Vehicle electronic control device, vehicle electronic control method and non-transitory storage medium

Abstract

A vehicle electronic control device includes a detection device configured to detect an occupant's state, a first control device, and a second control device. The second control device is configured to refer to a database defining a relationship between the occupant's state and a first time, and autonomously drive the vehicle at a speed equal to or lower than a maximum permissible speed from a switching time, which is the time when the first control device becomes unable to control the vehicle. The database is configured such that when the first time corresponding to the occupant's second state is longer than the first time corresponding to the occupant's first state, the maximum permissible speed corresponding to the second state is lower than the maximum permissible speed corresponding to the first state.

Description

Technical Field

[0001] The present disclosure relates to a vehicle electronic control device, a vehicle electronic control method, and a non-transitory storage medium for an autonomous driving vehicle. Background Art

[0002] Vehicle electronic control devices for autonomously driving vehicles are known. One of these control devices includes a first controller and a second controller. In a normal state (when the first controller is functioning properly), the first controller controls the engine, brakes, steering, etc. to autonomously drive the vehicle. When an abnormality occurs in a portion of the first controller, the second controller controls the engine, brakes, steering, etc. to autonomously drive the vehicle. The first controller and the second controller are powered by a battery (see Japanese Unexamined Patent Application Publication No. 2003-15743 (JP2003-15743A)). Summary of the Invention

[0003] Consider configuring a vehicle electronic control device so that, if an abnormality occurs in a portion of the first controller, the second controller controls the engine, brakes, steering, and other components to slow down and stop the vehicle at a rate that neither disturbs occupants nor requires the following vehicle to suddenly decelerate. In this case, the battery needs to have sufficient power to keep the second controller running until the vehicle stops.

[0004] For example, when the vehicle speed is relatively low at the time when the second controller starts to control the vehicle, the time required to stop the vehicle is relatively short. Therefore, the second controller consumes a relatively small amount of electricity during the period from when the second controller starts to decelerate the vehicle until the vehicle stops (hereinafter referred to as the "deceleration period"). On the other hand, when the vehicle speed is relatively high at the time when the second controller starts to control the vehicle, the deceleration period is relatively long. Therefore, the second controller consumes a relatively large amount of electricity during the deceleration period. As above, the power consumption of the second controller during the deceleration period varies depending on the vehicle speed at the time when the second controller starts to control the vehicle. Therefore, it is necessary to determine the capacity of the battery in consideration of the maximum power consumption of the second controller. Therefore, the vehicle needs to be equipped with a large-capacity battery. This increases the cost of the battery and therefore increases the component cost of the vehicle.

[0005] The present disclosure provides a vehicle electronic control device, a vehicle electronic control method, and a non-transitory storage medium capable of reducing component costs of a vehicle.

[0006] A vehicle electronic control device according to a first aspect of the present disclosure includes: a detection device configured to detect the state of an occupant seated in a seat, where the occupant operates a driving control of the vehicle; a first control device; and a second control device. The detection device is configured to be powered by a first battery mounted on the vehicle. The first control device is configured to refer to a database that predefines the relationship between the occupant's state and the vehicle's maximum permissible speed. The first control device is configured to identify the vehicle's maximum permissible speed corresponding to the occupant's state detected by the detection device. The first control device is configured to autonomously drive the vehicle at a speed equal to or lower than the identified maximum permissible speed. The second control device is configured to be powered by a second battery mounted on the vehicle. The second control device is configured to refer to a database that predefines the relationship between the occupant's state and a first time. The first time is the period of time from when information is presented to the occupant to initiate manual driving by operating the driving control until the occupant initiates manual driving. A database pre-defined to define the relationship between an occupant's state and a first time is configured such that, when the first time corresponding to the occupant's second state is longer than the first time corresponding to the occupant's first state, the maximum permissible speed corresponding to the second state is lower than the maximum permissible speed corresponding to the first state. The second control device is configured to identify the first time corresponding to the detected occupant's state. The second control device is configured to begin presenting information to the vehicle occupant at a switching time, which is the time when the first control device becomes unable to control the vehicle. From the switching time onward, the second control device is configured to autonomously drive the vehicle at a speed equal to or lower than the maximum permissible speed at the switching time. The maximum permissible speed is a speed that allows the vehicle to stop within a second time by decelerating the vehicle at an absolute value less than a predetermined value. The second time is the battery duration minus the first time. The battery duration is the period from when the second battery is fully charged until the second battery can no longer continue to operate the second control device without charging. The second control device is configured to stop the vehicle if the occupant does not initiate manual driving during the period from the switching time until the identified first time has passed.

[0007] For example, the battery duration is the time period from the time when the first battery becomes unable to supply power until the second battery is no longer able to supply power to the second control device when the second battery continues to supply power to the second control device at the maximum power consumption of the second control device (a value calculated taking into account all driving conditions).

[0008] In order to apply the vehicle electronic control device according to the present disclosure to a vehicle, first, as much space as possible is ensured in the vehicle, and a power storage device that can be accommodated in the space is used as the second battery. Then, the maximum allowable speed for each state of the occupant can be limited according to the capacity of the second battery. For example, when the carrying space for the second battery in the vehicle is relatively small and the battery duration of the second battery is relatively short, a relatively small value is assigned to the maximum allowable speed for each state of the occupant. As above, when the first control device cannot control the vehicle, the second control device can be powered by a small-capacity second battery to slow down and stop the vehicle. Therefore, according to the present disclosure, a second battery with a small capacity can be used, and the component cost of the vehicle can be reduced. In other words, the vehicle electronic control device according to the present disclosure can also be applied to vehicles (small vehicles) that can only carry batteries with relatively small capacities. That is, the vehicle electronic control device according to the present disclosure is highly versatile.

[0009] In a vehicle electronic control device according to a first aspect of the present disclosure, the detection device includes a first detection device and a second detection device. The first detection device may be configured to identify a maximum permissible speed of the vehicle corresponding to a state of an occupant. The state of the occupant may be detected by the first detection device. The second detection device may be configured to identify a first time corresponding to the state of the occupant detected by the second detection device.

[0010] With this configuration, even if an abnormality occurs in the first detection device, the second detection device can detect the state of the occupant, and the second detection device can thus autonomously drive the vehicle.

[0011] The present disclosure also relates to a method used in a vehicle electronic control device and a non-transitory storage medium storing a computer program executed by the vehicle electronic control device.

[0012] A vehicle electronic control method according to a second aspect of the present disclosure is applied to a vehicle electronic control device including a detection device, a first control device configured to be powered by a first battery mounted on the vehicle, and a second control device configured to be powered by a second battery mounted on the vehicle. The vehicle electronic control method includes the detection device detecting the state of an occupant seated in a seat, where the occupant operates a driving control of the vehicle. The vehicle electronic control method includes the first control device referencing a database that pre-defines the relationship between the occupant's state and the vehicle's maximum permissible speed. The vehicle electronic control method includes the first control device identifying the vehicle's maximum permissible speed corresponding to the occupant's state. The occupant's state is detected by the detection device. The vehicle electronic control method includes the first control device autonomously driving the vehicle at a speed equal to or lower than the identified maximum permissible speed. The vehicle electronic control method includes the second control device referencing a database that pre-defines the relationship between the occupant's state and a first time. The first time is the period of time from when information is presented to cause the occupant to initiate manual driving by operating the driving control until the occupant initiates manual driving. A database pre-defining the relationship between an occupant's state and a first time is configured such that, when the first time corresponding to the occupant's second state is longer than the first time corresponding to the occupant's first state, the maximum allowable speed corresponding to the second state is lower than the maximum allowable speed corresponding to the first state. The vehicle electronic control method includes, by a second control device, identifying the first time corresponding to the detected occupant's state. The second control device also presents information to the vehicle occupant beginning at a switching time, which is the time at which the first control device becomes unable to control the vehicle. The vehicle electronic control method includes, by the second control device, autonomously driving the vehicle at a speed equal to or lower than the maximum allowable speed at the switching time, starting from the switching time. The maximum allowable speed is a speed that is achieved by decelerating the vehicle at a deceleration rate less than a predetermined value in absolute value, such that the vehicle can be stopped within a second time. The second time is the battery duration minus the first time. The battery duration is the period from when the second battery is fully charged until the second battery can no longer continue to operate the second control device without charging. The vehicle electronic control method includes, by the second control device, stopping the vehicle if the occupant does not initiate manual driving during the period from the switching time until the identified first time has elapsed.

[0013] According to a third aspect of the present disclosure, a non-transitory storage medium stores instructions that are executable by one or more processors and cause the one or more processors to perform a function of a vehicle electronic control unit. The vehicle electronic control unit includes a detection device, a first control device configured to be powered by a first battery mounted on the vehicle, and a second control device configured to be powered by a second battery mounted on the vehicle. The function includes the detection device detecting the state of an occupant seated in a seat, where the occupant operates a driving control of the vehicle. The function includes the first control device referencing a database that pre-defines the relationship between the occupant's state and the vehicle's maximum permissible speed. The function includes the first control device identifying the vehicle's maximum permissible speed corresponding to the occupant's state. The occupant's state is detected by the detection device. The function includes the first control device autonomously driving the vehicle at a speed equal to or lower than the identified maximum permissible speed. The function includes the second control device referencing a database that pre-defines the relationship between the occupant's state and a first time. The first time is the period of time from when information is presented to the occupant to initiate manual driving by operating the driving control until the occupant begins manual driving. A database pre-defines the relationship between an occupant's state and a first time, and is configured such that when the first time corresponding to the occupant's second state is longer than the first time corresponding to the occupant's first state, the maximum permissible speed corresponding to the second state is lower than the maximum permissible speed corresponding to the first state. This function includes, by a second control device, identifying the first time corresponding to the detected occupant's state. This function includes, by the second control device, presenting information to the vehicle occupant beginning at a switching time, which is the time at which the first control device becomes unable to control the vehicle. This function includes, by the second control device, autonomously driving the vehicle at a speed equal to or lower than the maximum permissible speed at the switching time, starting from the switching time. The maximum permissible speed is a speed that can be stopped within a second time by decelerating the vehicle at an absolute value less than a predetermined value. The second time is the battery duration minus the first time. The battery duration is the period from when the second battery is fully charged until the second battery can no longer operate the second control device without charging. This function includes, by the second control device, stopping the vehicle if the occupant does not initiate manual driving during the period from the switching time until the identified first time has elapsed.

[0014] Other objects, other features and attendant advantages of the present disclosure will be easily understood from the following description of the embodiments of the present disclosure given with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Features, advantages, and technical and industrial significance of exemplary embodiments of the present invention will be described below with reference to the accompanying drawings, in which like symbols represent like elements, and in which:

[0016] Figure 1 is a block diagram of a vehicle to which a vehicle electronic control device according to an embodiment of the present disclosure is applied;

[0017] Figure 2 yes Figure 1 A block diagram of the vehicle electronic control unit shown;

[0018] Figure 3 is a flowchart of the first autonomous driving program;

[0019] Figure 4 This is a conceptual diagram of the first database;

[0020] Figure 5 is a flowchart of the second autonomous driving program;

[0021] Figure 6 It is a conceptual diagram of the second database;

[0022] Figure 7A is a conceptual diagram illustrating a process in which a second central processing unit (CPU) takes over control of a vehicle from a first CPU to stop the vehicle; and

[0023] Figure 7B 1 is a conceptual diagram illustrating a process in which the second CPU takes over control of the vehicle from the first CPU to stop the vehicle. DETAILED DESCRIPTION

[0024] like Figure 1 As shown, a vehicle electronic control device (autonomous driving control device) 1 according to an embodiment of the present disclosure is applied to a vehicle V. The vehicle V includes a drive device D (engine, transmission, etc.), a brake device B, and a steering system S. The vehicle V also includes an accelerator pedal AP, a brake pedal BP, and a steering wheel SW. The accelerator pedal AP, the brake pedal BP, and the steering wheel SW are driving operators for manually controlling the drive device D, the brake device B, and the steering system S, respectively. The vehicle V also includes a display device DI for displaying video or images and an audio device AU for generating audio.

[0025] The vehicle V operates in a manual driving mode or an autonomous driving mode. The manual driving mode is an operating mode in which the occupant (driver) of the vehicle V operates the accelerator pedal AP, the brake pedal BP and the steering wheel SW to drive the vehicle V according to their operating methods. The accelerator pedal AP, the brake pedal BP and the steering wheel SW are respectively connected to the drive device D, the brake device B and the steering system S via a well-known hydraulic system. The drive device D generates a driving force according to the operation amount (depression depth) Ap of the accelerator pedal AP. The brake device B generates a braking force according to the operation amount (depression depth) Bp of the brake pedal BP. The steering system S changes the steering angle according to the operation amount (steering angle) θ of the steering wheel SW. A device (a first controller 10 to be described in detail later) forming part of the vehicle electronic control device 1 can operate when the vehicle electronic control device 1 can operate normally in the manual driving mode. The first controller 10 can be configured to assist the driver in performing driving operations (for example, to reduce the operating force of the driving operator).

[0026] The autonomous driving mode is an operating mode in which the vehicle electronic control device 1 controls the drive device D, the brake device B, and the steering system S to autonomously drive the vehicle V toward the destination specified by the occupant. That is, the drive device D generates a driving force according to the control signal DS. The brake device B generates a braking force according to the control signal BS. The steering system S changes the steering angle according to the control signal SS. Therefore, the occupant does not need to operate the accelerator pedal AP, the brake pedal BP, the steering wheel SW, etc. in the autonomous driving mode. The occupant of the vehicle V can switch the operating mode from the manual driving mode to the autonomous driving mode by operating the mode selection operator (switch, touch panel, etc.) not shown in the figure. The occupant can also switch the operating mode from the autonomous driving mode to the manual driving mode by operating the mode selection operator.

[0027] Specifically, the main electronic control unit (ECU) not shown monitors the operating mode switching operation performed using the mode selection operator (the operating mode selection operation performed by the occupant). When the main ECU detects that the autonomous driving mode has been selected, the main ECU causes the vehicle electronic control device 1 to control the drive device D, the brake device B, and the steering system S to autonomously drive the vehicle V. When the main ECU detects that the manual driving mode has been selected, the main ECU causes the vehicle electronic control device 1 to stop controlling the drive device D, the brake device B, and the steering system S. In this case, the main ECU can cause the vehicle electronic control device 1 to perform control for assisting the driver in performing the driving operation. As will be described in detail later, when an abnormality (fault) occurs in the vehicle electronic control device 1, the main ECU disables the switching operation from the manual driving mode to the autonomous driving mode. When the operating mode is switched, the main ECU causes the audio device AU to generate predetermined audio and causes the display device DI to display a predetermined image.

[0028] The vehicle V further includes a power supply device P that supplies electric power to the vehicle electronic control device 1. Figure 2 As shown, the power supply device P includes a generator PG, a first battery P1, a second battery P2 and a system separation circuit PD.

[0029] The generator PG is driven by the drive device D and outputs electric power. The output terminal PGa (positive electrode terminal and negative electrode (reference potential) terminal) of the generator PG is connected to the power supply path PL1.

[0030] The first battery P1 comprises a well-known lead-acid battery. The second battery P2 comprises a well-known lithium-ion battery. The storage capacity of the second battery P2 is smaller than that of the first battery P1. The second battery P2 is smaller than the first battery P1. The second battery P2 may comprise a power storage device composed of a large-capacity capacitor (such as an aluminum electrolytic capacitor or an electric double-layer capacitor).

[0031] The terminals P1a (positive and negative terminals) of the first battery P1 are connected to the power supply path PL1. The terminals P2a (positive and negative terminals) of the second battery P2 are connected to the power supply path PL2.

[0032] The system separation circuit PD includes a well-known direct current to direct current (DC to DC) converter composed of a switching circuit, a transformer, and the like. Terminal PDa of the circuit on the primary side (input side) of the transformer constituting the DC to DC converter of the system separation circuit PD is connected to the power supply path PL1. Terminal PDb of the circuit on the secondary side (output side) of the transformer of the system separation circuit PD is connected to the power supply path PL2. That is, the system separation circuit PD electromagnetically couples the power supply system on the first battery P1 side (power supply path PL1) and the power supply system on the second battery P2 side (power supply path PL2). The system separation circuit PD electrically isolates the power supply system on the first battery P1 side and the power supply system on the second battery P2 side from each other. Therefore, for example, even if the positive and negative poles of the first battery P1 are short-circuited, the second battery P2 is less likely to be affected by such a failure of the first battery P1. Power can thus be supplied to a device connected to the power supply path PL2 (the second controller 20 to be described later). The system separation circuit PD may include a device having the same function as a DC to DC converter, rather than a DC to DC converter. Examples of devices having the same function as the DC-to-DC converter are devices composed of a relay, a diode, and the like.

[0033] The power output from the generator PG is supplied to the first battery P1 to charge the first battery P1. The power output from the generator PG is also supplied to the second battery P2 via the system isolation circuit PD to charge the second battery P2. When the generator PG is not outputting power, the power from the first battery P1 can be supplied to the second battery P2 via the system isolation circuit PD to charge the second battery P2. The capacity of the second battery P2 is relatively small. Therefore, after the drive device D of the vehicle V is started and the generator PG begins operating, the amount of power stored in the second battery P2 reaches its maximum value (fully charged) within a relatively short period of time.

[0034] The vehicle electronic control device 1 includes a first controller 10 and a second controller 20. The first controller 10 and the second controller 20 are connected to a communication bus CAN.

[0035] The first controller 10 includes a first sensor 11, a first autonomous driving control device 12, a first driving force control device 13, a first braking force control device 14, and a first steering angle control device 15. The first sensor 11, the first autonomous driving control device 12, the first driving force control device 13, the first braking force control device 14, and the first steering angle control device 15 are connected to a communication bus CAN. The power supply terminals of the devices comprising the first controller 10 are connected to a power supply path PL1. In other words, power from the first battery P1 is supplied to the first sensor 11, the first autonomous driving control device 12, the first driving force control device 13, the first braking force control device 14, and the first steering angle control device 15 via the power supply path PL1.

[0036] The first sensor 11 includes an environmental sensor 111. The environmental sensor 111 acquires data for identifying (perceiving) the driving environment of the vehicle V. The environmental sensor 111 includes an optical sensor (digital camera), a radar, a navigation system, a vehicle speed sensor, and the like. The optical sensor captures images of the road ahead of the vehicle V. The radar detects the distance to obstacles around the vehicle V. The navigation system detects the current position (latitude and longitude) of the vehicle V. The vehicle speed sensor detects the speed of the vehicle V. Data representing the detection results of each device included in the environmental sensor 111 is supplied to the first autonomous driving control device 12 via the communication bus CAN.

[0037] The first sensor 11 also includes an occupant sensor 112. The occupant sensor 112 acquires data for identifying (perceiving) the state (posture, behavior, etc.) of the occupant of the vehicle V. As used herein, an occupant refers to an occupant sitting in a seat provided with an accelerator pedal AP, a brake pedal BP, and a steering wheel SW. The occupant sensor 112 includes an optical sensor (digital camera), a seat sensor, a contact sensor, and the like. The optical sensor captures an image of the occupant. The seat sensor detects the angle of the seat back. The contact sensor detects whether the occupant is contacting the steering wheel SW. The occupant sensor 112 may further include a sensor that detects the operation amount Ap of the accelerator pedal AP, the operation amount Bp of the brake pedal BP, and the operation amount θ (steering angle) of the steering wheel SW. Data representing the detection results of each device included in the occupant sensor 112 is supplied to the first autonomous driving control device 12 via the communication bus CAN.

[0038] The first autonomous driving control device 12 includes a microcomputer composed of a calculation unit (hereinafter referred to as a “first CPU”), a storage device, a timer, and the like.

[0039] The first CPU has a self-diagnostic function to detect whether an abnormality has occurred in the first system consisting of the first battery P1 and the first controller 10. When the drive device D of the vehicle V is started, the first CPU initializes its internal error flag F to "0," indicating that the first system is normal. Next, the first CPU begins monitoring the output voltage of the first battery P1. As long as the output voltage of the first battery P1 is within a predetermined voltage range, the first CPU does not update error flag F. If the output voltage of the first battery P1 exceeds this range, the first CPU updates error flag F to "1," indicating that an abnormality has occurred in the first system.

[0040] The first CPU also periodically sends a response request signal to the first sensor 11, the first driving force control device 13, the first braking force control device 14, and the first steering angle control device 15. The first sensor 11, the first driving force control device 13, the first braking force control device 14, and the first steering angle control device 15 are configured to send a predetermined response signal to the first CPU within a predetermined time after receiving the response request signal. If the first CPU receives a response signal from the first sensor 11, the first driving force control device 13, the first braking force control device 14, and the first steering angle control device 15 within a predetermined time after the first CPU sends the response request signal, the first CPU will not update the error flag F. If the first CPU fails to receive a response signal from any one or more of the first sensor 11, the first driving force control device 13, the first braking force control device 14, and the first steering angle control device 15 within a predetermined time after the first CPU sends the response request signal, the first CPU updates the error flag F to "1." The main ECU periodically reads the error flag F. When the error flag F is "0," the main ECU permits the switching of the operating mode. When the error flag F is "1", the main ECU disables the switching operation from the manual driving mode to the autonomous driving mode by the occupant and will not change the operating mode.

[0041] When the main ECU detects that the autonomous driving mode has been selected by the occupant (the operation mode has been switched from the manual driving mode to the autonomous driving mode) and the error flag F is "0", the main ECU causes the first CPU to execute Figure 3 The first autonomous driving procedure is shown.

[0042] In step 300, the first CPU starts the first autonomous driving process. Then, the first CPU obtains data representing the image of the road in front of the vehicle V, the distance to the obstacle, the current position of the vehicle V, the speed of the vehicle V, etc. from the environmental sensor 111. In step 301, the first CPU determines (perceives) the driving environment of the vehicle V (the degree of curvature of the driving lane, the position of the vehicle V in the lane, the following distance, the presence or absence of obstacles, etc.) based on the data. Thereafter, the first CPU obtains data representing the image of the occupant, the angle of the seat back, whether the occupant is touching the steering wheel SW, etc. from the occupant sensor 112. In step 302, the first CPU recognizes (perceives) the state of the occupant (posture, behavior (for example, changes in hand position, changes in line of sight, etc.)) based on the data.

[0043] The storage device of the first autonomous driving control device 12 stores the representation in the form of a lookup table (map). Figure 4A database D1 showing the relationship between the state of the occupant shown and the maximum permissible speed Smax for autonomous driving. As will be described in detail later, when the first controller 10 becomes unable to control the vehicle V, the second controller 20 takes over control of the vehicle V. As soon as the second controller 20 starts controlling the vehicle V, information is presented for causing the occupant to start operating the driving operator. A certain amount of time is required from when this information is presented until the occupant actually starts the driving operation of the vehicle V. Hereinafter, this time is also referred to simply as the "manual driving start time." Figure 4 As shown, a relatively large value has been assigned to the maximum permissible speed Smax corresponding to the state of the occupant in which "the manual driving start time is relatively short" (see, for example Figure 4 (a) in FIG. 2 ). A relatively small value has been assigned to the maximum permissible speed Smax corresponding to the state of the occupant in which “the manual driving start time is relatively long” (see, for example, Figure 4 (d) in the manual driving start time is obtained statistically. The value assigned to the maximum allowable speed Smax corresponding to each state in the database D1 is not limited to Figure 4 , and other values ​​may be assigned to the maximum permissible speed Smax. The "occupant's state" in the database D1 is not limited to Figure 4 The states shown and may include other states.

[0044] Refer again Figure 3 , in step 303, the first CPU refers to the database D1 and identifies (reads) the maximum allowable speed Smax corresponding to the sensed state of the passenger.

[0045] Then, in step 304, the first CPU controls the driving device D, the braking device B and the steering system S. Specifically, the first CPU determines the autonomous driving mode of the vehicle V (the direction in which the vehicle V should travel (the desired direction) and the speed at which the vehicle V should travel (the desired speed)) based on the identified driving environment and the identified maximum allowable speed Smax. At this time, the first CPU determines the desired speed so that the desired speed does not exceed the maximum allowable speed Smax. The first CPU controls the first driving force control device 13, the first braking force control device 14 and the first steering angle control device 15 so that the vehicle V travels in the determined manner. The first driving force control device 13, the first braking force control device 14 and the first steering angle control device 15 thus controlled by the first CPU respectively control the driving device D, the braking device B and the steering system S. That is, as Figure 3As shown, the first CPU generates expected value data representing the expected value of the driving force DD, the expected value of the braking force BD, and the expected value of the steering angle SD based on the sensing results. The first CPU provides the expected value data to the first driving force control device 13, the first braking force control device 14, and the first steering angle control device 15. The routine then returns to step 301.

[0046] The first driving force control device 13 generates a control signal DS based on the desired value DD of the driving force and supplies the control signal DS to the driving device D. That is, the first driving force control device 13 controls the driving device D so that the driving force generated by the driving device D matches the desired value DD.

[0047] The first braking force control device 14 generates a control signal BS based on the desired value BD of the braking force and supplies the control signal BS to the braking device B. That is, the first braking force control device 14 controls the braking device B so that the braking force generated by the braking device B matches the desired value BD.

[0048] The first steering angle control device 15 generates a control signal SS based on the desired value SD of the steering angle and supplies the control signal SS to the steering system S. That is, the first steering angle control device 15 controls the steering system S so that the steering angle matches the desired value SD.

[0049] When the first CPU senses that the occupant has fallen asleep in step 302 , the first CPU immediately starts “a process of decelerating and stopping the vehicle V”.

[0050] As will be described in detail later, when it is determined that an abnormality has occurred in the first system and the first CPU cannot control the vehicle V (when the error flag F is "1"), the second controller 20 controls the vehicle V in place of the first controller 10. The second controller 20 includes a second sensor 21, a second autonomous driving control device 22, a second driving force control device 23, a second braking force control device 24, and a second steering angle control device 25. These devices are similar to the first sensor 11, first autonomous driving control device 12, first driving force control device 13, first braking force control device 14, and first steering angle control device 15 of the first controller 10, respectively. The second sensor 21, second autonomous driving control device 22, second driving force control device 23, second braking force control device 24, and second steering angle control device 25 are connected to the communication bus CAN. The power supply terminals of the devices making up the second controller 20 are connected to the power supply path PL2. In other words, power from the second battery P2 is supplied to the second sensor 21, second autonomous driving control device 22, second driving force control device 23, second braking force control device 24, and second steering angle control device 25 via the power supply path PL2.

[0051] In autonomous driving mode, the arithmetic unit of the second autonomous driving control device 22 (hereinafter referred to as the "second CPU") periodically reads the error flag F of the first CPU via the communication bus CAN. If the read error flag F is "0," the second CPU stops the second driving force control device 23, the second braking force control device 24, and the second steering angle control device 25.

[0052] When the error flag F read is "1" or the error flag F cannot be read by the second CPU (when the first CPU does not respond), the second CPU executes Figure 5 The second autonomous driving program is shown. In step 500, the second CPU begins the second autonomous driving process. In step 501, the second CPU sends a signal to pause the first driving force control device 13, the first braking force control device 14, and the first steering angle control device 15, thereby stopping these devices. Subsequently, in step 502, the second CPU takes over control of the vehicle V in place of the first CPU. Specifically, the second CPU controls the second driving force control device 23, the second braking force control device 24, and the second steering angle control device 25 based on data acquired from the second sensor 21 to autonomously drive the vehicle V. The maximum permissible speed Smax at this time is the speed at which the second CPU takes over control of the vehicle V from the first CPU.

[0053] In step 503, the second CPU causes the audio device AU to generate a warning sound AS to prompt the occupant to operate the driving control to start manual driving. This warning sound may be a message stating "Please start manual driving." At this point, the second CPU may cause the display device DI to display the message "Please start manual driving." In other words, the second CPU uses visual or auditory means to warn the occupant.

[0054] A certain amount of time is required from the time the warning sound AS is generated until the occupant is ready to drive the vehicle V. This time depends on the occupant's state at the time the warning sound AS is generated. Therefore, the second CPU autonomously drives the vehicle V while waiting for the occupant to initiate the driving operation. If the occupant does not initiate the driving operation even after a predetermined first time T1, which is based on the occupant's state at the time the warning sound AS is generated, has passed, the second CPU decelerates and stops the vehicle V. If the second CPU senses that the occupant has fallen asleep, it immediately initiates the process of decelerating and stopping the vehicle V.

[0055] Specifically, in step 504 , the second CPU acquires data representing the state of the occupant from the occupant sensor 212 , and perceives the state of the occupant based on the data.

[0056] The storage device of the second autonomous driving control device 22 stores the representation in the form of a lookup table (map). Figure 6The database D2 shows the relationship between the state of the occupant and the first time T1. A statistically obtained standard value (e.g., an average value) has been assigned to the first time T1 corresponding to each state of the occupant. In step 505, the second CPU refers to the database D2 and identifies (reads) the first time T1 corresponding to the sensed state of the occupant. The value assigned to the first time T1 corresponding to each state in the database D2 is not limited to Figure 6 , and other values ​​may be assigned to the first time T1. The "occupant's state" in the database D2 is not limited to Figure 6 States shown and may include other states.

[0057] Thereafter, in step 506 , the second CPU starts measuring the elapsed time T from the current time using the timer.

[0058] In step 507, the second CPU acquires data representing the occupant's status from the occupant sensor 212 and, based on this data, determines whether the occupant has initiated a driving operation. If the occupant has initiated a driving operation (e.g., if the occupant has initiated steering wheel SW operation (step 507: Yes)), the second CPU causes the main ECU to switch the operating mode of the vehicle V to manual driving mode in step 508, and terminates the second autonomous driving process in step 511. In other words, in this case, even if the occupant has not operated the mode selector, the initiation of a driving operation by the occupant triggers the switch to manual driving mode. The second driving force control device 23, the second braking force control device 24, and the second steering angle control device 25 are then deactivated.

[0059] If the occupant has not initiated a driving operation in step 507 (for example, if the occupant is not touching the steering wheel (step 507: No)), the second CPU determines in step 509 whether the elapsed time T has reached the identified first time T1. If the elapsed time T has not yet reached the identified first time T1 (step 509: No), the routine returns to step 507. If the elapsed time T has reached the identified first time T1 (step 509: Yes), in step 510, the second CPU stops the vehicle V within a predetermined second time T2, which will be described later. For example, the second CPU decelerates the vehicle V at a constant or variable deceleration (negative acceleration) while moving the vehicle V from the passing lane to the driving lane. The second CPU then moves the vehicle V to the shoulder of the road and stops it there. In step 511, the second CPU terminates the second autonomous driving process. The deceleration in this case is preset to a value that neither causes discomfort to the occupant nor requires the following vehicle to abruptly decelerate.

[0060] The second time T2 is the battery duration Tmax (e.g., "60 seconds", see Figure 7A and Figure 7B ) minus the first time T1 (T2=Tmax-T1). The battery duration Tmax is the maximum time until the second battery P2, which is fully charged and not recharged, can no longer continue to operate the second controller 20. That is, the second time T2 is the time during which the second controller 20 can operate with the maximum capacity of the second battery P2 minus the amount of power consumed by the second controller 20 within the first time T1. Therefore, when the first time T1 is relatively short (e.g., "5 seconds"), the time T2 available for stopping the vehicle V is relatively long (e.g., "55 seconds" (see Figure 7A )). Therefore, in this case, a relatively large value is assigned to the maximum permissible speed Smax (see Figure 4 On the other hand, when the first time T1 is relatively long (for example, "30 seconds"), the time T2 available for stopping the vehicle V is relatively short (for example, "30 seconds" (see Figure 7B )). Therefore, a relatively small value is assigned to the maximum permissible speed Smax, so that the vehicle V can be stopped within such a relatively short time T2 without causing occupants to feel uneasy and without requiring the following vehicle to suddenly decelerate (see Figure 4 (d) in the above figure.

[0061] As described above, the speed at which the first CPU autonomously drives the vehicle V is limited to a value equal to or lower than the maximum permissible speed Smax, depending on the occupant's state. The maximum permissible speed Smax is equal to the maximum value of the speeds at which the second CPU begins decelerating the vehicle V, at which the second CPU can stop the vehicle V within a second time T2 (i.e., the battery duration Tmax minus the first time T1). For example, the second CPU can decelerate and stop the vehicle V at a constant deceleration. To apply the vehicle electronic control device 1 configured as described above to the vehicle V, the vehicle V is first provided with as much space as possible, and a power storage device that can accommodate this space is used as the second battery P2. The maximum permissible speed Smax for each occupant's state is then defined based on the capacity of the second battery P2. For example, when the vehicle V is a small vehicle with relatively little space for the second battery P2 and a relatively short battery duration Tmax, a relatively small value is assigned to the maximum permissible speed Smax for each occupant's state. As described above, when the first controller 10 is unable to control the vehicle V, the second controller 20 can be powered by the small-capacity second battery P2 to decelerate and stop the vehicle V. According to this embodiment, since a small-capacity power storage device can be used as the second battery P2, it is possible to reduce the component cost of the vehicle V. In other words, the vehicle electronic control device 1 can also be applied to small vehicles. That is, the vehicle electronic control device 1 is highly versatile.

[0062] Modification

[0063] The present disclosure is not limited to the above embodiments, and various modifications can be made within the scope of the present disclosure.

[0064] First Modification

[0065] For example, the database D1 may be editable by a user (passenger). Specifically, when a user increases the maximum allowable speed Smax for a certain state X in the database D1, the second CPU reduces the first time T1 for the state X in the database D2 according to the amount of increase in the maximum allowable speed Smax. The database D2 may be editable by a user. Specifically, when a user increases the first time T1 for a certain state X in the database D2, the first CPU reduces the maximum allowable speed Smax for the state X in the database D1 according to the amount of increase in the first time T1. According to this configuration, the control method of the autonomous driving of the vehicle V performed by the first CPU and the second CPU can be changed according to the user's preferences. The above describes an embodiment of the technology of the present disclosure. However, the present disclosure is not limited to a vehicle electronic control device, but may be a method performed by a vehicle electronic control device and a computer-readable non-transitory storage medium storing instructions for causing a computer to perform the functions of a vehicle electronic control device.

Claims

1. A vehicle electronic control device, characterized in that: include: a detection device configured to detect a state of an occupant seated in a seat, the occupant operating a driving operator of the vehicle at the seat; The first control device is configured as follows: powered by a first battery mounted on the vehicle, referring to a database predefining a relationship between the occupant's state and the vehicle's maximum permissible speed, identifying a maximum permissible speed of the vehicle corresponding to a state of the occupant, the state of the occupant being detected by the detection device, and autonomously driving the vehicle at a speed equal to or less than the identified maximum permissible speed; as well as The second control device is configured as follows: powered by a second battery mounted on the vehicle, referring to a database that predefines a relationship between a state of the occupant and a first time, the first time being a period of time from when information causing the occupant to start manual driving by operating the driving operator is presented until the occupant starts the manual driving, and the database that predefines a relationship between the state of the occupant and the first time is set in such a manner that, when the first time corresponding to a second state of the occupant is longer than the first time corresponding to the first state of the occupant, the maximum allowable speed corresponding to the second state is lower than the maximum allowable speed corresponding to the first state, identifying the first time corresponding to the detected state of the occupant, starting presentation of the information to the occupant of the vehicle at a switching time, the switching time being a time when the first control device becomes unable to control the vehicle, autonomously driving the vehicle from the switching time at a speed equal to or lower than the maximum allowable speed at the switching time, the maximum allowable speed being a speed at which the vehicle can be stopped within a second time by decelerating the vehicle at a deceleration whose absolute value is smaller than a predetermined value, the second time being a battery duration minus the first time, and the battery duration being a period from when the second battery is in a fully charged state until the second battery can no longer continue to operate the second control device without being charged, and When the occupant does not start the manual driving during a period from the switching time until the identified first time elapses, the vehicle is stopped for the second time.

2. The vehicle electronic control device according to claim 1, characterized in that: The detection device includes a first detection device and a second detection device; the first control device is configured to identify the maximum allowable speed of the vehicle corresponding to the state of the occupant, the state of the occupant being detected by the first detection device; and The second control device is configured to identify a first time corresponding to the state of the occupant detected by the second detection device.

3. A vehicle electronic control method, applied to a vehicle electronic control device comprising a detection device, a first control device configured to be powered by a first battery mounted on the vehicle, and a second control device configured to be powered by a second battery mounted on the vehicle, characterized in that: The vehicle electronic control method comprises: detecting, by the detection device, a state of an occupant seated in a seat, the occupant operating a driving operator of the vehicle at the seat; referring, by the first control device, to a database that predefines a relationship between the state of the occupant and the maximum permissible speed of the vehicle; identifying, by the first control device, a maximum permissible speed of the vehicle corresponding to a state of the occupant, the state of the occupant being detected by the detection device; autonomously driving the vehicle by the first control device at a speed equal to or less than the identified maximum permissible speed; the second control device refers to a database that preliminarily defines a relationship between a state of the occupant and a first time, the first time being a period of time from when information causing the occupant to start manual driving by operating the driving operator is presented until the occupant starts the manual driving, and the database that preliminarily defines the relationship between the state of the occupant and the first time is set in such a manner that when the first time corresponding to the second state of the occupant is longer than the first time corresponding to the first state of the occupant, the maximum permissible speed corresponding to the second state is lower than the maximum permissible speed corresponding to the first state; identifying, by the second control device, the first time corresponding to the detected state of the occupant; presenting the information to an occupant of the vehicle by the second control device beginning at a switching time, the switching time being a time when the first control device becomes unable to control the vehicle; the vehicle is autonomously driven by the second control device from the switching time at a speed equal to or lower than the maximum allowable speed at the switching time, the maximum allowable speed being a speed at which the vehicle can be stopped within a second time by decelerating the vehicle at a deceleration rate whose absolute value is smaller than a predetermined value, the second time being a battery duration minus the first time, and the battery duration being a period from when the second battery is in a fully charged state until the second battery can no longer continue to operate the second control device without being charged; and When the occupant does not start the manual driving during a period from the switching time until the identified first time elapses, the vehicle is stopped by the second control device within the second time.

4. A non-transitory storage medium storing instructions, wherein the instructions are executable by one or more processors and cause the one or more processors to perform functions of a vehicle electronic control device, wherein the vehicle electronic control device includes a detection device, a first control device configured to be powered by a first battery mounted on the vehicle, and a second control device configured to be powered by a second battery mounted on the vehicle, wherein: The features include: detecting, by the detection device, a state of an occupant seated in a seat, the occupant operating a driving operator of the vehicle at the seat; referring, by the first control device, to a database that predefines a relationship between the state of the occupant and the maximum permissible speed of the vehicle; identifying, by the first control device, a maximum permissible speed of the vehicle corresponding to a state of the occupant, the state of the occupant being detected by the detection device; autonomously driving the vehicle by the first control device at a speed equal to or less than the identified maximum permissible speed; the second control device refers to a database that preliminarily defines a relationship between a state of the occupant and a first time, the first time being a period of time from when information causing the occupant to start manual driving by operating the driving operator is presented until the occupant starts the manual driving, and the database that preliminarily defines the relationship between the state of the occupant and the first time is set in such a manner that when the first time corresponding to the second state of the occupant is longer than the first time corresponding to the first state of the occupant, the maximum permissible speed corresponding to the second state is lower than the maximum permissible speed corresponding to the first state; identifying, by the second control device, the first time corresponding to the detected state of the occupant; presenting the information to an occupant of the vehicle by the second control device beginning at a switching time, the switching time being a time when the first control device becomes unable to control the vehicle; the vehicle is autonomously driven by the second control device from the switching time at a speed equal to or lower than the maximum allowable speed at the switching time, the maximum allowable speed being a speed at which the vehicle can be stopped within a second time by decelerating the vehicle at a deceleration rate whose absolute value is smaller than a predetermined value, the second time being a battery duration minus the first time, and the battery duration being a period from when the second battery is in a fully charged state until the second battery can no longer continue to operate the second control device without being charged; and When the occupant does not start the manual driving during a period from the switching time until the identified first time elapses, the vehicle is stopped by the second control device within the second time.

Images