Processing method, processing system, processing program

Abstract

The present application relates to a processing method, a processing system, a processing program. A processing method executed by a processor for performing processing related to driving of a host mobile body capable of communicating with a target mobile body includes: monitoring, in the host mobile body, violation of a safety envelope in which safety of an expected function between the target mobile body and other road users other than the target mobile body is set, i.e., envelope violation; and in a case where the envelope violation is recognized in the host mobile body, generating warning information that warns of the envelope violation to be transmitted to the target mobile body.

Description

[0001] Cross-reference to related applications

[0002] This application is based on Japanese Patent Application No. 2021-53970, filed in Japan on March 26, 2021, and is incorporated herein by reference in its entirety. Technical Field

[0003] This disclosure relates to processing techniques for performing driving-related processing of a moving body. Background Technology

[0004] The technology disclosed in Patent Document 1 plans driving control related to the navigation actions of the main vehicle based on detection information related to the internal and external environment of the main vehicle. Therefore, driving control is constrained when a potential accident liability is determined based on a safety model according to the driving strategy and the detection information.

[0005] Patent Document 1: Japanese Patent No. 6708793

[0006] However, the technology disclosed in Patent Document 1 assumes that even if other road users besides the target vehicle are detected from the main vehicle, these other road users may be obscured by the main vehicle and difficult for the target vehicle to detect. In this case, there are concerns about the impact on the response to other road users. Summary of the Invention

[0007] The present disclosure addresses the issue of providing a processing method that enhances the ability to respond to other road users. Another issue of the present disclosure is providing a processing system that enhances the ability to respond to other road users. Yet another issue of the present disclosure is providing a processing procedure that enhances the ability to respond to other road users.

[0008] The technical means of this disclosure used to solve the problem will be described below.

[0009] The first aspect of this disclosure is a processing method executed by a processor for performing driving-related processing of a master mobile body capable of communicating with a target mobile body, comprising:

[0010] Monitoring violations of the security envelope, i.e., envelope violations, within the primary mobile vehicle that define the security of intended functions with other road users besides the target mobile vehicle; and

[0011] If an envelope violation is detected in the primary mobile body, a warning message indicating an envelope violation is generated and sent to the target mobile body.

[0012] The second aspect of this disclosure is a processing system that includes a processor to perform driving-related processing of a master mobile body capable of communicating with a target mobile body.

[0013] The processor is configured to execute:

[0014] Monitoring violations of the security envelope, i.e., envelope violations, within the primary mobile vehicle that define the security of intended functions with other road users besides the target mobile vehicle; and

[0015] If an envelope violation is detected in the primary mobile body, a warning message indicating an envelope violation is generated and sent to the target mobile body.

[0016] The third aspect of this disclosure is stored in a storage medium, comprising a processor that executes commands for performing driving-related processing of a master mobile body capable of communicating with a target mobile body.

[0017] The command includes:

[0018] Monitoring violations of the security envelope, i.e., envelope violations, within the primary mobile vehicle that define the security of intended functions with other road users besides the target mobile vehicle; and

[0019] If an envelope violation is detected in the primary mobile body, a warning message indicating an envelope violation is generated and sent to the target mobile body.

[0020] In these first to third types of master mobile units, violations of the security envelope (i.e., the envelope itself) are monitored, which sets the security of the intended functions between the master mobile unit and other road users besides the target mobile unit. Therefore, upon detecting an envelope violation with other road users, the master mobile unit generates a warning message about the envelope violation and sends it to the target mobile unit. This allows the target mobile unit to also commonly identify envelope violations warned about by the master mobile unit regarding other road users, thereby improving the ability to respond to other road users.

[0021] The fourth aspect of this disclosure is a processing method executed by a processor for performing driving-related processing of a master mobile body capable of communicating with a target mobile body.

[0022] The warning obtained from the target vehicle indicates a violation of the security envelope, i.e., an envelope violation warning message, set within the target vehicle to ensure the security of intended functions between the target vehicle and other road users besides the primary vehicle; and

[0023] In response to the acquisition of warning information, determine whether there is an envelope violation with other road users.

[0024] The fifth aspect of this disclosure is a processing system that includes a processor to perform driving-related processing of a master mobile body capable of communicating with a target mobile body.

[0025] The processor is configured to execute:

[0026] The warning obtained from the target vehicle indicates a violation of the security envelope, i.e., an envelope violation warning message, set within the target vehicle to ensure the security of intended functions between the target vehicle and other road users besides the primary vehicle; and

[0027] In response to the acquisition of warning information, determine whether there is an envelope violation with other road users.

[0028] The sixth aspect of this disclosure is stored in a storage medium and includes a processor that executes commands for performing driving-related processing of a master mobile body capable of communicating with a target mobile body.

[0029] The command includes:

[0030] The warning obtained from the target vehicle indicates a violation of the security envelope, i.e., an envelope violation warning message, set within the target vehicle to ensure the security of intended functions between the target vehicle and other road users besides the primary vehicle; and

[0031] In response to the acquisition of warning information, determine whether there is an envelope violation with other road users.

[0032] In these fourth to sixth modes of the primary mobile body, a warning is obtained from the target mobile body regarding a violation of the security envelope (i.e., an envelope violation) that indicates a breach of the intended functional security between the target mobile body and other road users besides the primary mobile body. Therefore, in response to the acquisition of the warning information, the primary mobile body determines whether an envelope violation exists between it and other road users. Thus, the primary mobile body can also commonly identify envelope violations warned by the target mobile body regarding other road users and reflect this in the determination of the existence of envelope violations, thereby improving the ability to respond to other road users. Attached Figure Description

[0033] Figure 1 This is a descriptive table indicating the explanation of the terms used in this disclosure.

[0034] Figure 2 This is a descriptive table indicating the explanation of the terms used in this disclosure.

[0035] Figure 3 This is a descriptive table indicating the explanation of the terms used in this disclosure.

[0036] Figure 4 This is a table of definitions indicating the terms used in this disclosure.

[0037] Figure 5 This is a table of definitions indicating the terms used in this disclosure.

[0038] Figure 6 This is a block diagram illustrating the processing system of the first embodiment.

[0039] Figure 7 This is a schematic diagram illustrating the driving environment of the vehicle used in the first embodiment.

[0040] Figure 8 This is a schematic diagram illustrating the driving environment of the vehicle used in the first embodiment.

[0041] Figure 9 This is a block diagram illustrating the processing system of the first embodiment.

[0042] Figure 10 This is a schematic diagram illustrating a lane structure example and processing method of the first embodiment.

[0043] Figure 11 This is a schematic diagram illustrating a lane structure example and processing method of the first embodiment.

[0044] Figure 12 This is a schematic diagram illustrating a lane structure example and processing method of the first embodiment.

[0045] Figure 13 This is a schematic diagram illustrating a lane structure example and processing method of the first embodiment.

[0046] Figure 14 This is a schematic diagram illustrating a lane structure example and processing method of the first embodiment.

[0047] Figure 15 This is a schematic diagram illustrating a lane structure example and processing method of the first embodiment.

[0048] Figure 16 This is a flowchart illustrating the processing method of the first embodiment.

[0049] Figure 17 This is a flowchart illustrating the processing method of the first embodiment.

[0050] Figure 18 This is a flowchart illustrating the processing method of the second embodiment.

[0051] Figure 19 This is a flowchart illustrating the processing method of the second embodiment.

[0052] Figure 20 This is a block diagram illustrating the processing system of the third embodiment.

[0053] Figure 21 This is a block diagram illustrating the processing system of the fourth embodiment.

[0054] Figure 22 This is a block diagram illustrating the processing system of the fifth embodiment.

[0055] Figure 23This is a block diagram illustrating the processing system of the sixth embodiment.

[0056] Figure 24 This is a block diagram illustrating the processing system of the sixth embodiment. Detailed Implementation

[0057] Hereinafter, several embodiments of the present disclosure will be described based on the accompanying drawings. It should be noted that there are instances where repeated descriptions are omitted by using the same reference numerals for corresponding components in each embodiment. Furthermore, when only a portion of the structure is described in each embodiment, structures from other previously described embodiments can be applied to the remaining portions of that structure. Moreover, not only combinations of structures explicitly shown in the descriptions of each embodiment are possible, but structures from multiple embodiments can be partially combined with each other, even if not explicitly shown, as long as the combination does not create obstacles.

[0058] Figures 1-5 The following description illustrates the terminology related to various embodiments of this disclosure. The definitions of these terms are not limited to... Figures 1-5 The explanation is not intended to be based on the description shown, but rather to be interpreted within the scope of the spirit of this disclosure.

[0059] (First Implementation)

[0060] Figure 6 The processing system 1 of the first embodiment shown performs driving-related processing (hereinafter referred to as driving-related processing) of the mobile body. The mobile body to which the driving-related processing is addressed in the processing system 1 is... Figure 7 , 8 The vehicle 2 shown. In the first embodiment, the vehicle 2 used by the processing system 1 is assumed to be a first vehicle 2a and a second vehicle 2b capable of communicating directly or indirectly with each other via a communication infrastructure. Figure 7 From the viewpoint of the first vehicle 2a shown, the ego-vehicle 2a is equivalent to the main moving body, while the second vehicle 2b, which is also an other road user 3 existing in the driving environment of the ego-vehicle 2a, is equivalent to the target moving body. In contrast, in Figure 8 From the perspective of the second vehicle 2b shown, this vehicle 2b is equivalent to the main moving body, while the first vehicle 2a, which is also an other road user 3 existing in the driving environment of this vehicle 2b, is equivalent to the target moving body.

[0061] Figure 7 , 8The vehicle 2 shown is a road user, such as a car or truck, performing autonomous driving. Autonomous driving is graded based on the degree of occupant manual intervention in the Dynamic Driving Task (DDT). Autonomous driving can also be achieved by a system performing all of the DDT's autonomous driving control while operating under conditions of driving automation, high-level driving automation, or full driving automation. Autonomous driving can also be achieved by a driver, acting as an occupant, performing some or all of the DDT's high-level driving assistance control, such as driving assistance or partial driving automation. Autonomous driving can also be achieved through any one of these autonomous driving controls and high-level driving assistance controls, a combination of them, or a switching between them.

[0062] Vehicle 2 is equipped with Figure 6 , 9 The sensor system 5, communication system 6, map database 7, and information display system 4 are shown. The sensor system 5 acquires sensor data that can be used by the processing system 1 by detecting the external and internal boundaries of the vehicle 2. For this purpose, the sensor system 5 is configured to include an external sensor 50 and an internal boundary sensor 52.

[0063] External sensor 50 can also detect objects present outside the vehicle 2. Object detection type external sensor 50 includes, for example, at least one of a camera, LiDAR (Light Detection and Ranging / Laser Imaging Detection and Ranging), lidar, millimeter-wave radar, and ultrasonic sonar. External sensor 50 can also detect the state of the atmosphere outside the vehicle 2. Atmospheric detection type external sensor 50 includes, for example, at least one of an external temperature sensor and a humidity sensor.

[0064] The interior boundary sensor 52 can also detect specific physical quantities (hereinafter referred to as motion physical quantities) related to vehicle motion within the interior boundary of the vehicle 2. The interior boundary sensor 52 of the physical quantity detection type is, for example, at least one of a speed sensor, an acceleration sensor, and a gyroscope sensor. The interior boundary sensor 52 can also detect the state of the occupants within the interior boundary of the vehicle 2. The interior boundary sensor 52 of the occupant detection type is, for example, at least one of an actuator sensor, a driver state monitor, a bio-sensor, a seating sensor, and an in-vehicle equipment sensor. Specifically, as an actuator sensor, at least one of an acceleration sensor, a braking sensor, and a steering control sensor is used to detect the occupant's operating state related to the motion actuator of the vehicle 2.

[0065] Communication system 6 acquires communication data that can be used by processing system 1 via wireless communication. Communication system 6 can also receive positioning signals from GNSS (Global Navigation Satellite System) satellites located outside the vehicle 2. Positioning-type communication system 6 is, for example, a GNSS receiver. Communication system 6 can also transmit and receive communication signals with V2X systems located outside the vehicle 2. V2X-type communication system 6 is, for example, at least one of DSRC (Dedicated Short Range Communications) communicators and cellular V2X (C-V2X) communicators. In the first embodiment, communication between the assumed vehicles 2 (2a, 2b) can be achieved via the V2X-type communication system 6 in each of these vehicles 2. Communication system 6 can also transmit and receive communication signals with terminals located inside the vehicle 2. Terminal communication-type communication system 6 is, for example, at least one of Bluetooth devices, Wi-Fi devices, and infrared communication devices.

[0066] Map DB7 stores map data that can be used by processing system 1. Map DB7 may be configured as, for example, at least one non-transitorytangible storage medium, including semiconductor memory, magnetic media, and optical media. Map DB7 may also be a DB of a locator that estimates the self-state quantities of vehicle 2, including its own position. Map DB may also be a DB of a navigation unit that navigates the driving path of vehicle 2. Map DB7 may also be constructed from a combination of multiple types of DBs.

[0067] Map DB7 acquires and stores the latest map data, for example, through communication with an external center via a V2X-type communication system 6. The map data, representing the driving environment of vehicle 2, is digitized in two or three dimensions. As three-dimensional map data, high-precision map digital data can also be used. The map data may also include, for example, road data representing at least one of the following: the location coordinates, shape, and road surface condition of road structures. The map data may also include, for example, label data representing at least one of the following: the location coordinates and shape of road signs, road displays, and zoning lines attached to the road. The label data included in the map data may also represent road signs such as traffic signs, arrow marks, lane markings, stop lines, directional signs, road beacons, rectangular signs, commercial signs, or changes in road line maps. The map data may also include, for example, structure data representing at least one of the following: the location coordinates and shape of road-facing structures and traffic lights. The label data included in the map data may also represent road signs such as streetlights, road edges, reflectors, utility poles, or the back of road signs.

[0068] Information prompting system 4 prompts occupants, including the driver of vehicle 2, with reported information. Information prompting system 4 is configured to include a visual prompting unit, an auditory prompting unit, and a skin-sensory prompting unit. The visual prompting unit prompts reported information by stimulating the occupant's vision. The visual prompting unit is, for example, at least one of a HUD (Head-up Display), an MFD (Multi-Function Display), an instrument cluster, a navigation unit, and a light-emitting unit. The auditory prompting unit prompts reported information by stimulating the occupant's hearing. The auditory prompting unit is, for example, at least one of a speaker, a buzzer, and a vibration unit. The skin-sensory prompting unit prompts reported information by stimulating the occupant's skin sensation. The skin sensation stimulated by the skin-sensory prompting unit includes, for example, at least one of touch, temperature, and wind. The skin-sensory prompting unit is, for example, at least one of a steering wheel vibration unit, a driver's seat vibration unit, a steering wheel reaction force unit, an accelerator pedal reaction force unit, a brake pedal reaction force unit, and an air conditioning unit.

[0069] like Figure 6As shown, the processing system 1 is connected to the sensor system 5, communication system 6, map DB 7, and information prompting system 4 via at least one of the following: LAN (Local Area Network), wiring harness, internal bus, and wireless communication line. The processing system 1 is configured to include at least one dedicated computer. The dedicated computer constituting the processing system 1 may also be an integrated ECU (Electronic Control Unit) that integrates the driving control of the vehicle 2. The dedicated computer constituting the processing system 1 may also be a determination ECU that determines the DDT (Driver Delay) in the driving control of the vehicle 2. The dedicated computer constituting the processing system 1 may also be a monitoring ECU that monitors the driving control of the vehicle 2. The dedicated computer constituting the processing system 1 may also be an evaluation ECU that evaluates the driving control of the vehicle 2.

[0070] The dedicated computer constituting the processing system 1 can also be a navigation ECU that navigates the driving path of the vehicle 2. The dedicated computer constituting the processing system 1 can also be a locator ECU that estimates its own state variables, including the vehicle 2's own position. The dedicated computer constituting the processing system 1 can also be an actuator ECU that controls the motion actuators of the vehicle 2. The dedicated computer constituting the processing system 1 can also be an HCU (Hman Machine Interface Control Unit) that controls information prompts in the vehicle 2. The dedicated computer constituting the processing system 1 can also be, for example, at least one external computer, such as an external center or mobile terminal capable of communication via the communication system 6.

[0071] Each dedicated computer constituting the processing system 1 has at least one memory 10 and a processor 12. The memory 10 is a non-transitory tangible storage medium, such as semiconductor memory, magnetic media, and optical media, that non-transitory stores computer-readable programs and data. The processor 12 includes, for example, at least one of the following as its core: CPU (Central Processing Unit), GPU (Graphics Processing Unit), and RISC (Reduced Instruction Set Computer) – CPU.

[0072] The processor 12 executes multiple commands contained in a processing program stored as software in the memory 10. Thus, the processing system 1 constructs multiple functional modules for performing driving-related processing of the vehicle 2. In this way, in the processing system 1, the processing program stored in the memory 10 for performing driving-related processing of the vehicle 2 constructs multiple functional modules by causing the processor 12 to execute multiple commands. For example... Figure 8 As shown, the multiple functional modules constructed by the processing system 1 include a detection module 100, a planning module 120, a risk monitoring module 140, and a control module 160.

[0073] The detection module 100 acquires sensor data from the external sensor 50 and the internal sensor 52 of the sensor system 5. The detection module 100 acquires communication data from the communication system 6. The detection module 100 acquires map data from the map DB7. The detection module 100 detects the internal and external environment of the vehicle 2 by fusing these acquired data as inputs. Through the detection of the internal and external environment, the detection module 100 generates detection information for the subsequent planning module 120 and risk monitoring module 140. Thus, it can be said that when generating detection information, the detection module 100 acquires data from the sensor system 5 and the communication system 6, identifies or understands the meaning of the acquired data, and integrates the acquired data to grasp the overall situation including the external conditions of the vehicle 2, its own situation within them, and the internal conditions of the vehicle 2. The detection module 100 can also provide substantially the same detection information to the planning module 120 and the risk monitoring module 140. Alternatively, the detection module 100 can provide different detection information to the planning module 120 and the risk monitoring module 140.

[0074] The detection information generated by the detection module 100 represents the state of detection for each scene in the driving environment of the vehicle 2. The detection module 100 can also generate object detection information by detecting objects in the external environment of the vehicle 2, including other road users 3, obstacles, and structures. Object detection information may represent at least one of the following: distance to the object, relative velocity of the object, relative acceleration of the object, and estimated state based on object tracking detection. Object detection information may further represent the type identified or determined based on the state of the detected object. The detection module 100 can also generate track detection information by detecting the current and future track that the vehicle 2 is traveling on. Track detection information may represent at least one of the following states: road surface, lane, roadside, and free space.

[0075] The detection module 100 can also generate detection information for its own state quantity by estimating and detecting the localization of the self-state quantity containing the vehicle 2's own position. The detection module 100 can also simultaneously generate update information for map data related to the vehicle 2's runway along with the detection information for its own state quantity, and feed this update information back to map DB7. The detection module 100 can also generate detection information for the markers associated with the vehicle 2's runway. The marker detection information can, for example, represent at least one state of signs, lane markings, and traffic lights. The marker detection information can also further represent traffic rules identified or determined based on the marker's state. The detection module 100 can also generate detection information for weather conditions in each scenario in which the vehicle 2 is traveling. The detection module 100 can also generate detection information for each moment in each travel scenario of the vehicle 2.

[0076] The planning module 120 acquires detection information from the detection module 100. Based on the acquired detection information, the planning module 120 plans the driving control of the vehicle 2. In the driving control plan, control commands related to the navigation actions of the vehicle 2 and the driver's assistance actions are generated. That is, the planning module 120 implements the DDT function, which generates control commands as motion control requests for the vehicle 2. The control commands generated by the planning module 120 may also include control parameters for controlling the motion actuators of the vehicle 2. Examples of motion actuators that become the output objects of the control commands include at least one of an internal combustion engine, an electric motor, a powertrain composed of combinations thereof, a braking system, and a steering mechanism.

[0077] The planning module 120 can also generate control commands suitable for the driving strategy by using a safety model that describes the driving strategy and its safety features. The driving strategy upon which the safety model is based is, for example, defined by a vehicle-level safety strategy that guarantees the intended function (Safety Of The Intended Functionality, hereinafter referred to as SOTIF). In other words, the safety model is described by modeling the SOTIF based on a driving strategy that implements the vehicle-level safety strategy. The planning module 120 can also train the safety model using a machine learning algorithm that backpropagates the driving control results to the safety model. The safety model used for training can be, for example, at least one learning model such as deep learning based on neural networks like DNNs (Deep Neural Networks) or reinforcement learning. The safety model referred to here can be either the safety-related models themselves or models that constitute a part of the safety-related models.

[0078] The planning module 120 can also plan the future path of vehicle 2 through driving control before generating control commands. The path planning can also be performed, for example, through simulation or other calculations, to navigate vehicle 2 based on path planning detection information. That is, the planning module 120 can also implement the DDT (Direct Targeting) function of planning the path as a tactical action of vehicle 2. The planning module 120 can further plan an appropriate track for vehicle 2 along the planned path based on acquired detection information before generating control commands. That is, the planning module 120 can also implement the DDT function of planning the track of vehicle 2. The track planned by the planning module 120 can, for example, specify at least one of the following as motion physical quantities related to vehicle 2, such as driving position, speed, acceleration, and yaw rate, according to a time series. The time series track planning constructs a future driving scheme based on the navigation of vehicle 2. The planning module 120 can also generate a track based on a plan using a safety model. In this case, a cost function that assigns a cost to the generated track can be calculated, and a machine learning algorithm based on the calculation result can be used to train the safety model.

[0079] The planning module 120 can also plan adjustments to the autonomous driving level in vehicle 2 based on the acquired detection information. The adjustment of the autonomous driving level can also include a handover between autonomous and manual driving. The handover between autonomous and manual driving can also be achieved by setting an autonomous driving operation design area and implementing entry into or exit from that operation design area. In the exit scheme from the operation design area, i.e., the handover scheme from autonomous to manual driving, an unreasonable situation deemed to have unreasonable risks based on a safety model can be cited as a use case. In this use case, the planning module 120 can also plan a DDT (Driver-Driven Delay) rollback, where the driver, acting as a rollback candidate, performs a minimum-risk operation on vehicle 2 to move vehicle 2 to a minimum-risk state.

[0080] The adjustment of the autonomous driving level may also include the downgrade of vehicle 2. In the downgrade scenario, an example use case could be an unreasonable situation determined based on a safety model, where an unreasonable risk exists due to the handover to manual driving. In this use case, the planning module 120 can also plan a DDT rollback to move vehicle 2 to the minimum risk state through autonomous driving and autonomous stopping. The DDT rollback to move vehicle 2 to the minimum risk state can be implemented not only in adjustments to reduce the autonomous driving level, but also in adjustments to maintain the autonomous driving level while downgrading, such as in MRM (Minimum Risk Maneuver). In the DDT rollback to move vehicle 2 to the minimum risk state, the visibility of the transition can be increased, for example, through at least one of lighting, horn sounds, signals, and gestures.

[0081] The risk monitoring module 140 acquires detection information from the detection module 100. Based on the acquired detection information, the risk monitoring module 140 monitors the risk between vehicle 2 and other road users 3 for each scenario. The risk monitoring module 140 performs risk monitoring based on the detection information in a time-series manner to ensure the SOTIF of vehicle 2 for other road users 3. The other road users 3 assumed in the risk monitoring include, for example, non-vulnerable road users such as cars, trucks, motorcycles, and bicycles, and vulnerable road users such as pedestrians. Animals may also be included among the other road users 3 assumed in the risk monitoring.

[0082] The risk monitoring module 140 sets a safety envelope in vehicle 2 that ensures SOTIF (Safety in Context of Context) based on the detection information acquired for each scenario, such as a vehicle-level safety strategy. The risk monitoring module 140 can also use a safety model based on the aforementioned driving strategy to set a safety envelope between vehicle 2 and other road users 3. The safety model used to set the safety envelope can also be designed to comply with accident liability rules and avoid potential accident liability caused by unreasonable risks or misuse by road users. In other words, the safety model can also be designed to ensure that vehicle 2 complies with accident liability rules based on the driving strategy. Examples of such a safety model include, for instance, the responsibility-sensitive safety model disclosed in Patent Document 1.

[0083] In setting the safety envelope, a safety distance can be assumed based on a safety model for vehicle 2 and other road users 3, assumed to be based on a driving strategy, and according to a profile related to at least one physical quantity of motion. The safety distance defines a boundary around vehicle 2 that ensures a physical margin for the predicted motion of other road users 3. The safety distance can also be assumed by taking into account the reaction time until vehicle 2 and other road users 3 each execute an appropriate response. The safety distance can also be assumed to comply with accident liability rules. For example, in scenarios with lane structures such as lanes, a safety distance can be calculated to avoid the risk of rear-end collisions and frontal collisions in the longitudinal direction of vehicle 2, and a safety distance to avoid the risk of side collisions in the lateral direction of vehicle 2. On the other hand, in scenarios without lane structures, a safety distance can also be calculated to avoid the risk of track collisions in any direction of vehicle 2.

[0084] The risk monitoring module 140 can also determine the relative motion between vehicle 2 and other road users 3 in each scenario before setting the aforementioned safety envelope. For example, in scenarios with lane structures such as lanes, it can determine the risk of rear-end collision and frontal collision in the longitudinal direction, and the risk of side collision in the lateral direction. In these longitudinal and lateral situation determinations, the state variables related to vehicle 2 and other road users 3 can be transformed to a coordinate system based on straight lanes. On the other hand, in scenarios without lane structures, it can determine the risk of track collision in any direction of vehicle 2. Furthermore, the situation determination function described above can be performed at least partly by the detection module 100, thereby providing the situation determination results as detection information to the risk monitoring module 140.

[0085] The risk monitoring module 140 performs a safety determination between vehicle 2 and other road users 3 based on a set safety envelope and the detection information acquired for each scenario. Specifically, the risk monitoring module 140 determines safety by testing whether there is an envelope violation in the driving scenario between vehicle 2 and other road users 3, as interpreted based on the detection information. If a safe distance is assumed in the setting of the safety envelope, a determination of no envelope violation can be made if the actual distance between vehicle 2 and other road users 3 exceeds this safe distance. Conversely, a determination of envelope violation can be made if the actual distance between vehicle 2 and other road users 3 is below the safe distance.

[0086] In the event of an envelope violation, the risk monitoring module 140 can also use simulation to calculate a reasonable plan for the appropriate action to be taken to provide an appropriate response to vehicle 2. During the simulation of the reasonable plan, the actions to be taken at each transition state can be estimated as constraints on vehicle 2 (described in detail later) by estimating the state transitions between vehicle 2 and other road users 3. In setting the actions, a limit value can also be calculated on at least one assumed motion physical quantity given to vehicle 2 to limit that motion physical quantity as a constraint on vehicle 2.

[0087] The risk monitoring module 140 can also directly calculate the limit values ​​for complying with accident liability rules based on a configuration file related to at least one motion physical quantity, using a safety model for vehicle 2 and other road users 3 that assumes a driving strategy. The calculation of these direct limit values ​​can be considered itself a setting of the safety envelope, and also a setting of constraints on driving control. Therefore, if a real value is detected that is closer to the safe side than the limit value, a determination of no envelope violation can be made. On the other hand, if a real value is detected that deviates from the limit value, a determination of envelope violation can be made.

[0088] The risk monitoring module 140 may store at least one of the following evidence information in the memory 10: detection information for setting the security envelope, determination information indicating the determination result of the security envelope, detection information affecting the determination result, and simulation scheme. Depending on the type of dedicated computer constituting the processing system 1, the memory 10 storing the evidence information may be installed inside the vehicle 2 or, for example, located in an external center outside the vehicle 2. The evidence information may be stored unencrypted, encrypted, or hashed before storage. Storage of evidence information is performed at least in the case of a determination of envelope violation. Of course, storage of evidence information may also be performed even in the case of no determination of envelope violation. Evidence information in the case of no determination of envelope violation can be effectively used as a lagging indicator at the time of storage and can also be effectively used as a forward indicator in the future.

[0089] Control module 160 obtains control commands from planning module 120. Control module 160 obtains judgment information related to the safety envelope from risk monitoring module 140. Control module 160 implements the DDT function to control the movement of vehicle 2. When control module 160 obtains judgment information indicating no envelope violation, it executes the planned driving control of vehicle 2 according to the control commands.

[0090] In contrast, when the control module 160 obtains judgment information indicating an envelope violation, it imposes constraints on the planned driving control of the vehicle 2 based on the judgment information and the driving strategy. These constraints on driving control can be functional restrictions, degraded constraints, or different types of constraints. Driving control is constrained by limiting control commands. If the risk monitoring module 140 simulates a reasonable scenario, the control module 160 can also limit control commands based on that scenario. In this case, if limit values ​​are set for the motion physical quantities of the vehicle 2, the control parameters of the motion actuators included in the control commands can be modified based on these limit values.

[0091] The first embodiment will now be described in detail.

[0092] like Figure 7 , 8 As shown in Figures 10-15, the first embodiment assumes a lane configuration Ls that divides the lanes. The lane configuration Ls uses the direction of lane extension as the longitudinal direction to restrict the movement of vehicles 2 and other road users 3. The lane configuration Ls uses the width direction or the arrangement direction of the lanes as the lateral direction to restrict the movement of vehicles 2 and other road users 3.

[0093] For example, between a first vehicle 2a and a second vehicle 2b, where one party is assumed to be vehicle 2 and the other is another road user 3, the driving strategy under lane configuration Ls is specified as follows (A) to (E). Furthermore, "forward" relative to vehicle 2 means, for example, the direction of travel on the turning circle at the current steering angle of vehicle 2, the direction of travel on a straight line passing through the center of gravity of the vehicle that is orthogonal to the axle of vehicle 2, or the direction of travel on the axis of the front camera module in the sensor system 5 of vehicle 2 towards the FOE (Focus of Expansion) of that camera.

[0094] (A) Vehicle 2 does not rear-end Vehicle 2 traveling in front of it.

[0095] (B) Vehicle 2 shall not forcibly insert itself between other vehicles 2.

[0096] (C) Even when it has priority, vehicle 2 will give way to other vehicles 2 depending on the situation.

[0097] (D) Vehicle 2 should be driven with caution in areas with poor visibility.

[0098] (E) Regardless of whether it is their own fault or the fault of others, vehicle 2 shall take reasonable action as long as it is within its ability to prevent the accident.

[0099] As a safety model based on driving strategy and modeled on SOTIF, it assumes that the actions of road users will not reach unreasonable situations, and these actions are considered appropriate and reasonable actions that should be taken. Unreasonable situations between vehicle 2 and other road users 3 under lane configuration Ls include frontal collisions, rear-end collisions, and side collisions. Reasonable actions in the event of a frontal collision include, for example, braking by the oncoming vehicle 2a or 2b between vehicle 2 and the other vehicle 2b, which is another road user 3. Reasonable actions in the event of a rear-end collision include, for example, not applying a certain amount of emergency braking by the vehicle 2a or 2b in front, and avoiding a rear-end collision by the vehicle 2b or 2a behind. Reasonable actions in the event of a side collision include, for example, steering the parallel vehicles 2a and 2b in opposite directions. When assuming reasonable action, the state variables associated with vehicle 2 and other road users 3, whether it is a lane configuration Ls with lane turning or a lane configuration Ls with uneven lane elevation, are transformed into a lane configuration Ls that is assumed to be straight and planar, and orthogonal coordinate systems are specified for longitudinal and lateral directions.

[0100] A safety model can be designed based on accident liability rules that hold a moving body responsible for an accident for failing to take reasonable action. Under the accident liability rules in the lane configuration Ls, the safety model for monitoring the risk between vehicle 2 and other road users 3 sets a safety envelope for vehicle 2 to avoid potential accident liability through reasonable action. Therefore, the risk monitoring module 140, which handles the overall normal condition of system 1 in vehicle 2, determines whether there is an envelope violation by comparing the safe distance based on the safety model with the actual distance between vehicle 2 and other road users 3 in each driving scenario. In the case of an envelope violation, the risk monitoring module 140 simulates a scheme to give vehicle 2 reasonable action. Through simulation, the risk monitoring module 140 sets, for example, a limit value related to at least one of speed and acceleration as a constraint on driving control in the control module 160.

[0101] like Figures 10-15 As shown, the risk monitoring module 140 assumes a model envelope Em as the safety envelope based on the safety model described above, within the SOTIF safety envelope set according to the driving strategy. Further, the risk monitoring module 140 assumes an extended envelope Ee as the safety envelope to which a physical margin is added based on the model envelope Em. Under these assumptions, the safety distance of the extended envelope Ee is set to be larger than the safety distance of the model envelope Em. That is, the extended envelope Ee is set to encompass a larger range of the model envelope Em. Therefore, the margin can also be set as a certain distance added to the safety distance of the model envelope Em, or a variable distance, such as based on the safety model.

[0102] In the first embodiment, in the first vehicle 2a and the second vehicle 2b, which are paired vehicles 2 that are assumed to communicate with each other directly or indirectly, respectively according to Figure 16 , 17 The flowchart shown illustrates a processing method that performs driving-related processing through the combined action of functional modules constructed by their respective processing systems 1. While the distance between the first vehicle 2a and the second vehicle 2b is within a set range, the processing method of the first embodiment is repeatedly executed in each of these vehicles 2a and 2b. Furthermore, in the following description, each "S" in the processing method refers to multiple steps executed in the processing system 1 of each vehicle 2a and 2b through multiple commands included in the processing program.

[0103] exist Figure 16 , 17In S100 and S110 shown, the risk monitoring modules 140 of the first vehicle 2a and the second vehicle 2b authenticate each other by exchanging user IDs containing authentication keys through mutual communication. This mutual authentication may only be a confirmation of security and the ability to communicate. Alternatively, in addition to confirming security and the ability to communicate, this mutual authentication may also include confirmation of whether the adopted safety model or driving strategy has a safety envelope setting function.

[0104] like Figure 16 As shown, in S101 following S100 of the processing method, the risk monitoring module 140 of the first vehicle 2a determines whether other road users 3, other than the second vehicle 2b, are detected within the monitoring range of the safety envelope between the first vehicle 2a and the second vehicle 2b. Based on the detection information from the detection module 100 of the first vehicle 2a, it determines whether other road users 3, other than the second vehicle 2b, have been identified. The monitoring range of the safety envelope in the first vehicle 2a is set to include... Figures 10-12 The model envelope Em and the extended envelope Ee shown have a large range. Therefore, as Figure 16 As shown, in S101, if the risk monitoring module 140 of the first vehicle 2a determines that other road users 3 other than the second vehicle 2b are identified in the monitoring range of the first vehicle 2a, the current process in the first vehicle 2a is moved to S102.

[0105] In S102, the risk monitoring module 140 of the first vehicle 2a monitors envelope violations related to the safety envelope between the first vehicle 2a and other road users 3 besides the second vehicle 2b, using a safety model based on the first vehicle 2a. For example... Figure 10 As shown, in the case where all other road users 3 besides the second vehicle 2b exist outside the extended envelope Ee and the model envelope Em in the first vehicle 2a, envelope violation is not identified. Therefore, in S102, if the risk monitoring module 140 of the first vehicle 2a makes no determination regarding envelope violation, as... Figure 16 As shown, the current process in the first vehicle 2a has ended.

[0106] On the other hand, such as Figure 11 As shown, in the case where at least a portion of the other road users 3 besides the second vehicle 2b exist outside the model envelope Em in the first vehicle 2a, an extended envelope violation is identified as an envelope violation. Additionally, as... Figure 12 As shown, in the case where at least a portion of the other road users 3 besides the second vehicle 2b exist within the range of the model envelope Em within the range of the extended envelope Ee in the first vehicle 2a, a model envelope violation is identified as an envelope violation.

[0107] Therefore, in S102, the risk monitoring module 140 of the first vehicle 2a makes a determination related to either model envelope violation or extended model violation, such as... Figure 16 As shown, the current process in the first vehicle 2a is sequentially moved to S103 and S104. That is, if an envelope violation is detected in the first vehicle 2a between the first vehicle and other road users 3 other than the second vehicle 2b, S103 and S104 are executed.

[0108] In S103, the risk monitoring module 140 of the first vehicle 2a generates warning information Iw to warn the second vehicle 2b of an envelope violation with other road users 3. Warning information Iw may also include notification information In that the envelope violation is pushed from the first vehicle 2a to the second vehicle 2b. Warning information Iw may also be a composite of notification information In with attached status information Is. Status information Is may also include envelope information Ise related to the safety envelope set in the first vehicle 2a.

[0109] Envelope information Ise can also represent the range of a safety envelope containing a safe distance that serves as the criterion for determining envelope violation in the first vehicle 2a. Envelope information Ise can also represent a safety model defined as the safety envelope that serves as the criterion for determining envelope violation, assuming at least one risk type among the relative states between the first vehicle 2a and other road users 3, such as rear-end collision risk, frontal collision risk, side collision risk, intersection risk, blind spot risk, and their detailed conditions.

[0110] The envelope information Ise can also represent, for example, at least one of the following: a self-state quantity including position (i.e., a location estimate), distance, velocity, acceleration / deceleration, relative velocity, relative acceleration, and estimated states and types containing these vectors, as detection information of the first vehicle 2a detected by the detection module 100 of the first vehicle 2a in a scenario of envelope violation. In particular, the envelope information Ise can also represent at least one of the following detection information detected by the detection module 100 of the first vehicle 2a: velocity, acceleration / deceleration, etc., as a motion physical quantity of the first vehicle 2a that has deviated from the constraint value set by the risk monitoring module 140 in an envelope violation.

[0111] The envelope information Ise can also represent, for example, at least one of position, distance, velocity, acceleration / deceleration, relative velocity, relative acceleration, and estimated states and types containing these vectors, as detection information of other road users 3 detected by the detection module 100 of the first vehicle 2a in the scenario of envelope violation. In particular, the envelope information Ise can also represent at least one of the detection information of other road users 3, such as velocity and acceleration / deceleration, detected by the detection module 100 of the first vehicle 2a, as a motion physical quantity of the first vehicle 2a that has deviated from the limit value set by the constraint based on the risk monitoring module 140 in the scenario of envelope violation. The envelope information Ise can also include images or videos containing other road users 3 captured by the camera of the external sensor 50 of the first vehicle 2a in the scenario of envelope violation.

[0112] In addition to envelope information Is, condition information Is can also represent at least one of the following: path, track, control parameters, and autonomous driving level (including the case where manual driving is set to level 0), as the planning status in the planning module 120 of the first vehicle 2a in the scenario of envelope violation. Condition information Is can also represent at least one of the following: traffic rules, signs, road structure, location, section, road surface condition, light and dark conditions, construction conditions, traffic congestion conditions, the presence of obstacles including falling objects, the structure of ground objects around the road, and blind spots caused by such ground objects or moving bodies, as the road condition in the scenario of envelope violation. Condition information Is can also represent at least one of the following in the scenario of envelope violation: time, time period of the violation scenario including day and night distinctions, and weather conditions (i.e., weather) of the violation scenario.

[0113] The warning message Iw generated in S103 can be sent from the first vehicle 2a to the second vehicle 2b according to the control of the communication system 6 by the risk monitoring module 140 of the first vehicle 2a. In other words, the risk monitoring module 140 of the first vehicle 2a generates the envelope violation warning message Iw and sends it from the first vehicle 2a to the second vehicle 2b in real time in response to the determination of envelope violation. Here, in this embodiment, the transmission between the vehicles 2a and 2b can be realized directly by the communication system 6 of the V2V type, or indirectly through a remote center such as a cloud server, or through a mesh network composed of multiple vehicles including vehicles 2a and 2b.

[0114] In S104, the risk monitoring module 140 of the first vehicle 2a stores the generated warning information Iw in the memory 10 of the first vehicle 2a. The warning information Iw can also be stored in association with a timestamp representing the generation or transmission time in the first vehicle 2a, thereby accumulating warning information Iw at multiple times. The warning information Iw can also be stored through encryption or hashing processing in the first vehicle 2a. The warning information Iw can also be stored as evidence information. The warning information Iw can also be deleted after a set period has elapsed since the generation or transmission time in the first vehicle 2a. If S104 is completed, the current process in the first vehicle 2a ends.

[0115] like Figure 17 As shown, in S111 following S110, the risk monitoring module 140 of the second vehicle 2b determines whether other road users 3 besides the first vehicle 2a are detected within the monitoring range of the safety envelope between the second vehicle 2b and the first vehicle 2a. Based on the detection information from the detection module 100 of the second vehicle 2b, it determines whether other road users 3 besides the first vehicle 2a are detected. The monitoring range of the safety envelope in the second vehicle 2b is set to include... Figures 13-15 The model envelope Em and the extended envelope Ee shown are relatively large ranges. Here, the monitoring range of the safety envelope, the range of the model envelope Em, and the range of the extended envelope Ee in the second vehicle 2b are identified and set to be the same as or different from the range under the first vehicle 2a. Therefore, if the risk monitoring module 140 of the second vehicle 2b determines in S111 that no other road user 3 other than the first vehicle 2a is identified in the monitoring range of the second vehicle 2b, such as Figure 17 As shown, the current process in the second vehicle 2b is moved to S115.

[0116] In step S115, the risk monitoring module 140 of the second vehicle 2b determines whether it has received the warning information Iw from the first vehicle 2a through the communication system 6 of the second vehicle 2b. If the risk monitoring module 140 of the second vehicle 2b determines in step S115 that the warning information Iw has not been received, the current process in the second vehicle 2b ends.

[0117] On the other hand, if the risk monitoring module 140 of the second vehicle 2b determines in S115 that it has obtained warning information Iw, the current process in the second vehicle 2b will sequentially move to S116 and S117. That is, as follows Figure 11 , 12As shown, even though an envelope violation is identified in the first vehicle 2a with other road users 3 besides the second vehicle 2b, but the other road users 3 are not detected in the second vehicle 2b, S116 and S117 are executed in response to the acquisition of warning information Iw in real time.

[0118] like Figure 17 As shown, in S116, the risk monitoring module 140 of the second vehicle 2b stores the acquired warning information Iw in the memory 10 of the second vehicle 2b. The warning information Iw can also be stored in association with a timestamp representing the generation or transmission time in the first vehicle 2a, or the acquisition time (i.e., the reception time) in the second vehicle 2b, thereby accumulating warning information Iw at multiple times. The warning information Iw can also be stored via encryption or hashing in the second vehicle 2b. The warning information Iw can also be stored as evidence information. The warning information Iw can also be deleted after a set period has elapsed from the generation or transmission time in the first vehicle 2a, or the acquisition time in the second vehicle 2b.

[0119] The risk monitoring module 140 of the second vehicle 2b in S117 notifies the second vehicle 2b of the warning message Iw as a violation object in the first vehicle 2a, and determines whether there is a violation of the safety envelope between the second vehicle 2b and other road users 3 not detected. For example... Figure 11 As shown, in the second vehicle 2b, if the entirety of other road users 3 outside the detection range exists outside the range of the extended envelope Ee and the model envelope Em, an envelope violation is not identified. Therefore, in S117, if the risk monitoring module 140 of the second vehicle 2b makes no determination of envelope violation, the current process in the second vehicle 2b ends.

[0120] On the other hand, such as Figure 12 As shown, in the second vehicle 2b, if at least a portion of other road users 3 outside the detected model envelope Em exists within the extended envelope Ee, an extended envelope violation is identified as an envelope violation. Additionally, although not shown, in the second vehicle 2b, if at least a portion of other road users 3 outside the detected model envelope Em exists within the extended envelope Ee, a model envelope violation is identified as an envelope violation. For these identifications, information about other road users 3 who are the targets of violations in the first vehicle 2a can be appended to the warning information Iw as status information Is, or specifically envelope information Ise from status information Is. Information about other road users 3 who are the targets of violations in the first vehicle 2a can also be obtained via the communication system 6 of the second vehicle 2b, for example, from a remote center.

[0121] Therefore, if the risk monitoring module 140 of the second vehicle 2b makes a determination related to either model envelope violation or extended model violation in S117, the current process in the second vehicle 2b is moved to S118.

[0122] In the second vehicle 2b in S118, the risk monitoring module 140 sets constraints on the motion control of the second vehicle 2b to avoid unreasonable risks. The constraints for risk avoidance can also be restrictive instructions to the control module 160 of the second vehicle 2b, which impose constraints to move the second vehicle 2b to a state of minimum risk. Where the envelope violation identified in S117 is at least an extended envelope violation, such constraints may not be set in S118, and information related to other road users 3 who are also identified as having extended envelope violations, for example, can be used as detection information from the detection module 100 in the second vehicle 2b. If the execution of S118 is completed, the current process in the second vehicle 2b ends.

[0123] This concludes the explanation of the scenario where the first vehicle 2a is the sender of warning information Iw and the second vehicle 2b is the receiver of warning information Iw. Next, the scenario where the second vehicle 2b is the sender of warning information Iw and the first vehicle 2a is the receiver of warning information Iw will be explained.

[0124] like Figure 17 As shown, in S111, if the risk monitoring module 140 of the second vehicle 2b determines that it has identified other road users 3 other than the first vehicle 2a within the monitoring range of the second vehicle 2b, the current process in the second vehicle 2b will move to S112.

[0125] In S112, the risk monitoring module 140 of the second vehicle 2b monitors envelope violations related to the safety envelope between the second vehicle 2b and other road users 3 besides the first vehicle 2a, using a safety model based on the second vehicle 2b. For example... Figure 13 As shown, in the case where all other road users 3 besides the second vehicle 2b exist outside the range of the extended envelope Ee and the range of the model envelope Em, an envelope violation is not identified. Therefore, in S112, if the risk monitoring module 140 of the second vehicle 2b makes no determination regarding an envelope violation, as... Figure 17 As shown, the current process in the second vehicle 2b has ended.

[0126] Before the current process ends after the envelope violation is not determined in S112, the risk monitoring module 140 of the second vehicle 2b can also achieve common identification with the first vehicle 2a by performing the acquisition and determination process of warning information Iw according to S115. Similarly, before the current process ends after the envelope violation is not determined in S102, the risk monitoring module 140 of the first vehicle 2a can also achieve common identification with the second vehicle 2b by performing the acquisition and determination process of warning information Iw according to S115.

[0127] On the other hand, such as Figure 14 As shown, in the case where, in the second vehicle 2b, at least a portion of the other road users 3 besides the first vehicle 2a exist outside the model envelope Em, within the extended envelope Ee, an extended envelope violation is identified as an envelope violation. Additionally, as... Figure 15 As shown, in the second vehicle 2b, if at least a portion of the other road users 3 besides the first vehicle 2a exist within the range of the model envelope Em within the range of the extended envelope Ee, a model envelope violation is identified as an envelope violation.

[0128] Therefore, in S112, if the risk monitoring module 140 of the second vehicle 2b makes a determination related to either model envelope violation or extended model violation, such as... Figure 17 As shown, the current process in the second vehicle 2b is sequentially moved to S113 and S114. That is, if an envelope violation is detected in the second vehicle 2b between it and other road users 3 other than the first vehicle 2a, S113 and S114 are executed.

[0129] In S113, the risk monitoring module 140 of the second vehicle 2b performs the process of reversing the substitution of the first vehicle 2a and the second vehicle 2b in the description of S103, as the generation process of warning information Iw. In S114, the risk monitoring module 140 of the second vehicle 2b performs the process of reversing the substitution of the first vehicle 2a and the second vehicle 2b in the description of S104, as the storage process of warning information Iw. If the execution of S114 is completed, the current process in the second vehicle 2b ends.

[0130] Before the execution of S114, or before the end of the current process after the execution of S114, the risk monitoring module 140 of the second vehicle 2b can also achieve common identification with the first vehicle 2a by performing the acquisition and determination processing of warning information Iw according to S115. Similarly, before the execution of S104, or before the end of the current process after the execution of S104, the risk monitoring module 140 of the first vehicle 2a can also achieve common identification with the second vehicle 2b by performing the acquisition and determination processing of warning information Iw according to S115.

[0131] like Figure 16 As shown, if the risk monitoring module 140 of the first vehicle 2a determines that no other road user 3 other than the second vehicle 2b is identified in the monitoring range of the first vehicle 2a in S101, the current process of the first vehicle 2a is moved to S105.

[0132] In S105, the risk monitoring module 140 of the first vehicle 2a performs the reverse substitution of the first vehicle 2a and the second vehicle 2b as described in S115, as a determination process for obtaining warning information Iw. Therefore, if the risk monitoring module 140 of the first vehicle 2a determines in S105 that warning information Iw has not been obtained, the current process in the first vehicle 2a ends.

[0133] On the other hand, if the risk monitoring module 140 of the first vehicle 2a determines in S105 that it has obtained warning information Iw, the current process in the first vehicle 2a will sequentially move to S106 and S107. That is, as Figure 14 , 15 As shown, even though an envelope violation is identified in the second vehicle 2b with other road users 3 besides the first vehicle 2a, but the other road users 3 that are the objects of the violation are not detected in the first vehicle 2a, the system responds to the acquisition of warning information Iw in real time and executes S106 and S107.

[0134] like Figure 16 As shown, in S106, the risk monitoring module 140 of the first vehicle 2a performs the process of reversing the first vehicle 2a and the second vehicle 2b in the description of S116, and stores it as warning information Iw. In S107, the risk monitoring module 140 of the first vehicle 2a performs the process of reversing the first vehicle 2a and the second vehicle 2b in the description of S117, and determines whether the envelope has been violated.

[0135] like Figure 14 As shown, in the first vehicle 2a, if the entirety of other road users 3 not detected exists outside the range of the extended envelope Ee and the range of the model envelope Em, an envelope violation is not identified. Therefore, in S107, if the risk monitoring module 140 of the first vehicle 2a makes no determination of envelope violation, the current process in the first vehicle 2a ends.

[0136] On the other hand, such as Figure 15As shown, in the first vehicle 2a, if at least a portion of other road users 3 outside the detected model envelope Em exists within the extended envelope Ee, an extended envelope violation is identified as an envelope violation. Additionally, although not shown, in the first vehicle 2a, if at least a portion of other road users 3 outside the detected model envelope Em exists within the extended envelope Ee, a model envelope violation is identified as an envelope violation. For these identifications, information about other road users 3 who are the targets of violations in the second vehicle 2b can be appended to the warning information Iw as status information Is, or specifically envelope information Ise from status information Is. Information about other road users 3 who are the targets of violations in the second vehicle 2b can also be obtained via the communication system 6 of the first vehicle 2a, for example, from a remote center.

[0137] Therefore, if the risk monitoring module 140 of the first vehicle 2a makes a determination related to either a model envelope violation or an extended model violation in S107, the current process in the first vehicle 2a moves to S108. In S108, the risk monitoring module 140 of the first vehicle 2a performs the process of reversing the first vehicle 2a and the second vehicle 2b as described in S118, as a constraint setting process. If the execution of S108 is completed, the current process in the first vehicle 2a ends.

[0138] As explained above, in the first embodiment, from the perspective of the first vehicle 2a, the first vehicle 2a, as the main moving body, monitors and sets up an envelope that violates the SOTIF safety envelope between itself and other road users 3, other than the second vehicle 2b, as the target moving body. Therefore, when an envelope violation with other road users 3 is detected, the first vehicle 2a generates a warning message Iw warning of the envelope violation and sends it to the second vehicle 2b. Thus, the second vehicle 2b can also commonly identify the envelope violation warned by the first vehicle 2a regarding other road users 3, thereby improving the ability to respond to other road users.

[0139] On the other hand, in the first embodiment, from the perspective of the second vehicle 2b, a warning message Iw is obtained from the first vehicle 2a, which is the target vehicle, regarding a violation of the SOTIF safety envelope between itself and other road users besides the second vehicle 2b. Therefore, in response to the acquisition of the warning message Iw, the existence or absence of an envelope violation with other road users 3 is determined in the second vehicle 2b. Thus, the envelope violation warning issued by the first vehicle 2a regarding other road users 3 can be commonly identified in the second vehicle 2b and reflected in the determination of the existence or absence of the envelope violation, thereby improving the ability to respond to other road users.

[0140] Furthermore, in the first embodiment, from the perspective of the second vehicle 2b, the second vehicle 2b, as the primary moving body, monitors and sets up envelopes that violate the SOTIF safety envelope between itself and other road users 3 besides the first vehicle 2a, which is the target moving body. Therefore, when an envelope violation with other road users 3 is detected, the second vehicle 2b also generates a warning message Iw warning of the envelope violation and sends it to the first vehicle 2a. Thus, the first vehicle 2a can also commonly identify envelope violations warned by the second vehicle 2b regarding other road users 3, thereby improving the ability to respond to other road users.

[0141] On the other hand, in the first embodiment, from the perspective of the first vehicle 2a, a warning message Iw is obtained from the second vehicle 2b, which is the target vehicle, regarding a violation of the SOTIF safety envelope between itself and other road users besides the first vehicle 2a. Therefore, in response to the acquisition of the warning message Iw, the existence or absence of an envelope violation with other road users 3 is determined in the first vehicle 2a. Thus, the envelope violation warning issued by the second vehicle 2b regarding other road users 3 can also be commonly identified in the first vehicle 2a and reflected in the determination of the existence or absence of the envelope violation, thereby improving the ability to respond to other road users.

[0142] (Second Implementation)

[0143] The second embodiment is a variation of the first embodiment.

[0144] exist Figure 18 , 19In the processing method of the second embodiment, which shows the cases of the first vehicle 2a and the second vehicle 2b respectively, the execution of S100 and S110 is omitted. Correspondingly, in the processing method, S2109, S2120, and S2121 in the first vehicle 2a and S2119, S2130, and S2131 in the second vehicle 2b are added.

[0145] like Figure 19 As shown, after the envelope violation is not determined in S117 and after the execution of S118, in S2119, the risk monitoring module 140 of the second vehicle 2b generates feedback information If for obtaining the warning information Iw to be fed back to the first vehicle 2a. The feedback information If may also include notification information In indicating that the warning information Iw is pushed from the second vehicle 2b to the first vehicle 2a. The feedback information If may also be a composite of the notification information In, with the status information Is obtained by reversing the order of the first vehicle 2a and the second vehicle 2b as described in S103. That is, the status information Is may also include envelope information Ise related to the safety envelope set in the second vehicle 2b.

[0146] The warning message Iw generated in S2119 can be sent from the second vehicle 2b to the first vehicle 2a according to the control of the communication system 6 by the risk monitoring module 140 of the second vehicle 2b. In other words, the risk monitoring module 140 of the second vehicle 2b generates feedback message If for the warning message Iw, and sends it from the second vehicle 2b to the first vehicle 2a in real time in response to the acquisition of the warning message Iw. If the execution of S2119 is completed, the current process in the second vehicle 2b ends.

[0147] like Figure 18 As shown, in S2120 following S104, the risk monitoring module 140 of the first vehicle 2a determines within a set time from the transmission of the warning information Iw whether it has received feedback information If from the second vehicle 2b through the communication system 6 of the first vehicle 2a. In S2120, if the risk monitoring module 140 of the first vehicle 2a determines that it has received feedback information If, the current process in the first vehicle 2a ends.

[0148] According to S2120, the risk monitoring module 140 of the first vehicle 2a can check that common identification with the second vehicle 2b has been achieved. Additionally, in S2120, the risk monitoring module 140 of the first vehicle 2a can also delete the warning information Iw corresponding to the acquisition of feedback information If from the memory 10 of the first vehicle 2a. Alternatively, in S2120, the risk monitoring module 140 of the first vehicle 2a can also store the feedback information If acquired corresponding to the warning information Iw in S104 in the memory 10 of the first vehicle 2a.

[0149] On the other hand, in S2120, if the risk monitoring module 140 of the first vehicle 2a determines that no feedback information If has been obtained, the current process in the first vehicle 2a moves to S2121. In S2121, the risk monitoring module 140 of the first vehicle 2a sets constraints on the motion control of the first vehicle 2a to avoid unreasonable risks, based on the possibility that other road users 3 who violate the rules are not detected in the second vehicle 2b, or that the envelope violation of the other road users 3 is not identified in the second vehicle 2b. The constraints for risk avoidance can also be restrictive instructions to the control module 160 of the first vehicle 2a to give constraints that move the first vehicle 2a to a state of minimum risk. In addition, the constraints for risk avoidance can also be at least one of the following: a limit on the speed of the first vehicle 2a, a limit on acceleration, and a slight constraint on the first vehicle 2a moving away from the second vehicle 2b. For example, if the first vehicle 2a is unable to obtain feedback information If in response to the transmission of warning information Iw due to important factors such as the second vehicle 2b not using processing system 1 or the second vehicle 2b not being equipped with communication system 6, this constraint setting process can execute risk avoidance actions that are closer to the safety side. If the execution of S2121 is completed, the current process in the first vehicle 2a ends. In addition, in the first vehicle 2a where the current process ends without obtaining feedback information If, if the envelope violation continues in the next process S102, the generation and transmission of warning information Iw are repeated in the next process S103.

[0150] This concludes the explanation of the scenario where the second vehicle 2b is the sender of the feedback information If and the first vehicle 2a is the receiver of the feedback information If. Next, the scenario where the first vehicle 2a is the sender of the feedback information If and the second vehicle 2b is the receiver of the feedback information If will be explained.

[0151] like Figure 18 As shown, after the envelope violation is not determined in S107 and after the execution of S108, in S2109, the risk monitoring module 140 of the first vehicle 2a performs the process of reversing the first vehicle 2a and the second vehicle 2b as described in S2119, as the generation process of feedback information If. If the execution of S2109 is completed, the current process in the first vehicle 2a ends.

[0152] like Figure 19As shown, in S2130 following S114, the risk monitoring module 140 of the second vehicle 2b performs the process of reversing the first vehicle 2a and the second vehicle 2b as described in S2120, as a determination process for obtaining feedback information If. Therefore, if the risk monitoring module 140 of the second vehicle 2b determines in S2130 that it has obtained feedback information If, the current process in the second vehicle 2b ends.

[0153] According to S2130, the risk monitoring module 140 of the second vehicle 2b can check that the common identification with the first vehicle 2a has been achieved. Additionally, in S2130, the risk monitoring module 140 of the second vehicle 2b can also delete the warning information Iw corresponding to the acquisition of feedback information If from the memory 10 of the second vehicle 2b. Alternatively, in S2130, the risk monitoring module 140 of the second vehicle 2b can also store the feedback information If acquired corresponding to the warning information Iw in S114 in the memory 10 of the second vehicle 2b.

[0154] On the other hand, in S2130, if the risk monitoring module 140 of the second vehicle 2b determines that no feedback information If has been obtained, the current process in the second vehicle 2b moves to S2131. In S2131, the risk monitoring module 140 of the second vehicle 2b performs the process of reversing the first vehicle 2a and the second vehicle 2b as described in S2121, which is a constraint setting process for risk avoidance, targeting the possibility that other road users 3 who are the violators are not detected in the first vehicle 2a, or that the envelope violation of the other road users 3 is not identified in the first vehicle 2a. For example, if the second vehicle 2b cannot obtain feedback information If from the transmission of warning information Iw due to important factors such as the first vehicle 2a not applying the processing system 1 or the first vehicle 2a not being equipped with the communication system 6, such constraint setting processing can perform risk avoidance actions that are closer to the safety side. If the execution of S2131 is completed, the current process in the second vehicle 2b ends. In addition, in the second vehicle 2b where the process ends without receiving feedback information If, if the envelope violation continues in the next process S112, the generation and sending of warning information Iw will be repeated in the next process S113.

[0155] In this second embodiment, the risk monitoring modules 140 of the first vehicle 2a and the second vehicle 2b are the main components, and the processing methods S2109, S2120, S2121 and S2119, S2130, S2131, respectively, are executed as described in the first embodiment. Therefore, it is possible to improve the ability to respond to other road users.

[0156] (Third Implementation)

[0157] The third embodiment is a variation of the first embodiment.

[0158] like Figure 20 As shown, in the control module 3160 of the third embodiment, the acquisition process of determination information regarding the safety envelope is omitted from the risk monitoring module 140. Therefore, the planning module 3120 of the third embodiment acquires determination information related to the safety envelope from the risk monitoring module 140. If the planning module 3120 acquires determination information indicating no envelope violation, it plans the driving control of the vehicle 2 according to the planning module 120. On the other hand, if the planning module 3120 acquires determination information indicating an envelope violation, it imposes constraints on the driving control based on the determination information during the stage of planning the driving control according to the planning module 120. That is, the planning module 3120 restricts the planned driving control. In either case, the control module 3160 executes the driving control of the vehicle 2 planned by the planning module 3120.

[0159] In this third embodiment, the risk monitoring modules 140 of the first vehicle 2a and the second vehicle 2b respectively execute the processing method according to the first embodiment. Therefore, it is possible to improve the ability to respond to other road users. In addition, this third embodiment can also be combined with the second embodiment.

[0160] (Fourth Implementation)

[0161] The fourth embodiment is a variation of the third embodiment.

[0162] like Figure 21 As shown, in the planning module 4120 of the fourth embodiment, the functions based on the risk monitoring module 140 are incorporated as a risk monitoring submodule 4140. When the risk monitoring submodule 4140 obtains determination information indicating no envelope violation, the planning module 4120 plans the driving control of the vehicle 2 according to the planning module 120. On the other hand, when the risk monitoring submodule 4140 obtains determination information indicating an envelope violation, the planning module 4120 imposes constraints on the driving control based on the determination information during the stage of planning the driving control according to the planning module 120. That is, the planning module 4120 restricts the planned driving control. In either case, the control module 3160 executes the driving control of the vehicle 2 planned by the planning module 4120.

[0163] In this fourth embodiment, the risk monitoring submodules 4140 of the first vehicle 2a and the second vehicle 2b respectively execute the processing method according to the first embodiment. Therefore, it is possible to improve the ability to respond to other road users. In addition, this fourth embodiment can also be combined with the second embodiment.

[0164] (Fifth Implementation)

[0165] The fifth embodiment is a variation of the first embodiment.

[0166] like Figure 22 As shown, in the control module 5160 of the fifth embodiment, the acquisition process of determination information related to the safety envelope is omitted from the risk monitoring module 5140. Therefore, the risk monitoring module 5140 of the fourth embodiment acquires information representing the result of the driving control performed by the control module 5160 on the vehicle 2. The risk monitoring module 5140 evaluates the driving control by performing an envelope violation determination on the result of the driving control.

[0167] In this fifth embodiment, the risk monitoring modules 5140 of the first vehicle 2a and the second vehicle 2b respectively execute the processing method according to the first embodiment. Therefore, it is possible to improve the ability to respond to other road users. In addition, this fifth embodiment can also be combined with the second embodiment. In the case of combining the fifth embodiment with the second embodiment, in S2121 and S2131, an evaluation of driving control based on set constraints is performed.

[0168] (Sixth Implementation Method)

[0169] The sixth embodiment is a variation of the first embodiment.

[0170] like Figure 23 , 24 As shown, in the sixth embodiment, a test module 6180 for driving control, such as a test control module 160 for safety approval, is added. The test module 6180 is given the functions of the detection module 100 and the risk monitoring module 140. It can also be achieved by... Figure 23 The processing system 1 shown executes test programs appended to the processing programs used to build modules 100, 120, 140, and 160 to build test module 6180. For example... Figure 24 As shown, the test module 6180 can also be constructed by executing a test processing program, which is different from the processing program used to construct each module 100, 120, 140, and 160, using a test processing system 6001 that is different from the processing system 1. Here, the test processing system 6001 can be configured as at least one dedicated computer having a memory 10 and a processor 12, which is connected to the processing system 1 for testing driving control (the case of connection via the communication system 6 is omitted).

[0171] In this sixth embodiment, the processing method according to the first embodiment is executed, with each test module 6180 of the first vehicle 2a and the second vehicle 2b as the main components. Therefore, it is possible to improve the ability to respond to other road users. In addition, this sixth embodiment can also be combined with the second embodiment. In the case of the combination of the sixth embodiment and the second embodiment, in S2121 and S2131, the evaluation of driving control as a test is performed based on the set constraints.

[0172] (Other implementation methods)

[0173] The above describes several embodiments, but this disclosure is not limited to these embodiments and can be applied to various embodiments and combinations without departing from the spirit of this disclosure.

[0174] In a variation, the dedicated computer constituting processing system 1 may also include at least one of digital circuitry and analog circuitry as a processor. Here, the digital circuitry may be, for example, at least one of ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array), SOC (System on a Chip), PGA (Programmable Gate Array), and CPLD (Complex Programmable Logic Device). Furthermore, such digital circuitry may also have a memory storing a program.

[0175] In the modified processing method, in S102, S107, S112, and S117, the presence or absence of envelope violation can be determined only with respect to one of the model envelope Em and the extended envelope Ee, which serves as the safety envelope. In this case, in S101 and S110, the monitoring range of the safety envelope can be set within the range that includes either the model envelope Em or the extended envelope Ee, which is the object of the determination of envelope violation.

[0176] In the modified processing method, the storage processing of warning information Iw in S104 and S114 can also be omitted. In the modified processing method, the storage processing of warning information Iw in S106 and S116 can also be omitted. In the modified processing method, the mutual authentication processing of S100 and S110 can also be omitted in the first embodiment, according to the second embodiment.

Claims

1. A processing method, executed by a processor for performing driving-related processing of a master mobile body capable of communicating with a target mobile body, wherein, Include: The aforementioned primary mobile vehicle monitors for violations of the security envelope that sets the security of the intended functions between it and other road users other than the aforementioned target mobile vehicle; If the aforementioned envelope violation is detected in the primary mobile body, a warning message indicating the envelope violation is generated and sent to the target mobile body. Feedback information obtained from the aforementioned target moving body regarding the acquisition of the aforementioned warning information; as well as Without obtaining the aforementioned feedback information, constraints are set on the driving control of the aforementioned main moving body.

2. The processing method according to claim 1, wherein, Monitoring the above-mentioned envelope violations includes: Regarding the model envelope, which is a security envelope based on a security model, violations of the aforementioned envelope are monitored, wherein the aforementioned security model is a model that models the security of the intended function.

3. The processing method according to claim 1, wherein, Monitoring the above-mentioned envelope violations includes: Regarding the addition of a physically-based extended envelope to the aforementioned security envelope based on a security model, and monitoring for violations of the aforementioned envelope, wherein the aforementioned security model is a model that models the security of the intended function.

4. The processing method according to any one of claims 1 to 3, wherein, The above warning message includes: Generate a notification to the target mobile body indicating that the aforementioned envelope has been violated, and issue the aforementioned warning message.

5. The processing method according to any one of claims 1 to 3, wherein, The above warning message includes: The aforementioned warning message is generated, which includes envelope information related to the aforementioned security envelope set in the aforementioned main mobile body.

6. The processing method according to any one of claims 1 to 3, wherein, It also includes the storage of the aforementioned warning messages.

7. A processing system comprising a processor for performing driving-related processing of a primary mobile body capable of communicating with a target mobile body, wherein... The above processor is configured to execute: The aforementioned primary mobile vehicle monitors for violations of the security envelope that sets the security of the intended functions between it and other road users other than the aforementioned target mobile vehicle; If the aforementioned envelope violation is detected in the primary mobile body, a warning message indicating the envelope violation is generated and sent to the target mobile body. Feedback information obtained from the aforementioned target moving body regarding the acquisition of the aforementioned warning information; as well as Without obtaining the aforementioned feedback information, constraints are set on the driving control of the aforementioned main moving body.

8. A storage medium storing a processing program, the processing program being stored in the storage medium and comprising commands executed by a processor for performing driving-related processing of a primary mobile body capable of communicating with a target mobile body, wherein... The above commands include: The aforementioned primary mobile vehicle monitors for violations of the security envelope that sets the security of the intended functions between it and other road users other than the aforementioned target mobile vehicle; If the aforementioned envelope violation is detected in the primary mobile body, a warning message indicating the envelope violation is generated and sent to the target mobile body. Feedback information obtained from the aforementioned target moving body regarding the acquisition of the aforementioned warning information; as well as Without obtaining the aforementioned feedback information, constraints are set on the driving control of the aforementioned main moving body.

9. A processing method, executed by a processor for performing driving-related processing of a master mobile body capable of communicating with a target mobile body, wherein, Include: A warning is obtained from the aforementioned target mobile body regarding a violation of the security envelope intended for the functionality between the target mobile body and other road users besides the aforementioned main mobile body; that is, a warning message indicating an envelope violation. In response to the acquisition of the aforementioned warning information, it is determined whether there is a violation of the aforementioned envelope with the other road users.

10. The processing method according to claim 9, wherein, Determine whether the above envelope violation includes: Regarding the model envelope, which is a security envelope based on a security model, it is determined whether the envelope is violated. The security model is a model that models the security of the expected function.

11. The processing method according to claim 9, wherein, Determine whether the above envelope violation includes: Regarding the addition of a physics-based extended envelope to the aforementioned security envelope based on the security model, determining whether the aforementioned envelope is violated, wherein the aforementioned security model is a model that models the security of the intended function.

12. The processing method according to any one of claims 9 to 11, wherein, Determine whether the above envelope violation includes: If the other road users mentioned above are not detected in the aforementioned main mobile vehicle, in response to the acquisition of the aforementioned warning information, it is determined whether there is a violation of the aforementioned envelope with the aforementioned other road users.

13. The processing method according to any one of claims 9 to 11, wherein, The above warning information includes: Obtain the aforementioned warning message from the aforementioned target mobile body indicating a violation of the aforementioned envelope.

14. The processing method according to any one of claims 9 to 11, wherein, The above warning information includes: The warning message is obtained by adding envelope information related to the security envelope set in the target moving body.

15. The processing method according to any one of claims 9 to 11, wherein, It also includes the aforementioned warning information that has been stored.

16. The processing method according to any one of claims 9 to 11, wherein, It also includes generating feedback information to send the aforementioned warning information to the target moving body.

17. A processing system comprising a processor for performing driving-related processing of a primary mobile body capable of communicating with a target mobile body, wherein, The above processor is configured to execute: A warning is obtained from the aforementioned target mobile body regarding a violation of the security envelope intended for the functionality between the target mobile body and other road users besides the aforementioned main mobile body; that is, a warning message indicating an envelope violation. In response to the acquisition of the aforementioned warning information, it is determined whether there is a violation of the aforementioned envelope with the other road users.

18. A storage medium storing a processing program, the processing program being stored in the storage medium, comprising commands executed by a processor for performing processing related to driving of a master mobile body capable of communicating with a target mobile body, wherein, The above commands include: A warning is obtained from the aforementioned target mobile body regarding a violation of the security envelope intended for the functionality between the target mobile body and other road users besides the aforementioned main mobile body; that is, a warning message indicating an envelope violation. In response to the acquisition of the aforementioned warning information, it is determined whether there is a violation of the aforementioned envelope with the other road users.

Images