Mobile body control method, mobile body control system, and computer-readable recording medium

Abstract

The present invention relates to a mobile body control method, a mobile body control system, and a computer-readable recording medium. The present invention suppresses abuse of a function of a mobile body that acts in accordance with a remote instruction in a prescribed area. The mobile body control method controls a mobile body that has a function of acting in accordance with a remote instruction in a prescribed area. The mobile body control method includes remote instruction verification processing that determines whether a remote instruction received by the mobile body is appropriate, and action restriction processing that restricts at least a part of an action of the mobile body without following the remote instruction in a case where the remote instruction received by the mobile body is not appropriate. The remote instruction verification processing includes determining whether the mobile body exists within the prescribed area when the mobile body receives the remote instruction, and determining that the remote instruction is not appropriate in a case where the mobile body does not exist within the prescribed area when the mobile body receives the remote instruction.

Description

Technical Field

[0001] This disclosure relates to techniques for controlling a mobile body that has the function of performing actions according to remote instructions within a designated area. Background Technology

[0002] Patent Document 1 discloses a control device used in a parking lot for automated valet parking. The vehicle reads a marker set in the parking lot and estimates its absolute position based on the relative distance between the vehicle and the marker. Meanwhile, the control device acquires information about the vehicle's position measured by sensors installed within the parking lot. The control device compares a static estimation accuracy with a reference value, where the static estimation accuracy is the difference between the estimated vehicle position and the measured vehicle position. If the static estimation accuracy is below the reference value, the control device prevents the vehicle from using the automated valet parking function.

[0003] Existing technical documents

[0004] Patent documents

[0005] Patent Document 1: International Publication No. 2021 / 166620

[0006] Consider a mobile entity (e.g., a vehicle, a robot) capable of operating within a designated area according to remote instructions. For example, a vehicle in an automated valet parking system receives a remote instruction from the management system to turn on its power when entering or exiting a parking lot (designated area). The vehicle automatically turns on its power according to the received remote instruction and then begins automated movement within the parking lot.

[0007] Remote control of mobile devices is useful in providing services that utilize mobile devices. However, because mobile devices have the ability to act according to remote instructions, this function can be abused. That is, a malicious person could spoof remote instructions and issue fake ones, thereby causing the mobile device to act arbitrarily (hijacking). For example, consider someone maliciously turning on the power to the mobile device and unlocking the doors to steal it. As another example, consider someone maliciously turning on the power to the mobile device and making it move automatically, causing an accident. Summary of the Invention

[0008] One object of this disclosure is to provide a technique for preventing the abuse of the function of a mobile body that performs actions according to remote instructions within a designated area.

[0009] The first perspective relates to a motion control method that controls a mobile body capable of performing actions within a designated area according to remote instructions.

[0010] The mobile body control method includes: remote instruction verification processing to determine whether the remote instruction received by the mobile body is appropriate; and action restriction processing to restrict at least a portion of the mobile body's actions without following the remote instruction if the remote instruction received by the mobile body is inappropriate.

[0011] The remote instruction verification process includes: determining whether the mobile body exists within a specified area when it receives a remote instruction; and determining that the remote instruction is inappropriate if the mobile body does not exist within the specified area when it receives the remote instruction.

[0012] The second perspective relates to a mobile body control system that controls a mobile body capable of performing actions within a designated area according to remote instructions.

[0013] The mobile body control system has one or more processors.

[0014] One or more processors are configured to perform: remote instruction verification processing to determine whether a remote instruction received by a mobile body is appropriate; and motion restriction processing to restrict at least a portion of the mobile body's motion without following the remote instruction if the remote instruction received by the mobile body is inappropriate.

[0015] The remote instruction verification process includes: determining whether the mobile body exists within a specified area when it receives a remote instruction; and determining that the remote instruction is inappropriate if the mobile body does not exist within the specified area when it receives the remote instruction.

[0016] The third perspective relates to a mobile body control program that controls mobile bodies capable of performing actions within a designated area according to remote instructions.

[0017] The movement control program is executed by a computer.

[0018] The mobile body control program is configured to cause the computer to perform: remote instruction verification processing to determine whether the remote instruction received by the mobile body is appropriate; and action restriction processing to restrict at least a portion of the mobile body's actions without following the remote instruction if the remote instruction received by the mobile body is inappropriate.

[0019] The remote instruction verification process includes: determining whether the mobile body exists within the specified area when it receives a remote instruction; and determining that the remote instruction is inappropriate if the mobile body does not exist within the specified area when it receives the remote instruction.

[0020] Invention Effects

[0021] According to this disclosure, when a mobile body receives a remote instruction, a remote instruction verification process is performed to determine whether the remote instruction is appropriate. If the remote instruction received by the mobile body is inappropriate, an action restriction process is performed that restricts at least a portion of the mobile body's actions in a manner inconsistent with the remote instruction. Thus, the function of preventing the mobile body from abusing its ability to perform actions according to the remote instruction is prevented. Attached Figure Description

[0022] Figure 1 This is a concept diagram used to illustrate the outline of the vehicle in the implementation method.

[0023] Figure 2 This is a block diagram used to illustrate the overview of the vehicle-mounted system of the implementation method.

[0024] Figure 3 This is a concept diagram used to illustrate automated valet parking.

[0025] Figure 4 This is a conceptual diagram used to illustrate mobility services.

[0026] Figure 5 This is a concept map used to explain the first question.

[0027] Figure 6 This is a concept map used to explain the second question.

[0028] Figure 7 A block diagram illustrating the overview of the remote instruction verification process in the implementation method.

[0029] Figure 8 A flowchart illustrating the process associated with the remote instruction verification process of the implementation method.

[0030] Figure 9 This is a block diagram used to explain the region verification unit for implementing the region verification process.

[0031] Figure 10 This is a conceptual diagram illustrating various examples of region verification processing for implementation methods.

[0032] Figure 11 This is a flowchart that summarizes the area verification process of the implementation method.

[0033] Figure 12 This is a block diagram for explaining the signal transmission source verification unit for implementing the signal transmission source verification process.

[0034] Figure 13 This is a conceptual diagram illustrating an example of the signal transmission source verification process in an implementation method.

[0035] Figure 14 This is a flowchart that summarizes the signal transmission source verification process of the implementation method.

[0036] Figure 15 This is a block diagram illustrating the identification result verification unit used for verifying the identification result in the implementation method.

[0037] Figure 16 This is a conceptual diagram illustrating an example of the identification result verification process for an implementation method.

[0038] Figure 17 This is a flowchart that summarizes the identification result verification process of the implementation method.

[0039] Figure 18 This is a block diagram illustrating an example of the configuration of an in-vehicle system according to an implementation method.

[0040] Figure 19 This is a block diagram illustrating an example of driving environment information in an implementation method.

[0041] Figure 20 This is a block diagram illustrating an example of the configuration of a management system for implementing an embodiment.

[0042] Explanation of reference numerals in the attached figures:

[0043] 1 vehicle;

[0044] 2. Management system;

[0045] 3. User terminals;

[0046] 10. In-vehicle systems;

[0047] 11. Remote indication receiving unit;

[0048] 12. Vehicle Control Unit;

[0049] 20 sensor groups;

[0050] 30. Driving device;

[0051] 40 lights / speaker;

[0052] 50 communication devices;

[0053] 60 control devices;

[0054] 70 processor;

[0055] 80 storage devices;

[0056] 90 Driving environment information;

[0057] 100 Remote Instruction Verification Department;

[0058] 110 Area Verification Department;

[0059] 120 signal transmission source verification unit;

[0060] 130 Recognition Result Verification Department;

[0061] 210 communication devices;

[0062] 220 processor;

[0063] 230 storage devices;

[0064] 240 Management Procedures;

[0065] 250 map information;

[0066] 260 vehicle information;

[0067] 270 Management Information;

[0068] M landmark;

[0069] X is a disguised remote signaler;

[0070] AR-designated area;

[0071] INS remote indication;

[0072] INS-F disguised remote indication;

[0073] LMT action restriction signal;

[0074] TRG trigger signal. Detailed Implementation

[0075] The embodiments of this disclosure will be described with reference to the accompanying drawings.

[0076] 1. A moving entity that performs actions according to remote instructions.

[0077] 1-1. Overview

[0078] Consider a mobile body capable of performing actions according to remote instructions. Examples of mobile bodies include vehicles and robots. As an example, in the following description, the mobile body is considered to be a vehicle. Generally, "mobile body" will be used instead of "vehicle" in the following description.

[0079] Figure 1 This is a conceptual diagram used to illustrate the outline of vehicle 1 in this embodiment. Vehicle 1 has the function of operating according to remote instruction INS. In particular, vehicle 1 has the function of operating according to remote instruction INS within a designated area AR.

[0080] The designated area AR is, for example, an area where vehicle 1 can drive autonomously. In this case, vehicle 1 drives autonomously within the designated area AR according to remote instructions INS. As another example, the designated area AR can also be an area that provides services utilizing vehicle 1. In this case, vehicle 1 provides services within the designated area AR according to remote instructions INS. Various examples of designated area ARs will be described later.

[0081] The remote instruction INS, for example, instructs the power supply to vehicle 1 to be turned on (ON) or off (OFF). "Turning on the power supply to vehicle 1" means making vehicle 1 operational. For example, turning on the power supply to vehicle 1 includes initiating power supply to various devices mounted on vehicle 1. Furthermore, turning on the power supply to vehicle 1 includes turning on the ignition switch of vehicle 1. On the other hand, "turning off the power supply to vehicle 1" means making vehicle 1 inoperable. For example, turning off the power supply to vehicle 1 includes turning off the ignition switch of vehicle 1. As another example, turning off the power supply to vehicle 1 may also include stopping the power supply to various devices mounted on vehicle 1. However, even after the power supply to vehicle 1 is turned off, the function of receiving the remote instruction INS is still activated. Thus, even after the power supply is turned off, vehicle 1 can still receive the remote instruction INS instructing the power supply to be turned on, and automatically turn the power supply back on according to the remote instruction INS.

[0082] As another example, the remote instruction INS can also instruct vehicle 1 to steer, accelerate, and decelerate at least one of these actions. As yet another example, the remote instruction INS can also instruct vehicle 1 to drive autonomously. As yet another example, the remote instruction INS can also instruct the use of identification sensors mounted on vehicle 1 to identify the surrounding conditions of vehicle 1.

[0083] As another example, the remote indicator INS can also indicate whether the doors of vehicle 1 are locked or unlocked.

[0084] The remote instruction INS is generated by the management system 2. The management system 2 manages at least vehicle 1 within the designated area AR. The management system 2 can also manage the designated area AR. The management system 2 can also manage services provided by vehicle 1 within the designated area AR. Vehicle 1 and the management system 2 can communicate with each other. The management system 2 sends the remote instruction INS to vehicle 1 within the designated area AR as needed. Vehicle 1 within the designated area AR receives the remote instruction INS sent from the management system 2 and performs actions according to the received remote instruction INS.

[0085] Management system 2 can be implemented, for example, through a management server in the cloud. Management system 2 can also consist of multiple servers performing distributed processing.

[0086] Figure 2 This is a block diagram used to illustrate the general structure of the vehicle-mounted system 10 installed in vehicle 1. The vehicle-mounted system 10 includes a remote instruction receiver 11 and a vehicle control unit 12.

[0087] The remote instruction receiving unit 11 receives remote instruction INS sent from the management system 2. It should be noted that the remote instruction receiving unit 11 continues to operate even after the power to the vehicle 1 is disconnected, waiting for the remote instruction INS sent from the management system 2.

[0088] The vehicle control unit 12 controls the vehicle 1. For example, controlling the vehicle 1 includes turning the power supply on or off. As another example, controlling the vehicle 1 includes controlling its movement (steering, acceleration, and deceleration). As yet another example, controlling the vehicle 1 may include autonomous driving control. As yet another example, controlling the vehicle 1 may include using identification sensors mounted on the vehicle 1 to identify the surrounding environment. As yet another example, controlling the vehicle 1 may include locking or unlocking the vehicle 1's doors. As yet another example, controlling the vehicle 1 may include turning on or off the vehicle 1's lights (e.g., headlights, hazard lights). As yet another example, controlling the vehicle 1 may include sounding the vehicle 1's horn (car horn).

[0089] When the remote instruction receiving unit 11 receives a remote instruction INS, the vehicle control unit 12 controls the vehicle 1 according to the received remote instruction.

[0090] The following is an example of vehicle 1 performing actions according to remote instructions INS within a designated area AR.

[0091] 1-2. Automated valet parking

[0092] Figure 3 This is a conceptual diagram used to illustrate Automated Valet Parking (AVP). In this example, the designated area AR is a parking lot. The parking lot can be indoors or outdoors. Multiple landmarks (markers) M are configured within the parking lot. Landmarks M are assigned identification information.

[0093] AVP vehicle 1A is a vehicle 1 for automated valet parking in a parking lot. AVP vehicle 1A is capable of autonomous driving, at least within the parking lot. More specifically, AVP vehicle 1A is equipped with recognition sensors (e.g., cameras) for recognizing the surrounding conditions. AVP vehicle 1A drives autonomously in the parking lot while using the recognition sensors to recognize the surrounding conditions.

[0094] For example, AVP vehicle 1A uses a camera to acquire images representing the surrounding conditions of AVP vehicle 1A and identifies landmark M based on the images. AVP vehicle 1A can identify the parking area based on the recognition result of landmark M. In addition, AVP vehicle 1A performs "localization processing" to accurately estimate its position in the parking lot based on the recognition result of landmark M. More specifically, AVP vehicle 1A combines the recognition result of landmark M based on the camera with map information of landmark M in the parking lot to accurately estimate its own position. The target path PT is the movement path from the parking area to the target parking frame assigned to AVP vehicle 1A. AVP vehicle 1A automatically drives by following the target path PT based on the position of AVP vehicle 1A estimated through localization processing and the target path PT. Thus, AVP vehicle 1A can automatically move from the parking area to the target parking frame.

[0095] Management system 2 manages the automated valet parking (AVP) vehicles in the parking lot. Management system 2 can communicate with the vehicle group, including AVP vehicle 1A within the parking lot. For example, management system 2 issues remote instructions (INS) to AVP vehicle 1A. For instance, the remote instruction INS indicates whether the power to AVP vehicle 1A is on or off. As another example, the remote instruction INS indicates the start of automated driving. Management system 2 can also provide map information of landmarks M in the parking lot to AVP vehicle 1A. Management system 2 can also assign parking frames to AVP vehicle 1A. Management system 2 can also generate a target path PT from the entry area to the assigned parking frame and provide the target path PT information to AVP vehicle 1A. Management system 2 can also track the location of the vehicle group, including AVP vehicle 1A within the parking lot. Management system 2 can also remotely operate AVP vehicle 1A within the parking lot.

[0096] like Figure 3 As shown, the management system 2 may also include a vehicle management center 2A and a parking control center 2B. The parking control center 2B is set up for each parking lot. The parking control center 2B, for example, monitors the status of the parking lot, allocates parking frames to AVP vehicles 1A, generates target routes (PTs), and provides target routes (PTs) to AVP vehicles 1A.

[0097] Vehicle Management Center 2A oversees the parking control centers 2B of numerous parking lots. To this end, Vehicle Management Center 2A communicates with each parking control center 2B to collect and provide various information. Furthermore, Vehicle Management Center 2A manages AVP vehicle 1A and sends remote instruction INS to AVP vehicle 1A as needed. Moreover, Vehicle Management Center 2A manages users and reservations for the automated valet parking service. Vehicle Management Center 2A can also communicate with user terminals 3 operated by users of the automated valet parking service.

[0098] The following is an example illustrating the process when a user utilizes an automated valet parking service. Assume the user's membership information is pre-registered at vehicle management center 2A.

[0099] First, the user makes a reservation for the automated valet parking service. For example, the user operates user terminal 3 to input their ID information, desired parking lot, desired date of use, and desired time of use (desired entry and exit times). User terminal 3 sends the reservation information, including the input information, to vehicle management center 2A. Vehicle management center 2A processes the reservation based on the reservation information and sends a reservation completion notification to user terminal 3. In addition, vehicle management center 2A sends authentication information corresponding to the reservation information to user terminal 3. User terminal 3 accepts and retains the received authentication information.

[0100] The following describes how AVP vehicle 1A enters (checks in) the parking lot.

[0101] AVP vehicle 1A carrying the user arrives at the parking lot's entry area (drop-off area) and stops. In the entry area, the user (and any other passengers, if present) disembarks from AVP vehicle 1A. The user then requests entry into the parking lot using the authentication information stored on user terminal 3. In response to the entry request, vehicle management center 2A authenticates the user. Upon successful authentication, operational permissions for AVP vehicle 1A are transferred from the user to vehicle management center 2A. Vehicle management center 2A then performs the entry processing related to AVP vehicle 1A.

[0102] During the inbound processing, Vehicle Management Center 2A communicates with AVP vehicle 1A, sending a remote instruction INS to AVP vehicle 1A to turn on its power. AVP vehicle 1A automatically turns on its power according to the received remote instruction INS.

[0103] Parking control center 2B, based on the parking lot utilization status, allocates vacant parking bays to AVP vehicle 1A. Then, parking control center 2B communicates with AVP vehicle 1A, sending an entry instruction (INS) indicating the start of automated driving to AVP vehicle 1A. The entry instruction includes information about the target parking bay assigned to AVP vehicle 1A and map information of the parking lot. The entry instruction may also include information about the target path (PT) from the entry area to the target parking bay.

[0104] In response to the parking instruction, AVP vehicle 1A begins automatic driving. AVP vehicle 1A automatically drives from the parking area to the target parking frame and automatically parks itself within the target parking frame. At this time, AVP vehicle 1A can travel along the target path PT specified by the parking control center 2B. Alternatively, the parking control center 2B can communicate with AVP vehicle 1A to remotely control its automatic driving.

[0105] When parking is complete, AVP vehicle 1A notifies vehicle management center 2A of parking completion. Alternatively, parking control center 2B can use infrastructure sensors installed in the parking lot to detect parking completion of AVP vehicle 1A and notify vehicle management center 2A of parking completion. After parking is completed, vehicle management center 2A communicates with AVP vehicle 1A and sends a remote instruction INS instructing AVP vehicle 1A to disconnect its power. AVP vehicle 1A automatically disconnects its power according to the received remote instruction INS.

[0106] The following describes how AVP vehicle 1A exits (checks out) from the parking lot.

[0107] The user uses user terminal 3 to request the dispatch of AVP vehicle 1A. The dispatch request includes authentication information. The dispatch request may also include information about the dispatch area (boarding area) specified by the user. In response to the dispatch request, vehicle management center 2A authenticates the user. Once the authentication process is complete, vehicle management center 2A performs the dispatch processing related to AVP vehicle 1A.

[0108] During the outbound processing, Vehicle Management Center 2A communicates with AVP vehicle 1A, sending a remote instruction INS to AVP vehicle 1A to turn on its power. AVP vehicle 1A automatically turns on its power according to the received remote instruction INS.

[0109] Parking control center 2B communicates with AVP vehicle 1A, sending an exit instruction indicating the start of automated driving as a remote instruction INS to AVP vehicle 1A. The exit instruction includes information about the exit area (boarding area) and parking lot map information. The exit instruction may also include information about the target path PT from the parking frame to the exit area (boarding area).

[0110] In response to the exit instruction, AVP vehicle 1A begins automatic driving. AVP vehicle 1A automatically drives from the parking bay to the exit area. At this time, AVP vehicle 1A can drive along the target path PT specified by the parking control center 2B. Alternatively, the parking control center 2B can communicate with AVP vehicle 1A to remotely control the automatic driving of AVP vehicle 1A.

[0111] AVP vehicle 1A arrives at the departure area and stops. Operational access to AVP vehicle 1A is transferred from vehicle management center 2A to the user. The user (and any other passengers, if any) board AVP vehicle 1A. AVP vehicle 1A then departs for its next destination.

[0112] Thus, when AVP vehicle 1A enters or leaves the parking lot, it receives a remote instruction INS from management system 2 indicating that the power should be turned on. AVP vehicle 1A automatically turns on the power according to the received remote instruction INS, and then begins automatic driving in the parking lot.

[0113] 1-3. Mobility Services

[0114] Figure 4 This is a conceptual diagram used to illustrate mobility services within a defined area AR. A defined area AR is an area that provides mobility services. For example, a defined area AR is a street or part of a "smart city."

[0115] Mobility service vehicle 1B is a vehicle 1 used to provide mobility services within a designated area AR. Examples of mobility service vehicles 1B include buses, taxis, and car-sharing vehicles. Examples of buses include dedicated bus lines, sightseeing buses, on-demand buses, and semi-demand buses.

[0116] Typically, the mobility service vehicle 1B drives autonomously (autonomous driving) within a designated area (AR). More specifically, the mobility service vehicle 1B is equipped with recognition sensors (e.g., cameras) for recognizing the surrounding conditions. The mobility service vehicle 1B uses the recognition sensors to recognize the surrounding conditions while driving autonomously within the designated area (AR).

[0117] Alternatively, landmarks (markers) M can be configured in a designated area AR for location processing. The mobility service vehicle 1B uses a camera to acquire images representing its surroundings and identifies landmarks M based on the images. The mobility service vehicle 1B performs location processing based on the identified landmarks M and estimates its own position within the designated area AR. The mobility service vehicle 1B then drives automatically based on its estimated position.

[0118] The management system 2 manages the mobility services and each mobility service vehicle 1B within the designated area AR. The management system 2 can communicate with each mobility service vehicle 1B within the designated area AR. For example, the management system 2 communicates with each mobility service vehicle 1B to collect information on the location and status of each mobility service vehicle 1B. Furthermore, the management system 2 issues remote instructions (INS) to the mobility service vehicles 1B as needed. For example, the remote instructions (INS) instruct the mobility service vehicle 1B to turn on or off its power. As another example, the remote instructions (INS) can also remotely instruct the mobility service vehicle 1B to turn, accelerate, or decelerate at least one of these actions. Moreover, the management system 2 manages the users and reservations of the mobility services. The management system 2 can also communicate with the user terminals 3 operated by the users of the mobility services.

[0119] 1-4. Other examples

[0120] Vehicle 1 can also be a robot that moves autonomously within a designated area (AR). For example, Vehicle 1 could be a logistics robot that automatically transports goods within a designated area (AR) such as a street, warehouse, or factory. As another example, Vehicle 1 could also be a task robot that performs specific tasks within a designated area (AR) such as a warehouse or factory.

[0121] 2. Problem

[0122] As described above, the vehicle 1 of this embodiment has the function of operating within a designated area (AR) according to remote instructions (INS). This function is useful in providing services utilizing the vehicle 1.

[0123] However, since Vehicle 1 has the function of acting according to remote instruction INS, this function may be abused. That is, someone with malicious intent may forge the remote instruction INS and provide a fake remote instruction INS, thereby causing Vehicle 1 to act arbitrarily (hijacking). For convenience, the fake remote instruction INS will be referred to as "Fake Remote Instruction INS-F" below. Furthermore, the person with malicious intent who provides the fake remote instruction INS-F to Vehicle 1 will be referred to as "Fake Remote Instruction INS X".

[0124] Figure 5 This illustrates a scenario where vehicle 1 is outside the designated area AR. Essentially, management system 2 sends remote instruction INS to vehicle 1 when vehicle 1 is within the designated area AR. When vehicle 1 is outside the designated area AR, management system 2 does not send remote instruction INS to vehicle 1. For example, AVP vehicle 1A responding to automated valet parking (see reference). Figure 3The vehicle 1A operates according to remote instructions (INS) within the parking lot, but is driven by the user outside the parking lot. Outside the parking lot, AVP vehicle 1A does not receive remote instructions (INS) from management system 2.

[0125] However, vehicle 1 has the capability to receive remote instruction INS, and therefore can also issue remote instruction INS to vehicle 1 located outside the designated area AR. Thus, the disguised remote instruction agent X can also issue a disguised remote instruction INS-F to vehicle 1 located outside the designated area AR. The disguised remote instruction agent X can use the disguised remote instruction INS-F to cause vehicle 1 to move arbitrarily (hijack). For example, consider the disguised remote instruction agent X hijacking AVP vehicle 1A (refer to...) outside the parking lot. Figure 3 The power supply to the vehicle is turned on and the door locks are unlocked, thereby stealing the AVP vehicle 1A. As another example, it is also considered that a person impersonating a remote instructor X hijacks the AVP vehicle 1A outside the parking lot and causes the AVP vehicle 1A to drive automatically outside the parking lot, thereby causing an accident.

[0126] Figure 6 The illustration shows the scenario where vehicle 1 is located within the designated area AR. The same applies to the scenario where vehicle 1 is located within the designated area AR. A disguised remote controller X can cause vehicle 1 within the designated area AR to move arbitrarily (hijack) by issuing a disguised remote instruction INS-F. For example, consider the disguised remote controller X hijacking a mobile service vehicle 1B (refer to...) that is waiting in a waiting area. Figure 4 The power supply to vehicle 1B is switched on and the doors are unlocked, thereby stealing the mobile service vehicle 1B. As another example, it is also considered that a person posing as a remote instructor X hijacks a mobile service vehicle 1B in operation, causing an accident. As yet another example, it is also considered that a person posing as a remote instructor X hijacks AVP vehicle 1A in a parking lot (see reference...). Figure 3 The power supply to the vehicle was turned on, causing the AVP vehicle 1A to move automatically within the parking lot, thus causing the accident.

[0127] From the above perspective, this embodiment provides a technology that can suppress the abuse of the function of a vehicle 1 that performs actions according to remote instructions INS in a designated area AR.

[0128] 3. Remote instruction verification processing and action restriction processing

[0129] According to this embodiment, when vehicle 1 receives a remote instruction INS (which may also be a fake remote instruction INS-F), the received remote instruction INS is validated. Validating the remote instruction INS means determining whether the remote instruction INS is legitimate. In other words, validating the remote instruction INS means determining whether the remote instruction INS is a legitimate remote instruction INS sent from management system 2 or a fake remote instruction INS-F. Hereinafter, the process of validating the remote instruction INS received by vehicle 1 will be referred to as the "remote instruction validation process".

[0130] Figure 7 This is a block diagram used to explain the overview of the remote instruction verification process in this embodiment. The remote instruction verification unit 100 performs the remote instruction verification process. The remote instruction verification unit 100 is included, for example, in the vehicle system 10 of the vehicle 1. As another example, the remote instruction verification unit 100 may also be included in the management system 2. As yet another example, the remote instruction verification unit 100 may also be distributed between the vehicle system 10 and the management system 2.

[0131] Figure 8 This is a flowchart illustrating the process associated with the remote instruction verification process of this embodiment.

[0132] In step S10, the remote indication receiving unit 11 of the vehicle system 10 receives a remote indication INS (which may also be a fake remote indication INS-F). When the remote indication INS is received, the remote indication receiving unit 11 sends a trigger signal TRG to the remote indication verification unit 100. After that, the process proceeds to step S100.

[0133] It should be noted that, alternatively, if the received remote instruction INS indicates that the power supply to vehicle 1 is turned on, the vehicle control unit 12 may temporarily turn on the power supply to vehicle 1. In this case, the vehicle control unit 12 will not perform any further processing and will wait until the result of the remote instruction verification process is determined.

[0134] In step S100, the remote indication verification unit 100 receives a trigger signal TRG. In response to the trigger signal TRG, the remote indication verification unit 100 performs remote indication verification processing to determine whether the remote indication INS received by the vehicle system 10 is appropriate. Various examples are considered as specific methods for remote indication verification processing. These various examples of remote indication verification processing will be described later.

[0135] If the remote instruction INS received by the vehicle system 10 is correct (step S100: Yes), the process proceeds to step S200. In step S200, the remote instruction verification unit 100 notifies the vehicle control unit 12 of the vehicle system 10 that the remote instruction INS is correct. The vehicle control unit 12 then controls the vehicle 1 according to the received remote instruction INS, as usual.

[0136] On the other hand, if the remote instruction INS received by the vehicle system 10 is inappropriate, that is, if it is determined that the received remote instruction INS is a fake remote instruction INS-F (step S100: no), the process proceeds to step S300.

[0137] In step S300, the remote instruction verification unit 100 performs "motion restriction processing." Motion restriction processing is the process of restricting at least a portion of the vehicle 1's movement without conforming to the received remote instruction INS. More specifically, the remote instruction verification unit 100 sends a motion restriction signal LMT to the vehicle control unit 12. The motion restriction signal LMT indicates that at least a portion of the vehicle 1's movement is restricted without conforming to the received remote instruction INS. The motion restriction signal LMT may also include the content of the vehicle 1's movement that should be restricted. The vehicle control unit 12 restricts at least a portion of the vehicle 1's movement according to the motion restriction signal LMT. An example of motion restriction processing is described below.

[0138] The first example of motion restriction processing is disconnecting the power supply to vehicle 1. When the spoofed remote indicator INS-F indicates that the power supply to vehicle 1 is on, the vehicle control unit 12 temporarily connects the power supply to vehicle 1. Then, upon receiving the motion restriction signal LMT indicating power disconnection, the vehicle control unit 12 immediately disconnects the power supply to vehicle 1, thereby rendering vehicle 1 inoperable. This prevents theft and accidents involving vehicle 1.

[0139] The second example of motion restriction processing is prohibiting the movement (driving) of vehicle 1. Even if the spoofed remote indicator INS-F instructs vehicle 1 to drive automatically, the vehicle control unit 12 keeps vehicle 1 completely stationary. This prevents theft and accidents involving vehicle 1. It should be noted that during the period when the movement of vehicle 1 is prohibited, power supply to various devices mounted on vehicle 1 can continue.

[0140] A third example of motion restriction processing is issuing an alarm from vehicle 1 while simultaneously prohibiting its movement (driving). For example, vehicle control unit 12 may illuminate or flash the lights (e.g., headlights, hazard lights) of vehicle 1. As another example, vehicle control unit 12 may also sound the horn (car horn) of vehicle 1. This prevents theft of vehicle 1, accidents, and serves as a warning to those around vehicle 1.

[0141] The fourth example of motion restriction processing is preventing the unlocking of the doors of vehicle 1. This prevents intrusion into the interior of vehicle 1.

[0142] The fifth example of motion restriction processing involves a situation where a spoofed remote instruction INS-F is received while vehicle 1 is in motion. Specifically, the fifth example of motion restriction processing involves immediately slowing down and stopping vehicle 1. This prevents an accident from occurring.

[0143] It can also be a combination of two or more of the first to fifth examples of motion restriction processing.

[0144] In step S400, the remote indication verification unit 100 notifies the management system 2 of the anomaly detection. The management system 2 then notifies the user terminal 3 of the anomaly detection.

[0145] As explained above, according to this embodiment, when vehicle 1 receives a remote instruction INS, a remote instruction verification process is performed to determine whether the remote instruction INS is appropriate. If the remote instruction INS received by vehicle 1 is inappropriate, an action restriction process is performed that restricts at least a portion of the actions of vehicle 1 without conforming to the remote instruction INS. This prevents the abuse of the functions of vehicle 1 that operate according to the remote instruction INS. In other words, it prevents vehicle 1 from being hijacked by a person posing as a remote instruction provider X. As a result, for example, theft of vehicle 1 and accidents are prevented.

[0146] Hereinafter, various examples of the remote instruction verification process (step S100) of this embodiment will be described.

[0147] 3-1. Regional Validation Processing

[0148] Basically, the management system 2 sends remote instruction INS to vehicle 1 when vehicle 1 is within the designated area AR. When vehicle 1 is outside the designated area AR, the management system 2 does not send remote instruction INS to vehicle 1. For example, in an AVP vehicle 1A responding to automated valet parking (see reference...). Figure 3 The vehicle 1A operates according to the remote instruction INS within the parking lot, but is driven by the user outside the parking lot. Outside the parking lot, AVP vehicle 1A does not receive remote instruction INS from management system 2. If a remote instruction INS is received when vehicle 1A is outside the designated area AR, there is a high probability that the remote instruction INS is a spoofed remote instruction INS-F and not a legitimate remote instruction sent from management system 2.

[0149] From the above perspective, as an example of remote instruction verification processing, consider determining whether vehicle 1 exists within the designated area AR when vehicle 1 receives a remote instruction INS. Hereinafter, the process of determining whether vehicle 1 exists within the designated area AR when vehicle 1 receives a remote instruction INS will be referred to as "area verification processing".

[0150] like Figure 9 As shown, the remote instruction verification unit 100 includes a region verification unit 110. The region verification unit 110 performs region verification processing in response to a trigger signal TRG. If the vehicle 1 is not located within the designated region AR when it receives the remote instruction INS, the region verification unit 110 determines that the received remote instruction INS is invalid.

[0151] Figure 10 It is a conceptual diagram used to illustrate various examples of region validation processing.

[0152] 3-1-1. The first example

[0153] The first step in the area verification process is to determine whether a landmark M, located within the designated area AR, can be identified from the location of vehicle 1. If landmark M cannot be identified from the location of vehicle 1, the area verification unit 110 determines that vehicle 1 does not exist within the designated area AR.

[0154] For example, vehicle 1 (vehicle system 10) is configured to identify landmarks M around vehicle 1 using recognition sensors such as cameras mounted on vehicle 1. The area verification unit 110 included in vehicle system 10 determines whether vehicle system 10 has identified landmarks M around vehicle 1. If vehicle system 10 has not identified landmark M, area verification unit 110 determines that landmark M cannot be identified from the location of vehicle 1. That is, area verification unit 110 determines that vehicle 1 does not exist within the designated area AR.

[0155] As another example, vehicle 1 (vehicle system 10) sends image information acquired by a camera mounted on vehicle 1 to management system 2. Management system 2 is configured to identify landmarks M around vehicle 1 based on the image information received from vehicle 1. A region verification unit 110 included in management system 2 determines whether management system 2 has identified landmarks M around vehicle 1. If management system 2 has not identified landmark M, region verification unit 110 determines that landmark M cannot be identified from the location of vehicle 1. That is, region verification unit 110 determines that vehicle 1 does not exist within the designated area AR.

[0156] 3-1-2. Second example

[0157] The second example of area verification processing involves comparing the location information of vehicle 1 with map information. The map information records the location of a specified area (AR). Therefore, by comparing the location information of vehicle 1 with the map information, it can be determined whether vehicle 1 exists within the specified area (AR).

[0158] For example, the vehicle system 10 uses position sensors such as GPS to obtain the location information of the vehicle 1. Alternatively, the vehicle system 10 performs positioning processing to obtain the location information of the vehicle 1. The area verification unit 110 included in the vehicle system 10 obtains the location information of the vehicle 1 and compares the location information of the vehicle 1 with map information to determine whether the vehicle 1 exists within the specified area AR.

[0159] As another example, the vehicle system 10 sends the location information of vehicle 1 to the management system 2. The management system 2 obtains the location information of vehicle 1 from the vehicle system 10. The area verification unit 110 included in the management system 2 obtains the location information of vehicle 1 and compares the location information of vehicle 1 with the map information to determine whether vehicle 1 exists within the specified area AR.

[0160] 3-1-3. The Third Case

[0161] Vehicle 1 (onboard system 10) and communication device 5 installed in the designated area AR are configured to communicate according to a specific communication method. For example, in Figure 3 In the case of the automated valet parking system shown, the parking control center 2B acts as a communication device 5, and the AVP vehicle 1A in the parking lot communicates with the parking control center 2B using a specific communication method. This specific communication method could be a short-range wireless communication method such as WiFi (registered trademark) or Bluetooth (registered trademark).

[0162] The third example of area verification processing is determining whether communication has been established between vehicle 1 (vehicle system 10) and communication device 5 installed in the designated area AR. If no communication is established between vehicle 1 (vehicle system 10) and communication device 5, the area verification unit 110 determines that vehicle 1 does not exist within the designated area AR. This area verification unit 110 may be included in the vehicle system 10 or in the communication device 5 included in the management system 2.

[0163] 3-1-4. Processing Flow

[0164] Figure 11 This is a flowchart that schematically illustrates the regional verification process performed by the regional verification unit 110. The regional verification unit 110 may be included in the vehicle system 10 or the management system 2. Alternatively, the regional verification unit 110 may be distributed between the vehicle system 10 and the management system 2.

[0165] In step S110, the area verification unit 110 determines whether vehicle 1 exists within the designated area AR. If vehicle 1 exists within the designated area AR (step S110: Yes), the area verification unit 110 determines that the received remote indication INS is valid (step S111). On the other hand, if vehicle 1 does not exist within the designated area AR (step S110: No), the area verification unit 110 determines that the received remote indication INS is invalid (step S112).

[0166] 3-1-5. Effects

[0167] Based on the area verification process described above, the problem can be solved. Figure 5 The problem is that it is possible to prevent vehicle 1, located outside the designated area AR, from being hijacked by a disguised remote controller X.

[0168] 3-2. Signal Source Verification Processing

[0169] As another example of remote instruction verification processing, consider confirming whether management system 2 actually sent a remote instruction INS to vehicle 1. Hereinafter, the process of confirming whether management system 2 actually sent a remote instruction INS to vehicle 1 will be referred to as "signal transmission source verification processing".

[0170] like Figure 12 As shown, the remote indication verification unit 100 includes a signal transmission source verification unit 120. The signal transmission source verification unit 120 performs signal transmission source verification processing in response to the trigger signal TRG. If the management system 2 does not actually send a remote indication INS to the vehicle 1, the signal transmission source verification unit 120 determines that the received remote indication INS is inappropriate.

[0171] Figure 13 This is a conceptual diagram illustrating an example of signal source verification processing. Signal source verification units 120 are distributed between the vehicle system 10 and the management system 2. The signal source verification unit 120 on the vehicle system 10 side sends an inquiry message INQ to the management system 2 in response to a trigger signal TRG. The inquiry message INQ is a query to determine whether a remote instruction INS has indeed been sent to the vehicle 1. Upon receiving the inquiry message INQ, the signal source verification unit 120 on the management system 2 side confirms whether the management system 2 has indeed sent the remote instruction INS to the inquiry source, the vehicle 1. Then, the signal source verification unit 120 on the management system 2 side replies with a response message REP indicating the confirmation result to the vehicle system 10. If the response message REP indicates that no remote instruction INS was sent, the signal source verification unit 120 on the vehicle system 10 side determines that the received remote instruction INS is inappropriate.

[0172] As another example, in the absence of a remote instruction INS being sent, the signal transmission source verification unit 120 on the management system 2 side determines that the remote instruction INS is inappropriate and generates an action restriction signal LMT. In this case, the response information REP sent from the management system 2 to the vehicle system 10 includes the action restriction signal LMT. The vehicle control unit 12 of the vehicle system 10 performs action restriction processing according to the action restriction signal LMT.

[0173] Figure 14 This is a flowchart that outlines the signal source verification process implemented by the signal source verification unit 120. The signal source verification unit 120 is distributed between the vehicle system 10 and the management system 2.

[0174] In step S120, the signal transmission source verification unit 120 on the vehicle system 10 side sends an inquiry message INQ to the management system 2. In step S121, the signal transmission source verification unit 120 on the management system 2 side confirms whether the management system 2 actually sent a remote instruction INS to the vehicle 1. If the management system 2 actually sent the remote instruction INS (step S121: Yes), the signal transmission source verification unit 120 determines that the received remote instruction INS is valid (step S122). On the other hand, if the management system 2 did not actually send the remote instruction INS (step S121: No), the signal transmission source verification unit 120 determines that the received remote instruction INS is invalid (step S123).

[0175] The signal source verification process described above can not only solve... Figure 5 The problems shown can also be solved Figure 6 The problem is that, regardless of whether vehicle 1 is inside or outside the designated AR area, it is possible to suppress the hijacking of vehicle 1 by a disguised remote controller X.

[0176] 3-3. Verification and processing of recognition results

[0177] As described above, landmarks M are configured in the designated area by AR. Vehicle 1 (vehicle system 10) identifies landmarks M around vehicle 1 by using recognition sensors such as cameras mounted on vehicle 1. Alternatively, vehicle 1 (vehicle system 10) sends image information acquired by the cameras mounted on vehicle 1 to management system 2. Then, management system 2 identifies landmarks M around vehicle 1 based on the image information received from vehicle 1.

[0178] As explained in section 3-1-1 above, the appropriateness of the remote indication INS can be determined based on whether landmark M can be identified from the location of vehicle 1. However, it is also considered that the spoofing remote indicator X also forges landmark M and causes vehicle 1 to identify the forged landmark M.

[0179] From the above perspective, as another example of remote instruction verification processing, consider determining whether the landmark M identified from the location of vehicle 1 is appropriate. Hereinafter, the process of determining whether the landmark M identified from the location of vehicle 1 is appropriate will be referred to as "recognition result verification processing".

[0180] like Figure 15 As shown, the remote instruction verification unit 100 includes an identification result verification unit 130. The identification result verification unit 130 can be included in the vehicle system 10 or the management system 2. Alternatively, the identification result verification unit 130 can be distributed between the vehicle system 10 and the management system 2.

[0181] Figure 16 This is a conceptual diagram illustrating an example of the verification process for the identification result. Here, we consider the case where the remote indicator INS indicates that the power to vehicle 1 is turned on.

[0182] "Reference Landmark MR" is the landmark M identified from the location of vehicle 1 immediately before the power to vehicle 1 is disconnected. "Reference Information REF" is the information corresponding to the reference landmark MR. For example, the reference information REF includes identification information of the reference landmark MR. As another example, the reference information REF may also include the location information of the reference landmark MR. As yet another example, the reference information REF may also include the location and orientation of vehicle 1 when the reference landmark MR was identified. This is because the reference landmark MR that can be identified from vehicle 1 can be determined based on the map information of landmark M and the location and orientation of vehicle 1.

[0183] Immediately before the power to vehicle 1 is disconnected, the identification result verification unit 130 acquires reference information REF and stores it in a designated storage device 6. The designated storage device 6 can be mounted on vehicle 1 or included in the management system 2. For example, the identification result verification unit 130 included in the vehicle system 10 acquires the reference information REF from the vehicle system 10 and stores it in the designated storage device 6 mounted on vehicle 1. Alternatively, the identification result verification unit 130 included in the vehicle system 10 may send the reference information REF to the management system 2, and the identification result verification unit 130 included in the management system 2 may store the reference information REF in the designated storage device 6 of the management system 2. Yet another example, the identification result verification unit 130 included in the management system 2 may acquire the reference information REF from the management system 2 and store it in the designated storage device 6 of the management system 2.

[0184] Subsequently, the vehicle system 10 receives a remote indication INS indicating that the vehicle 1 has been powered on. The identification result verification unit 130 performs identification result verification processing in response to the trigger signal TRG. The "latest landmark ML" is the landmark M first identified from the location of the vehicle 1 after power is turned on. The identification result verification unit 130 obtains information about the latest landmark ML from the vehicle system 10 or the management system 2. The information about the latest landmark ML includes at least one of its location information and identification information.

[0185] Furthermore, the identification result verification unit 130 reads the aforementioned reference information REF from the designated storage device 6. Based on the read reference information, the identification result verification unit 130 obtains information about the reference landmark MR. The information about the reference landmark MR includes at least one of the location information and identification information of the reference landmark MR. Then, the identification result verification unit 130 determines whether the latest landmark ML is consistent with the reference landmark MR. If the latest landmark ML is inconsistent with the reference landmark MR, the identification result verification unit 130 determines that the received remote instruction INS is inappropriate.

[0186] Furthermore, even when the latest landmark ML and the reference landmark MR are inconsistent, the identification result verification unit 130 can determine that the vehicle 1 was accidentally moved during the period when the power to the vehicle 1 was disconnected. In other words, it can sense the occurrence of anomalies (e.g., theft) during the period when the power to the vehicle 1 was disconnected.

[0187] Figure 17 This is a flowchart that summarizes the identification result verification process performed by the identification result verification unit 130. The identification result verification unit 130 may be included in the vehicle system 10 or the management system 2. Alternatively, the identification result verification unit 130 may be distributed between the vehicle system 10 and the management system 2.

[0188] In step S130, the identification result verification unit 130 acquires information related to the latest landmark ML that was first identified from the location of vehicle 1 after power-on. In step S131, the identification result verification unit 130 determines whether the latest landmark ML and the reference landmark MR are consistent based on the reference information REF. If the latest landmark ML and the reference landmark MR are consistent (step S131: Yes), the identification result verification unit 130 determines that the received remote indication INS is appropriate (step S132). On the other hand, if the latest landmark ML and the reference landmark MR are inconsistent (step S131: No), the identification result verification unit 130 determines that the received remote indication INS is inappropriate (step S133).

[0189] The verification process based on the above description of the recognition results can not only solve... Figure 5 The problems shown can also be solved Figure 6The problem is that, regardless of whether the vehicle 1 is inside or outside the designated AR area, it can suppress the hijacking of vehicle 1 by a disguised remote controller X. Furthermore, it can detect anomalies (e.g., theft) during periods when the power to vehicle 1 is disconnected.

[0190] 3-4. Combinations

[0191] The remote indication verification process may include two or more of the aforementioned area verification process, signal source verification process, and identification result verification process. That is, the remote indication verification unit 100 may also include two or more of the area verification unit 110, signal source verification unit 120, and identification result verification unit 130. In the remote indication verification unit 100, two or more of the area verification unit 110, signal source verification unit 120, and identification result verification unit 130 may operate in parallel or serially. If at least one of the area verification unit 110, signal source verification unit 120, and identification result verification unit 130 determines that the remote indication INS is inappropriate, the remote indication verification unit 100 determines that the remote indication INS is inappropriate.

[0192] By combining two or more of the following methods—regional verification processing, signal source verification processing, and identification result verification processing—the accuracy of remote indication verification processing is further improved.

[0193] 3-5. Effects

[0194] As explained above, according to this embodiment, when vehicle 1 receives a remote instruction INS, a remote instruction verification process is performed to determine whether the remote instruction INS is appropriate. If the remote instruction INS received by vehicle 1 is inappropriate, an action restriction process is performed that restricts at least a portion of the actions of vehicle 1 without conforming to the remote instruction INS. This prevents the abuse of the functions of vehicle 1 that operate according to the remote instruction INS. In other words, it prevents vehicle 1 from being hijacked by a person posing as a remote instruction provider X. As a result, for example, theft of vehicle 1 and accidents are prevented.

[0195] 4. Vehicle control system

[0196] The vehicle control system (mobile body control system) of this embodiment includes the remote instruction verification unit 100 described above.

[0197] For example, the remote instruction verification unit 100 is included in the vehicle system 10 of the vehicle 1. In this case, the vehicle system 10 of the vehicle 1 is equivalent to the vehicle control system.

[0198] As another example, the remote instruction verification unit 100 can also be included in the management system 2. In this case, the management system 2 is equivalent to the vehicle control system.

[0199] As another example, the remote instruction verification unit 100 can also be distributed between the vehicle system 10 and the management system 2. In this case, the combination of the management system 2 and the vehicle system 10 is equivalent to a vehicle control system.

[0200] 5. Examples of in-vehicle systems

[0201] 5-1. Example of composition

[0202] Figure 18 This is a block diagram illustrating an example configuration of the vehicle system 10 according to this embodiment. The vehicle system 10 includes a sensor group 20, a driving device 30, a light / horn 40, a communication device 50, and a control device 60.

[0203] The sensor group 20 includes an identification sensor 21, a vehicle status sensor 22, a position sensor 23, etc.

[0204] The identification sensor 21 identifies (detects) the surrounding conditions of the vehicle 1. The identification sensor 21 includes a camera C. The camera C acquires image information representing the surrounding conditions of the vehicle 1. The identification sensor 21 may also include LIDAR (Laser Imaging Detection and Ranging), radar, etc.

[0205] The vehicle status sensor 22 detects the status of the vehicle 1. For example, the vehicle status sensor 22 includes a speed sensor (wheel speed sensor), an acceleration sensor, a yaw rate sensor, a rudder angle sensor, etc.

[0206] Position sensor 23 detects the position and orientation of vehicle 1. For example, a GPS (Global Positioning System) sensor is shown as position sensor 23.

[0207] The driving device 30 includes a steering mechanism, a drive mechanism, and a braking mechanism. The steering mechanism turns the wheels. For example, the steering mechanism includes an electric power steering (EPS) system. The drive mechanism is the power source that generates driving force. Examples of drive mechanisms include engines, electric motors, and in-wheel motors. The braking mechanism generates braking force.

[0208] The lamp / horn 40 includes a lamp and a horn. Examples of lamps include headlights and hazard lights.

[0209] The communication device 50 communicates with the outside of the vehicle 1. For example, the communication device 50 communicates with the management system 2. As another example, the communication device 50 communicates with the communication device 5 (see reference 2) located in a designated area AR. Figure 10Communication is conducted with the communication device 5, which is located in the designated area AR, through a specific communication method. This specific communication method may be, for example, short-range wireless communication methods such as WiFi (registered trademark) or Bluetooth (registered trademark).

[0210] The control unit 60 is a computer that controls the vehicle 1. The control unit 60 includes one or more processors 70 (hereinafter simply referred to as processor 70) and one or more storage devices 80 (hereinafter simply referred to as storage device 80). The processor 70 performs various processes. For example, the processor 70 includes a CPU (Central Processing Unit). The storage device 80 stores various information. Examples of storage devices 80 include volatile memory, non-volatile memory, HDD (Hard Disk Drive), SSD (Solid State Drive), etc. The control unit 60 may also include one or more ECUs (Electronic Control Units).

[0211] The vehicle control program PROG is a computer program used to control the vehicle 1. The processor 70 executes the vehicle control program PROG to implement various processes performed by the control device 60. The vehicle control program PROG is stored in the storage device 80. Alternatively, the vehicle control program PROG may be recorded on a computer-readable recording medium.

[0212] 5-2. Driving Environment Information

[0213] The control device 60 acquires driving environment information 90 representing the driving environment of the vehicle 1. The driving environment information 90 is stored in the storage device 80.

[0214] Figure 19 This is a block diagram representing an example of driving environment information 90. Driving environment information 90 includes map information 91, surrounding conditions information 92, vehicle status information 96, and vehicle location information 97.

[0215] Map information 91 includes general navigation maps. Map information 91 may also represent lane configurations and road shapes. Map information 91 may also include location information for structures, traffic lights, signs, etc. Furthermore, the location of a designated area AR (e.g., a parking lot) is registered in map information 91. Map information 91 may also include map information within the designated area AR. Map information 91 may also include the location and identification information of each landmark (marker) M located within the designated area AR. Control device 60 retrieves map information 91 from a map database. The map database may be stored in storage device 80 or in management system 2. In the latter case, control device 60 communicates with management system 2 via communication device 50 to retrieve the required map information 91.

[0216] Surrounding conditions information 92 is information indicating the conditions surrounding vehicle 1. Control device 60 uses recognition sensor 21 to recognize the conditions surrounding vehicle 1 to obtain surrounding conditions information 92. For example, surrounding conditions information 92 includes image information 93 acquired by camera C. As another example, surrounding conditions information 92 includes point cluster information obtained by LIDAR.

[0217] The surrounding environment information 92 also includes object information 94 related to objects around vehicle 1. Examples of objects include pedestrians, bicycles, two-wheeled vehicles, other vehicles (driving vehicles, parked vehicles, etc.), landmarks M, white lines, traffic lights, signs, structures, obstacles, etc. Object information 94 represents the relative position and relative speed of the object relative to vehicle 1. For example, objects can be identified by analyzing image information 93 obtained by camera C, and the relative position of the object can be calculated. For example, control device 60 uses image recognition AI obtained through machine learning to identify objects in image information 93. In addition, objects can also be identified based on point group information obtained by LIDAR, and the relative position and relative speed of the object can be obtained.

[0218] Specifically, landmark information 95 is object information 94 related to landmarks M surrounding vehicle 1. Control device 60 identifies landmarks M surrounding vehicle 1 using recognition sensor 21. For example, control device 60 utilizes image recognition AI obtained through machine learning to identify landmarks M in image information 93. Landmark information 95 includes the relative position of landmark M relative to vehicle 1. Landmark information 95 may also include identification information of the identified landmarks M.

[0219] Vehicle status information 96 indicates the status of vehicle 1, including vehicle speed (wheel speed), acceleration, yaw rate, rudder angle, etc. Control device 60 acquires vehicle status information 96 from vehicle status sensor 22. Vehicle status information 96 can also indicate the driving state of vehicle 1 (automatic driving / manual driving).

[0220] Vehicle position information 97 represents the position and orientation of vehicle 1. Control device 60 obtains vehicle position information 97 from the detection results obtained by position sensor 23. Furthermore, control device 60 can also obtain high-precision vehicle position information 97 through well-known localization processing. Specifically, control device 60 calculates the amount of movement of vehicle 1 based on the wheel speed and rudder angle obtained by vehicle state sensor 22, thereby roughly calculating the vehicle position. Moreover, control device 60 corrects the vehicle position by comparing the position of landmark M shown in map information 91 with the identified position of landmark M shown in landmark information 95. By repeatedly calculating the amount of movement and correcting the vehicle position, high-precision vehicle position information 97 can be continuously obtained.

[0221] 5-3. Vehicle driving control and automatic driving control

[0222] The control device 60 performs "vehicle driving control" to control the movement of the vehicle 1. Vehicle driving control includes steering control, acceleration control, and deceleration control. The control device 60 performs vehicle driving control by controlling the driving mechanism 30. Specifically, the control device 60 performs steering control by controlling the steering mechanism. Furthermore, the control device 60 performs acceleration control by controlling the drive mechanism. Additionally, the control device 60 performs deceleration control by controlling the braking mechanism.

[0223] Furthermore, the control device 60 can also perform autonomous driving control based on the driving environment information 90. More specifically, the control device 60 generates a driving plan for the vehicle 1 based on the driving environment information 90. Examples of driving plans include maintaining the current driving lane, changing lanes, making right / left turns, and avoiding obstacles. Moreover, the control device 60 generates a target trajectory required for the vehicle 1 to travel according to the driving plan based on the driving environment information 90. The target trajectory includes a target position and a target speed. Then, the control device 60 performs vehicle driving control by causing the vehicle 1 to follow the target trajectory.

[0224] 5-4. Light control, horn control

[0225] The control device 60 controls the light / horn 40. For example, the control device 60 causes the lights of vehicle 1 to illuminate or flash. As another example, the control device 60 causes the horn of vehicle 1 to sound.

[0226] 5-5. Communication Processing

[0227] The control device 60 communicates with the outside of the vehicle 1 via the communication device 50. For example, the control device 60 communicates with the management system 2 via the communication device 50. As another example, the control device 60 communicates with the communication device 5 (see reference 50) within a designated area AR via the communication device 50. Figure 10 ) to communicate.

[0228] 5-6. Vehicle control according to remote instructions

[0229] The control unit 60 receives remote instruction INS sent from the management system 2. The control unit 60 controls the vehicle 1 substantially according to the received remote instruction INS. For example, the remote instruction INS instructs the vehicle 1 to be powered on or off. As another example, the remote instruction INS may also instruct vehicle driving control, i.e., at least one of steering, acceleration, and deceleration. As yet another example, the remote instruction INS may also instruct automatic driving control. As yet another example, the remote instruction INS may also instruct the use of the recognition sensor 21 to identify the surrounding conditions of the vehicle 1. As yet another example, the remote instruction INS may also instruct the locking or unlocking of the vehicle 1's doors.

[0230] It should be noted that, as Figure 2 As shown, the vehicle system 10 includes a remote instruction receiver 11 and a vehicle control unit 12 as functional blocks. The remote instruction receiver 11 is implemented via a communication device 50. The vehicle control unit 12 is implemented via a control device 60.

[0231] 5-7. Remote Instruction Verification Processing

[0232] The control device 60 can also perform the remote instruction verification process described in section 3 above. That is, the control device 60 can also have the functions of the remote instruction verification unit 100.

[0233] 5-7-1. Regional Validation Processing

[0234] The control device 60 can also perform the area verification process described in section 3-1 above. That is, the control device 60 can also have the functions of the area verification unit 110.

[0235] In the first example (see section 3-1-1), the control device 60 determines whether the landmark M can be identified from the location of the vehicle 1 based on the landmark information 95.

[0236] In the second example (see section 3-1-2), the control device 60 determines whether vehicle 1 exists within the specified area AR based on map information 91 and vehicle location information 97.

[0237] In the third example (see section 3-1-3), the control device 60 determines whether to establish communication with the communication device 5 located in the designated area AR via the communication device 50.

[0238] 5-7-2. Signal Source Verification Processing

[0239] The control device 60 can also perform the signal source verification process described in section 3-2 above. That is, the control device 60 can also have the functions of the signal source verification unit 120. Specifically, the control device 60 sends the query information INQ to the management system 2 via the communication device 50. In addition, the control device 60 receives the reply information REP from the management system 2 via the communication device 50.

[0240] 5-7-3. Verification and Processing of Recognition Results

[0241] The control device 60 can also perform the identification result verification process described in Section 3-3 above. That is, the control device 60 can also have the functions of the identification result verification unit 130. Specifically, the control device 60 obtains reference information REF corresponding to the reference landmark MR based on the landmark information 95. The reference information REF is stored, for example, in the storage device 80. In addition, the control device 60 obtains information related to the latest landmark ML based on the landmark information 95. Then, the control device 60 determines whether the latest landmark ML is consistent with the reference landmark MR.

[0242] 5-8. Handling of Motion Restrictions

[0243] The control device 60 performs the motion restriction processing described in section 3 above. Specifically, the control device 60 generates a motion restriction signal LMT based on the result of the remote instruction verification processing. Then, based on the motion restriction signal LMT, the control device 60 restricts at least a portion of the motion of the vehicle 1 without following the remote instruction INS.

[0244] 6. Examples of management systems

[0245] 6-1. Example of composition

[0246] Figure 20 This is a block diagram illustrating an example configuration of the management system 2 according to this embodiment. The management system 2 includes a communication device 210, one or more processors 220 (hereinafter referred to as processors 220 only), and one or more storage devices 230 (hereinafter referred to as storage devices 230 only).

[0247] The communication device 210 communicates with the outside world via a communication network. For example, the communication device 210 communicates with the vehicle-mounted system 10 of vehicle 1. The communication device 210 may also include a communication device 5 (see reference 5) located in a designated area AR. Figure 10The communication device 5, located within the designated area of ​​the AR, communicates with the vehicle's onboard system 10 via a specific communication method. This specific communication method may be, for example, short-range wireless communication such as WiFi (registered trademark) or Bluetooth (registered trademark).

[0248] Processor 220 performs various processes. For example, processor 220 includes a CPU. Storage device 230 stores various information. Examples of storage devices 230 include volatile memory, non-volatile memory, HDD, SSD, etc.

[0249] Management program 240 is a computer program executed by processor 220. The functions of management system 2 are implemented by processor 220 executing management program 240. Management program 240 is stored in storage device 230. Alternatively, management program 240 may be recorded on a computer-readable recording medium. Management program 240 may also be provided via a network.

[0250] 6-2. Various Information

[0251] Map information 250 is the same as map information 91 described above. Map information 250 includes a general navigation map. Map information 250 may also represent lane configurations and road shapes. Map information 250 may also include location information for structures, traffic lights, signs, etc. Furthermore, map information 250 registers the location of a designated area AR (e.g., a parking lot). Map information 250 may also include map information within the designated area AR. Map information 250 may also include the location and identification information of each landmark (marker) M located within the designated area AR. Map information 250 is pre-stored in storage device 230.

[0252] Vehicle information 260 is information sent from the vehicle system 10 of vehicle 1. For example, vehicle information 260 includes image information 93 acquired by a camera C mounted on vehicle 1. As another example, vehicle information 260 may also include landmark information 95 related to a landmark M identified by the recognition sensor 21. As yet another example, vehicle information 260 may also include vehicle location information 97 indicating the location of vehicle 1. Processor 220 acquires vehicle information 260 from vehicle system 10 via communication device 210 and stores the acquired vehicle information 260 in storage device 230.

[0253] Management information 270 is information used for management implemented by management system 2. For example, management information 270 includes service information related to services managed by management system 2. Service information may include, for example, the utilization status of the service. As another example, management information 270 may also include user information related to users of the service.

[0254] 6-3. Landmark Recognition Processing

[0255] The processor 220 can identify landmarks M around the vehicle 1 based on the image information 93 included in the vehicle information 260.

[0256] 6-4. Remote indication signal transmission and processing

[0257] The processor 220 generates a remote instruction INS for the vehicle 1 as needed. Then, the processor 220 communicates with the vehicle system 10 via the communication device 210 to send the remote instruction INS to the vehicle system 10.

[0258] For example, in Figure 3 In the case of automated valet parking, when the AVP vehicle 1A enters or leaves the parking space, a remote indication INS indicating power on is sent to the vehicle system 10.

[0259] 6-5. Remote Instruction Verification Processing

[0260] The processor 220 can also perform the remote instruction verification process described in section 3 above. That is, the processor 220 can also have the functions of the remote instruction verification unit 100.

[0261] 6-5-1. Regional Validation Processing

[0262] The processor 220 can also perform the region verification process described in section 3-1 above. That is, the processor 220 can also have the functions of the region verification unit 110.

[0263] In the first example (see section 3-1-1), the processor 220 determines whether the landmark M can be identified from the location of the vehicle 1 based on the image information 93 or the landmark information 95 included in the vehicle information 260.

[0264] In the second example (see section 3-1-2), the processor 220 determines whether vehicle 1 exists within the specified area AR based on the vehicle location information 97 included in the map information 250 and vehicle information 260.

[0265] In the third example (see section 3-1-3), the processor 220 determines whether to establish communication with the vehicle system 10 of the vehicle 1 via the communication device 210 (communication device 5 located in the designated area AR).

[0266] 6-5-2. Signal Transmission Source Verification Processing

[0267] Processor 220 can also perform the signal source verification process described in Section 3-2 above. That is, processor 220 can also have the functions of signal source verification unit 120. Specifically, processor 220 receives query information INQ from vehicle system 10 via communication device 210. Processor 220 confirms whether it has actually sent remote instruction INS to vehicle 1. Then, processor 220 replies with reply information REP indicating the confirmation result to vehicle system 10 via communication device 210.

[0268] 6-5-3. Verification and Processing of Recognition Results

[0269] Processor 220 can also perform the recognition result verification processing described in Section 3-3 above. That is, processor 220 can also have the functions of recognition result verification unit 130. Specifically, processor 220 obtains reference information REF corresponding to the reference landmark MR based on image information 93 or landmark information 95 included in vehicle information 260. Reference information REF is stored, for example, in storage device 230. In addition, processor 220 obtains information related to the latest landmark ML based on image information 93 or landmark information 95 included in vehicle information 260. Then, processor 220 determines whether the latest landmark ML is consistent with the reference landmark MR.

[0270] 6-6. Motion Restriction Handling

[0271] The processor 220 can also perform the motion restriction processing described in Section 3 above. Specifically, the processor 220 generates a motion restriction signal LMT based on the result of the remote instruction verification processing. The processor 220 transmits the motion restriction signal LMT to the vehicle system 10 via the communication device 210. By transmitting the motion restriction signal LMT to the vehicle system 10, the movement of the vehicle 1 can be indirectly restricted.

[0272] 6-7. Confirmation and Processing

[0273] Here, consider Figure 3 The automated valet parking system is shown. Alternatively, while AVP vehicle 1A is parked in the parking lot, management system 2 (vehicle management center 2A) sends a test remote instruction INS-T to AVP vehicle 1A. The test remote instruction INS-T indicates that the power to AVP vehicle 1A is turned on while it is parked. For example, management system 2 sends the test remote instruction INS-T periodically. As another example, management system 2 may also send the test remote instruction INS-T a certain time before the scheduled departure time.

[0274] In response to the test remote indication INS-T, the remote indication verification unit 100 performs the remote indication verification process described in Section 3. If an anomaly is detected, the remote indication verification unit 100 notifies the management system 2 of the anomaly detection. Figure 8 (Step S400 in the process). Thus, it is possible to spontaneously sense the occurrence of anomalies in AVP vehicle 1A.

[0275] If no abnormality is detected within a certain period after the transmission of the test remote indication INS-T, the management system 2 determines that the parked AVP vehicle 1A is normal. In this case, the management system 2 sends a remote indication INS indicating power disconnection to the AVP vehicle 1A.

[0276] In this way, the status of AVP vehicle 1A in parking can be confirmed by sending a test remote instruction INS-T.

Claims

1. A method for controlling a mobile body, comprising controlling a mobile body having the function of performing actions according to remote instructions within a specified area, wherein, The moving body control method includes: The remote indication verification process determines whether the remote indication received by the mobile body is a legitimate remote indication or a spoofed remote indication. A legitimate remote indication refers to a remote indication sent from the management system, and a spoofed remote indication refers to a remote indication not sent from the management system. Action restriction processing, in cases where the remote instruction received by the mobile body is a spoofed remote instruction, restricts at least a portion of the mobile body's actions without following the spoofed remote instruction. The remote instruction verification process includes: When the mobile body receives the remote instruction, it is determined whether the mobile body exists within the specified area; If the mobile body is located within the designated area when it receives the remote instruction, the remote instruction is determined to be a legitimate remote instruction; and If the mobile body is not present within the designated area when it receives the remote instruction, the remote instruction is determined to be a spoofed remote instruction. Landmarks are placed within the designated area. Determining whether the moving body exists within the specified area includes: Determine whether the landmark can be identified from the location of the moving body; and If the landmark cannot be identified from the location of the moving object, it is determined that the moving object does not exist within the specified area.

2. The moving body control method according to claim 1, wherein, The motion restriction process includes disconnecting the power supply to the moving body.

3. The moving body control method according to claim 1, wherein, The motion restriction process includes prohibiting the movement of the moving body.

4. The moving body control method according to claim 3, wherein, The motion restriction process includes simultaneously prohibiting the movement of the moving body and issuing an alarm from the moving body.

5. The moving body control method according to claim 1, wherein, If the moving body receives the remote instruction while in motion, the motion restriction process includes stopping the moving body.

6. The moving body control method according to any one of claims 1 to 5, wherein, The remote instruction is sent from the management system to the mobile body. The remote instruction verification process also includes: Confirm whether the management system actually sent the remote instruction to the mobile body; and If the management system does not actually send the remote instruction to the mobile body, the remote instruction is determined to be a fake remote instruction.

7. The moving body control method according to any one of claims 1 to 5, wherein, Landmarks are placed within the designated area. Reference information corresponding to the reference landmarks identified from the location of the mobile body before the power to the mobile body is disconnected is stored in a designated storage device. When the remote indication instructs the power supply of the mobile body to be turned on, the remote indication verification process further includes: Obtain the latest landmark information identified from the location of the moving body; Based on the reference information, determine whether the latest landmark is consistent with the reference landmark; and If the latest landmark is inconsistent with the reference landmark, the remote indication is determined to be the spoofed remote indication.

8. A mobile body control system for controlling a mobile body having the function of performing actions according to remote instructions within a specified area, wherein, The mobile body control system has one or more processors. The one or more processors are configured to execute: The remote indication verification process determines whether the remote indication received by the mobile body is a legitimate remote indication or a spoofed remote indication. A legitimate remote indication refers to a remote indication sent from the management system, and a spoofed remote indication refers to a remote indication not sent from the management system. Action restriction processing, in cases where the remote instruction received by the mobile body is a spoofed remote instruction, restricts at least a portion of the mobile body's actions without following the spoofed remote instruction. The remote instruction verification process includes: When the mobile body receives the remote instruction, it is determined whether the mobile body exists within the specified area; If the mobile body is located within the designated area when it receives the remote instruction, the remote instruction is determined to be a legitimate remote instruction; and If the mobile body is not present within the designated area when it receives the remote instruction, the remote instruction is determined to be a spoofed remote instruction. Landmarks are placed within the designated area. Determining whether the moving body exists within the specified area includes: Determine whether the landmark can be identified from the location of the moving body; and If the landmark cannot be identified from the location of the moving object, it is determined that the moving object does not exist within the specified area.

9. A computer-readable recording medium, comprising a mobile body control program for controlling a mobile body having the function of performing actions according to remote instructions within a specified area, wherein, The movement control program is configured to cause the computer to execute when it is executed by the computer: The remote indication verification process determines whether the remote indication received by the mobile body is a legitimate remote indication or a spoofed remote indication. A legitimate remote indication refers to a remote indication sent from the management system, and a spoofed remote indication refers to a remote indication not sent from the management system. Action restriction processing, in cases where the remote instruction received by the mobile body is a spoofed remote instruction, restricts at least a portion of the mobile body's actions without following the spoofed remote instruction. The remote instruction verification process includes: When the mobile body receives the remote instruction, it is determined whether the mobile body exists within the specified area; If the mobile body is located within the designated area when it receives the remote instruction, the remote instruction is determined to be a legitimate remote instruction; and If the mobile body is not present within the designated area when it receives the remote instruction, the remote instruction is determined to be a spoofed remote instruction. Landmarks are placed within the designated area. Determining whether the moving body exists within the specified area includes: Determine whether the landmark can be identified from the location of the moving body; and If the landmark cannot be identified from the location of the moving object, it is determined that the moving object does not exist within the specified area.

Images