection map and is present in the guidance area 903, is selected (902 in Fig. 8(b)). The content, except for the determination of the route guidance area, is the same as in the case of route determination without using the route guidance area information. The route generation unit 613 generates the route information using the route guidance area information in this way.

[0048] In path determination mode that does not use guidance area information, the basic movement is essentially straight along the track, avoiding surrounding obstacles, since no information about the guidance area is available. In contrast, using guidance area information allows for more advanced control, such as changing lanes or driving in a lane where moving to a destination is straightforward. <Sicherheitsprognoseerkennung (Sicherheitsprognoseerkennungseinheit 621)>

[0049] The safety prediction detection unit 621 outputs the environmental detection information in the same way as the peripheral detection unit 611. The safety prediction detection unit 621 acquires and outputs information such as the type, position, orientation, velocity, and acceleration of an object, as well as similar information, which is particularly necessary for performing behavior prediction of the object. Furthermore, there is a case in which the trajectory (a planned future position) of an object is acquired (received) by means of the communication device 3.

[0050] Fig. Figure 9 shows an example of the environmental perception information that is output here. The position, orientation, and speed of the vehicle system 1, which is the carrier vehicle, another vehicle 1002, and a pedestrian 1003, are indicated by an arrow, and the safety prediction detection unit 621 sends its environmental perception information to the safety prediction planning unit 622. <Sicherheitsprognoseplanung (Sicherheitsprognoseplanungseinheit 622)>

[0051] The Safety Prediction Planning Unit 622 creates a Safety Prediction Map and Safety Prediction Orbit Information using the Environment Detection Information output by the Safety Prediction Detection Unit 621. <Sicherheitsprognosekarte (Sicherheitsprognoseplanungseinheit 622)>

[0052] The safety prediction map is a map that integrates the results of an object's behavior prediction, performed using environmental perception information, into the same format as the environmental perception map. An example of a safety prediction map is shown in Fig. Figure 10 shows the safety prediction map. This map, based on information such as the object's type, position, orientation, speed, and acceleration, predicts approximately where each object will be located after a given period. The dark area represents a region with a high probability of each object being present after that time, while the light area represents a region with a low probability. By performing this prediction and creating the safety prediction map, it is possible to determine the risk of vehicle system 1 approaching each object after a given time.

[0053] Regarding the prediction of an object, in addition to the procedure described in the behavioral prediction mentioned above, there is, for example, a procedure for predicting a position by predicting that each object will move to a position that has a low potential using the potential method; a procedure for recording the amount of change as an error of a linear prediction based on the current position, orientation, velocity, and acceleration, and performing a prediction in a specific range; and a procedure for predicting movement behavior by understanding situations such as a pedestrian walking continuously on a sidewalk or crosswalk, a vehicle signaling, changing lanes, and the like, according to specific situations or the like.

[0054] With regard to the content to be calculated here, it is sufficient, compared to the content calculated by cognitive processing unit 612, to calculate only the information necessary to determine the risk score as well as the information related to safety. In other words, predicting the behavior of a surrounding object here, compared to predicting the behavior of a surrounding object in cognitive processing unit 612, requires only the behavioral prediction necessary to determine safety. For example, there is no need to process precise information about the type (vehicle type, etc.) of an object and its lane, the type of a stationary object, or similar details. In this way, the calculation can be simplified, a relatively simple and low-error system can be created, and reliability can be improved.

[0055] Here, the safety prediction map is shown after a specific period. However, a map after a certain period from the present can be taken as the safety prediction map for each time (e.g., assuming the current time t = 0, at regular time intervals of t = t1, t2, t3, ...). In this way, it is easy to perform a determination in accordance with the position of the carrier vehicle, which is derived from the trajectory at any given time.

[0056] Furthermore, regarding the current position of an object after a certain period, position information such as a trajectory from the object or another system can be acquired using the communication device 3. In this way, it is possible to improve the predictive accuracy of an object's future position. <Sicherheitsprognosebahninformationen (Sicherheitsprognoseplanungseinheit 622)>

[0057] The safety prediction trajectory information is information that specifies a trajectory along which vehicle system 1 has a low risk of approaching an object on the safety prediction map. An example of the safety prediction trajectory is given by 1202 in Fig. As specified in section 11, the safety prediction planning unit 622 generates a path (a safety prediction path) such that it does not approach any object determined by the safety prediction map in the direction following the lane. The path generated here is, for example, a path along which the deceleration of the carrier vehicle is carried out in such a way that the carrier vehicle does not approach any other object too closely. In this way, it is possible to generate a path that does not approximate the predicted behavior of an object. <Sicherheitsprognosebestimmung (Sicherheitsprognosebestimmungseinheit 623)>

[0058] Then, a processing step (a security determination) is performed in the security prediction determination unit 623 with reference to the flowchart of Fig. 12 described. The safety prediction determination unit 623 receives the path information from the path generation unit 613 of the control module 601 for automatic driving and receives the safety prediction map and the safety prediction path information from the safety prediction planning unit 622 (S101). The safety prediction determination unit 623 then determines whether or not the control system is predictively safe based on the received path information (S102).

[0059] As a specific method of determination, in a case where the vehicle is controlled based on track information, if the risk of approaching an object is a certain value or more in the safety prediction map (the distance is a certain value or less), the control is determined to be unsafe.

[0060] If the control system is determined to be unsafe as a result of the determination (No in S102), the safety prediction path information calculated by the safety prediction planning unit 622 is output (S103). Furthermore, if the control system is determined to be safe as a result of the determination (Yes in S102), the path information received from the control module 601 for automatic driving is output (S104).

[0061] In this way, the safety prediction determination unit 623 can output the orbit information that has been determined as safe in the safety prediction map as a result of a prediction of the object's behavior.

[0062] Furthermore, regarding the determination that the control system is unsafe, in addition to determining that the risk of approaching an object is equal to or greater than a certain value, an event such as a traffic violation (e.g., a driving zone violation, entering a restricted access area, and exceeding or falling below upper or lower speed limits) can be identified based on the safety prediction map. For this purpose, the safety prediction detection unit 621 receives traffic information as external information and notifies the safety prediction planning unit 622 and the safety prediction determination unit 623 of this information. It is then determined whether the railway has violated the traffic information or not. In this way, a safer determination can be made based on environmental conditions such as...to comply with the road traffic regulations.

[0063] Furthermore, if the safety prediction determines that the track information received by the automatic driving control module 601 is not safe, an anomaly may have occurred in the automatic driving control module 601. Therefore, a warning is communicated to the user via output device 7, to another vehicle via notification device 9, or to another system via communication device 3 that the track information is not safe. Alternatively, the warning is communicated to another vehicle control system 4, triggering further safety control (e.g., switching to a degradation control), further recording of an operating log, or the like.

[0064] In this way, it is possible to take measures other than control based on the safety prediction track information in response to the occurrence of an anomaly in the vehicle control system 2.

[0065] Since the processing of the Safety Prediction Module 602 is limited to determining the safety of the input path information, the input and output paths have similar structures (path density, time from start to finish, and the like). That is, the path information output by the Safety Prediction Module 602 has a structure similar to the path information generated by the Control Module 601 for automated driving, which serves as the input information. The Safety Prediction Module 602 differs only in the section that determines safety and outputs the path information in relation to the input path information.

[0066] Furthermore, if the safety prediction unit 623 determines that the path information received from the automatic driving control module 601 is unsafe, it can output the path information received from the automatic driving control module 601 in a corrected form. For example, if the vehicle is approaching a vehicle ahead on the current path, the path received from the automatic driving control module 601 can be corrected to a path where no risk is present in the safety prediction map, such that the position of a point on the path is corrected to a deceleration path. In this way, it is possible to improve safety and reduce the computational effort required to calculate the safety prediction path information separately. <Sicherheitsbedingungserkennung (Sicherheitsbedingungserkennungseinheit 631)>

[0067] The safety condition detection unit 631 performs processing in the same way as the peripheral detection unit 611 and outputs the environment detection information.

[0068] Since the environmental detection information output by this safety condition detection is used for safety condition planning and safety condition determination, which will be described later, the amount of information and the computational effort (e.g., processing that only uses the input information from the detection device 6 and does not use the input information from the communication device 3) are small compared to the information processed by the peripheral detection unit 611 and the safety prediction detection unit 621, the processing is simplified, and a very reliable implementation with few assembly errors is possible. <Sicherheitsbedingungsplanung (Sicherheitsbedingungsplanungseinheit 632)>

[0069] The safety condition planning unit 632 plans the control that meets a safety condition using the environmental detection information output by the safety condition detection unit 631.

[0070] Specifically, the reaction time (idle time) is used in a case where the distance to ahead and surrounding objects, the speed, acceleration and an assumed maximum and minimum speed, acceleration and deceleration of another vehicle and the carrier vehicle, which are contained in the environment perception information, are required, and it is used to determine whether the carrier vehicle will collide with or approach a surrounding object or not if control continues in the current situation.

[0071] Furthermore, if it is determined that approaching occurs, the path on which acceleration is to take place in the direction opposite to the approach direction is output as the safety condition control path information. <Sicherheitsbedingungsbestimmung (Sicherheitsbedingungsbestimmungseinheit 633)>

[0072] If the safety condition planning unit 632 outputs the safety condition control path information, the safety condition determination unit 633 determines, based on a safety condition, that the current driving state is a risky situation and outputs the safety condition control path information to the vehicle motion control unit 604. Furthermore, if the safety condition planning unit 632 does not output the safety condition control path information, the safety condition determination unit 633 determines, based on a safety condition, that the current driving state is not a risky situation and outputs the path information provided by the safety prediction determination unit 623 to the vehicle motion control unit 604.

[0073] In this way, the safety condition determination unit 633 outputs railway information that fulfills the safety condition (i.e., railway information that corresponds to a signal to perform vehicle control in accordance with the safety condition determination). <Steuerung auf der Grundlage von Bahninformationen>

[0074] The vehicle motion control unit 604 controls the drive unit 5 to implement the path information output by the safety condition determination unit 633. Based on the path information, the control unit calculates a target speed, yaw rate, and similar parameters for the vehicle system 1 in such a way that the system state (actual speed, actual acceleration, actual yaw rate, and similar parameters) of the vehicle system 1, as detected by the detection device 6, is reflected in such a way that the path can be followed. The necessary control of the drive units 5 is then carried out to achieve this target speed and yaw rate.For example, the output of the engine torque or the motor torque is increased, the brakes are applied for deceleration, and steering is performed to achieve the target yaw rate, or the braking and acceleration of individual wheels are controlled in such a way that wheel speeds are uneven. In this way, vehicle control system 2 of vehicle system 1 implements vehicle control that can follow the target path. <Change of module configuration>

[0075] Then an example of the logical architecture of the vehicle control system 2 is described if the safety prediction module 602 and the safety condition determination module 603 are used, without using the control module 601 for automatic driving.

[0076] Fig. Figure 13 shows an example in which the safety prediction module 602 and the safety condition determination module 603 are used in combination as, for example, a driver assistance system, and Fig. Figure 14 shows an example in which only the safety condition determination module 603 is used as a driving assistance system.

[0077] If the safety prediction module 602 and the safety condition determination module 603 are Fig. When used in combination, unlike the case where the path information is entered into the safety prediction unit 623 of the safety prediction module 602 described above, the user's action, who drives the vehicle system 1, which is the carrier vehicle, is entered into the safety prediction unit 623 by the input device 8. The path is the future position of the carrier vehicle. However, in the case of a user action, an action input is performed. Accordingly, the future position of the carrier vehicle is predicted from the entered action (e.g.,The position of the carrier vehicle is predicted after a certain period of time by predicting a change in the lateral direction from the current steering angle, and by predicting a change in the steering angle and a change in the vertical direction from the amount of depressor or brake pedal input. A determination is carried out in the same way as for the path (specifically, in a manner approximating the path). The processing, except for the above, is the same as in the example above.

[0078] Furthermore, if only the safety condition determination module 603 of Fig. 14 is also used, the input of the safety condition determination unit 633 of the safety condition determination module 603 similarly to the user's actuation input from the input device 8. In this case, the position of the carrier vehicle in the future is also predicted from the user's actuation in a similar way instead of the path and is used as an approximation of the path.

[0079] In this way, if the control module 601 is used for automated driving (for railway information output), it can be used as a module to make automated driving safe. Even in the case where the user is driving, a similar safety control can be implemented as a driving assistance system, and processing can be carried out by further combining it with the safety prediction module 602, depending on whether a safety prediction is required. Accordingly, it is possible to create a system that can be easily extended and reused.

[0080] The conversion of the user's input to the path does not need to be performed by the safety prediction unit 623 or the safety condition determination unit 633 and can be carried out outside of these units. In this way, the safety prediction unit 623 and the safety condition determination unit 633 do not need to be modified and can easily be reused.

[0081] Furthermore, switching between these modules does not necessarily require another product, and a single product can be used in a way that allows it to switch between an automatic driving mode (where the system performs the driving control) and a driver assistance mode (where the user performs the driving control). In this way, the processing of the Safety Prediction Module 602 and the Safety Condition Determination Module 603 is performed jointly in both modes, and it is possible to improve the reliability of the system by enabling switching and shared functionality. <Anordnung der logischen Architektur in der physikalischen Architektur>

[0082] The aforementioned logical architecture 600 is composed of several functions, and several patterns exist in the functional arrangement within the hardware, as shown in the figure. An example of the arrangement is shown in Fig. 15(a) and Fig. 15(b) shown. Fig. 15(a) shows an example arrangement (see also Fig. 5) if the vehicle control system 2 has all three layers of the 601 automatic driving control module, the 602 safety prediction module and the 603 safety condition determination module, Fig. 15(b) shows an example arrangement (see also Fig. 13) if the vehicle control system 2 has the safety prediction module 602 and the safety condition determination module 603. The arrangement of functions is not limited thereto and each function may be arranged in an ECU that differs from the description.

[0083] Furthermore, not all functions are always located in one ECU for each module. For example, the peripheral detection unit 611, the cognitive processing unit 612, and the path generation unit 613 of the control module 601 for automated driving may be located in different ECUs. Conversely, several modules may be located in the same ECU. For example, the safety prediction module 602 and the safety condition determination module 603 may be located in the same ECU.

[0084] However, as in the safety condition determination module 603, the examples from Fig. 15(a) and Fig. 15(b) the safety condition detection unit 631, the safety condition planning unit 632 and the safety condition determination unit 633 arranged in the same ECU, such that the configurations of the ECU and the module in the cases of Fig. 15(a) and Fig. 15(b) are the same and reuse is easier.

[0085] Furthermore, since the safety prediction module 602 and the safety condition determination module 603 determine the safety of the track information generated by the automatic driving control module 601, the automatic driving control module 601, the safety prediction module 602 and the safety condition determination module 603 are preferably arranged in different ECUs or processors or designed in such a way that they are not dependent on each other in the processor, so that no common cause failure occurs.

[0086] In particular, the safety prediction module 602 can be used as a module for independently determining safety because it accepts input path information and outputs path information for which safety is determined. For example, an ECU equipped with the safety prediction module 602 is connected, and the path information generated by another control module 601 for automated driving is input to and output by the ECU, allowing for the additional determination of safety. <Zuverlässigkeit des Moduls>

[0087] The safety condition determination module 603 provides higher reliability than other modules of the safety prediction module 602 and the control module 601 for automated driving, or reliability that is the same as that of the safety prediction module 602 and higher than that of the control module 601 for automated driving, and is useful as a safety mechanism of the overall system. In this way, the safety condition determination module 603 can, for example, prevent an unsafe event from occurring even if the safety prediction module 602 or the control module 601 for automated driving performs faulty processing.

[0088] Furthermore, the Safety Prediction Module 602 can handle a fault in the Autopilot Control Module 601, which contains the behavior prediction of an object, that cannot be prevented solely by the Safety Condition Determination Module 603. Therefore, the Safety Prediction Module 602 is useful for ensuring safety with a higher reliability than the Autopilot Control Module 601, while performing complex processing with a reliability no higher than that of the Safety Condition Determination Module 603.

[0089] In this way, even if the 601 control module for automatic driving has a relatively low reliability, a design that does not affect the overall reliability is possible, and as a whole system, an improvement in reliability and a reduction in costs are possible. [Second embodiment]

[0090] Then an example (a second embodiment) is described in which the safety prediction planning unit 622 of the safety prediction module 602 and the path generation unit 613 of the control module 601 for automated driving acquire the determining conditions of each module and perform a planning, using Fig. 16 described. Fig. Figure 16 shows an example of the logical architecture of the vehicle control system 2 according to the second embodiment. It should be noted that in the second embodiment, the same configurations as in the first embodiment are defined by the same reference numerals, and a detailed description of such configurations is omitted.

[0091] A first example is an instance where the safety prediction planning unit 622 of the safety prediction module 602 detects a determining condition of the safety condition determining unit 633 and performs a planning process. In this case, the safety prediction planning unit 622 detects the conditions under which the safety condition determining unit 633 determines safety. Specifically, it detects the conditions under which the distance from the vehicle ahead, the speed, and the acceleration are located when deceleration control is performed, and so on. By detecting this determining condition, the safety prediction planning unit 622 generates safety prediction trajectory information that, according to the determining condition, is not deemed unsafe.

[0092] Similarly, the path generation unit 613 of the control module 601 for automated driving acquires the determination content of the safety prediction determination unit 623 and the determination content of the safety condition determination unit 633 and generates path information that each determination unit identifies as non-unsafe. The acquisition of the determination condition of the safety condition determination unit 633 occurs as described above. Regarding the acquisition of the determination content of the safety prediction determination unit 623, the safety prediction map output by the safety prediction planning unit 622 is first received. The determination content (a threshold value from the safety prediction map, etc.) is then acquired by the safety prediction determination unit 623, and it is determined in advance whether the generated path information in the determination content of the safety prediction determination unit 623 is identified as non-unsafe or not.

[0093] In this way it is possible to prevent the safety prediction module 602 from generating path information that does not meet the determination condition of the safety condition determination module 603, from the control module 601 for automatic driving generating path information that does not meet the determination condition of the safety prediction module 602, and from the safety condition determination module 603 and the vehicle system 1 reaching a state in which control cannot be carried out as expected, e.g. due to an unexpected control event (necessary avoidance cannot be carried out, control becomes unstable due to unexpected braking, and the like).

[0094] Regarding the acquisition of the above-mentioned information, the information can be acquired not only directly from each of the above-mentioned determining units, but also through external communication that acquires the information separately. [Function and effect of the first and second embodiments]

[0095] According to each of the embodiments described above, it is possible to form the vehicle control system 2 in a form in which it can be reused while ensuring the safety of the automatic driving system, using the control module 601 for automatic driving, which generates path information, the safety prediction module 602, which determines the safety of the path information based on information obtained by performing the behavior prediction of a surrounding object and outputs the safety prediction path information as required, and the safety condition determination module 603, which determines a predetermined safety condition and outputs the safety condition control path information if it is determined to be unsafe.

[0096] In particular, the Safety Prediction Module 602 performs a determination using the Safety Prediction Map as the result of a safety prediction of surrounding objects in relation to the input trajectory information and outputs safe trajectory information (input trajectory information or generated safety prediction trajectory information). In this way, even if the Autodrive Control Module 601 generates erroneous trajectory information, it is possible to continue safe control and detect anomalies, and reuse in a configuration without adding another module is simplified.

[0097] Furthermore, a determination of the safety of the control module 601 for automated driving is carried out using the safety prediction module 602, which is relatively simple to process, the configuration is straightforward for easy processing, and improved reliability is achieved. This allows the control module 601 for automated driving to perform more complex processing. This applies similarly to the safety prediction module 602 and the safety condition determination module 603.

[0098] Furthermore, when constructing a driving assistance system using the safety prediction module 602 and the safety condition determination module 603, the user's actions while driving the carrier vehicle are approximated to a specific path. In this way, it is easy to form the vehicle control system 2 by reusing the safety prediction module 602 and the safety condition determination module 603.

[0099] Furthermore, in another embodiment, the control module 601 for automated driving, the safety prediction module 602, and the safety condition determination module 603, each of which can operate independently, generate path information after they have detected a determination condition from one another. Accordingly, it is also possible to avoid instability of the control system due to an inconsistency in the states of the modules.

[0100] As described above, the vehicle control system (vehicle control device) 2 of the present embodiment includes the automatic driving control module 601, which generates path information using input information from the detection device 6 and / or the communication device 3, and the safety prediction module 602, which is independent of the automatic driving control module 601, performs a safety determination based on path information generated by the automatic driving control module 601 and the safety prediction map as a result of predicting the behavior of surrounding objects using input information from the detection device 6 and / or the communication device 3, outputs the path information if a result of the safety determination is safe, and the safety prediction path information, which is path information,which are generated based on input information from the detection device 6 and / or the communication device 3, and outputs the safety prediction card if a result of the safety determination is not safe. Furthermore, the safety condition determination module 603 is also included, which outputs a signal to carry out vehicle control according to a predefined safety condition determination from the track information output by the safety prediction module 602 and the input information of the detection device 6.

[0101] According to the present embodiment of the above-mentioned configuration, it is possible to form an automatic driving system for the logical architecture 600 by combining the control module 601 for automatic driving, which outputs the path information for performing automatic driving, the safety prediction module 602, which is independent of the control module 601 for automatic driving, performs the behavior prediction of an object and performs the safety determination of the path information output by the control module 601 for automatic driving or the user operating information, and the safety condition determination module 603, which performs the safety condition determination for the path information output from the safety prediction module 602 and outputs the path information.where reuse is simple and the safety of the automated driving system can be provided as needed.

[0102] It should be noted that the present invention is not limited to the embodiment mentioned above and includes a multitude of variations. For example, the embodiments mentioned above are described in detail for the sake of clarity and to facilitate understanding of the present invention, and the present invention is not necessarily limited to embodiments that include all of the described configurations. Furthermore, a part of a configuration of a particular embodiment can be replaced by a configuration of another embodiment, and a configuration of a particular embodiment can also be added to a configuration of another embodiment. Furthermore, for a part of a configuration of any embodiment, further configurations can be added, removed, or replaced.

[0103] Furthermore, some or all of the aforementioned configurations, functions, processing sections, processing means, and the like can be implemented as hardware, for example, as an integrated circuit. Alternatively, the aforementioned configurations, functions, and the like can be implemented by software, through which a processor interprets and executes programs that perform their functions. Data, such as a program that performs each function, a table, and a file, can be stored in storage devices such as memory, a hard disk drive, and a solid-state drive (SSD), or on recording media such as an IC card, an SD card, and a DVD.

[0104] Furthermore, control and data lines deemed necessary for explanation are shown; not all control or data lines required for a product are shown. In practice, almost all configurations can be considered interconnected. Reference symbol list 1 Vehicle system 2 Vehicle control system (vehicle control device) 3 Communication device 4 Vehicle control system 5 Drive device 6. Detection device 7 Output device 8 Input device 9 Notification device 300 Physical Architecture 301 Network connection 302 ECU 401 processor 402 Input / Output 403 Timers 404 ROM 405 RAM 406 Internal Bus 501 Control unit 502 Communications Monitoring Unit 503 Time Management Unit 504 Data table 505 buffers 600 Logical Architecture 601 Control module for automatic driving 602 Safety Forecast Module 603 Safety Condition Determination Module 604 Vehicle motion control unit 611 Peripheral detection unit 612 Cognitive Processing Unit 613 Railway generating unit 621 Security Prediction Detection Unit 622 Security Forecast Planning Unit 623 Safety prediction determination unit 631 Safety condition detection unit 632 Safety Conditions Planning Unit 633 Safety Condition Determination Unit 801 train 901 train 902 train 903 Driving guidance area 1002 Additional vehicle 1003 pedestrians 1202 Safety Forecast Ore 1301 Railway

Claims

[1] Vehicle control device (2) which performs control of a vehicle and includes a detection device (6) which includes a sensor provided on a carrier vehicle and a communication device (3) which performs communication to the outside, wherein the vehicle control device (2) comprises: a control module (601) for automatic driving that generates path information using input information from the detection device (6) and / or the communication device (3); and a safety prediction module (602) that is independent of the automatic driving control module (601) that performs a safety determination based on path information generated by the automatic driving control module (601) and a safety prediction map as a result of a behavior prediction of a surrounding object using input information from the detection device (6) and / or the communication device (3), outputs path information if a result of the safety determination is safe, and safety prediction path information, which is path information generated based on input information from the detection device (6) and / or the communication device (3), and outputs the safety prediction map if a result of the safety determination is not safe, wherein the vehicle control device (2) characterized byThe difference is that, for predicting the behavior of a surrounding object, the safety prediction module (602) only performs a behavior prediction that is necessary to determine safety, in contrast to a behavior prediction of a surrounding object in the control module (601) for automatic driving. [2] Vehicle control device (2) according to claim 1, further comprising: a safety condition determination module (603) which outputs a signal to perform vehicle control in accordance with a specified safety condition determination from railway information output by the safety prediction module (602) and input information from the detection device (6). [3] Vehicle control device (2) according to claim 1, wherein path information of an object received by means of the communication device (3) is used in a behavior prediction of a surrounding object by the safety prediction module (602). [4] Vehicle control device (2) according to claim 1, wherein path information generated by the control module (601) for automatic driving and path information output by the safety prediction module (602) have similar structures. [5] Vehicle control device (2) according to claim 1, wherein the safety prediction module (602) uses the actuation of a user driving the vehicle in an approximate manner as a path. [6] Vehicle control device (2) which performs control of a vehicle and includes a detection device (6) which includes a sensor provided on a carrier vehicle and a communication device (3) which performs communication to the outside, wherein the vehicle control device (2) comprises: a control module (601) for automatic driving that generates path information using input information from the detection device (6) and / or the communication device (3); and a safety prediction module (602) that is independent of the automatic driving control module (601) that performs a safety determination based on path information generated by the automatic driving control module (601) and a safety prediction map as a result of a behavior prediction of a surrounding object using input information from the detection device (6) and / or the communication device (3), outputs path information if a result of the safety determination is safe, and safety prediction path information, which is path information generated based on input information from the detection device (6) and / or the communication device (3), and outputs the safety prediction map if a result of the safety determination is not safe, wherein the vehicle control device (2) characterized byThe safety prediction module (602) has a higher reliability than the automatic driving control module (601). [7] Vehicle control device (2) which performs control of a vehicle and includes a detection device (6) which includes a sensor provided on a carrier vehicle and a communication device (3) which performs communication with the outside, wherein the vehicle control device (2) comprises: a control module (601) for automatic driving that generates path information using input information from the detection device (6) and / or the communication device (3); and a safety prediction module (602) that is independent of the automatic driving control module (601) that performs a safety determination based on path information generated by the automatic driving control module (601) and a safety prediction map as a result of a behavior prediction of a surrounding object using input information from the detection device (6) and / or the communication device (3), outputs path information if a result of the safety determination is safe, and safety prediction path information, which is path information generated based on input information from the detection device (6) and / or the communication device (3), and outputs the safety prediction map if a result of the safety determination is not safe, wherein the vehicle control device (2) characterized byis that the safety prediction module (602) has a reliability that is greater than that of the automatic driving control module (601) and less than or equal to that of the safety condition determination module (603). [8] Vehicle control device (2) according to claim 2, wherein the control module (601) for automatic driving generates path information using a determination condition of the safety prediction module (602) and / or the safety condition determination module (603). [9] Vehicle control device (2) according to claim 2, wherein the safety prediction module (602) generates path information using a determination condition of the safety condition determination module (603). [10] Vehicle control system (4) which performs control of a vehicle and includes a detection device (6) which includes a sensor provided on a carrier vehicle and a communication device (3) which performs communication with the outside, wherein the vehicle control system (4) comprises: a control module (601) for automatic driving that generates path information using input information from the detection device (6) and / or the communication device (3); a safety prediction module (602) that is independent of the automatic driving control module (601) that performs a safety determination based on path information generated by the automatic driving control module (601) and a safety prediction map as a result of a behavior prediction of a surrounding object using input information from the detection device (6) and / or the communication device (3), outputting path information if a result of the safety determination is safe, and safety prediction path information, which is path information generated based on input information from the detection device (6) and / or the communication device (3), and outputting the safety prediction map if a result of the safety determination is not safe; and a safety condition determination module (603) which outputs a signal for performing vehicle control in accordance with a predetermined safety condition determination from railway information output by the safety prediction module (602) and input information from the detection device (6), wherein the vehicle control system (4) characterized by The difference is that, for predicting the behavior of a surrounding object, the safety prediction module (602) only performs a behavior prediction that is necessary to determine safety, in contrast to a behavior prediction of a surrounding object in the control module (601) for automatic driving.

Images