Vehicle, vehicle platform, and autonomous driving kit

Abstract

The present disclosure relates to a vehicle, a vehicle platform, and an autonomous driving kit. A vehicle (1) includes a VP (20), an ADK (10), a main communication bus (43), a sub communication bus (44), a main VCIB (41), and a sub VCIB (42), the VP includes a specific system (32, 33), the ADK (10) is attachable to and removable from the VP, the ADK gives autonomous driving instructions, the main VCIB (41) is configured to communicate with the ADK through the main communication bus, the main VCIB gives control instructions to the specific system according to the instructions from the ADK, the sub VCIB (42) is configured to communicate with the ADK through the sub communication bus, the sub VCIB gives control instructions to the specific system according to the instructions from the ADK. When the VP fails, the main VCIB outputs identification information of a capability value of the specific system to the ADK (S214), and the sub VCIB outputs the identification information to the ADK (S214).

Description

[0001] Cross-references to related applications

[0002] This non-provisional application is based on Japanese Patent Application No. 2022-174911, filed with the Japan Patent Office on October 31, 2022, the entire contents of which are hereby incorporated by reference. Technical Field

[0003] This disclosure relates to a vehicle, a vehicle platform, and an autonomous driving kit, and more particularly to: a vehicle capable of autonomous driving; a vehicle platform to which an autonomous driving kit can be attached and removed, the vehicle platform being configured to be capable of autonomous driving; and an autonomous driving kit to be attached to and removed from the vehicle platform, the autonomous driving kit providing autonomous driving commands. Background Technology

[0004] Vehicles that include powertrain systems that centrally manage the vehicle's power and autonomous driving systems that centrally control the vehicle's autonomous driving are generally already available (see, for example, Japanese Patent Publication No. 2018-132015). Summary of the Invention

[0005] When an abnormal condition of the vehicle control-related system is sensed in the vehicle described in Japanese Patent Publication No. 2018-132015, the autonomous driving system needs to appropriately determine whether to issue a command from the main bus or the redundant sub-bus.

[0006] This disclosure is made to address the aforementioned problems, and its purpose is to provide a system capable of appropriately determining from which of the main bus and sub-bus an autonomous driving command will be given to the vehicle, vehicle platform, and autonomous driving suite.

[0007] The vehicle according to this disclosure is configured to be autonomously driven. The vehicle includes: a vehicle platform including specific systems that perform specific functions of the vehicle; an autonomous driving kit, which is attachable to and removable from the vehicle platform and provides autonomous driving commands; a main bus; a sub-bus; a main vehicle control interface box configured to communicate with the autonomous driving kit via the main bus and to provide control commands to the specific systems based on commands from the autonomous driving kit; and a sub-vehicle control interface box configured to communicate with the autonomous driving kit via the sub-bus and to provide control commands to the specific systems based on commands from the autonomous driving kit. When the vehicle platform malfunctions, the main vehicle control interface box outputs identification information capable of recognizing the capability values ​​of the specific systems to the autonomous driving kit via the main bus, while the sub-vehicle control interface box outputs the identification information to the autonomous driving kit via the sub-bus.

[0008] With this configuration, when the vehicle platform fails, the autonomous driving suite can determine from which of the main bus and sub-bus it received identification information that could recognize the capability values ​​of the specific system. Therefore, a vehicle can be provided in which the autonomous driving suite can appropriately determine from which of the main bus and sub-bus it issues autonomous driving commands based on the capability values ​​of the specific system.

[0009] The specific system can be a braking system that performs the function of braking the vehicle platform. The braking system can include a main part and sub-parts, each capable of braking the vehicle platform. The main vehicle control interface box can directly send control commands to the main part. The sub-vehicle control interface box can directly send control commands to both the main part and the sub-parts. The main vehicle control interface box can output identification information corresponding to whether the main part of the braking system is faulty, and whether the sub-parts of the braking system are faulty, based on fault points in the control system. The sub-vehicle control interface box can output identification information corresponding to whether the braking system is fault-free, whether the main part's function is degraded, and whether the sub-part's function is degraded, based on fault points.

[0010] With this configuration, when the vehicle platform fails, the autonomous driving suite can determine from which of the main bus and sub-bus it received identification information capable of recognizing the braking system's capabilities. Therefore, the autonomous driving suite can appropriately determine from which of the main bus and sub-bus to issue autonomous driving commands for the braking system based on the braking system's capabilities.

[0011] The specific system can be a steering system that performs the function of steering the vehicle platform. The steering system may include a motor that generates steering force on the vehicle platform, and main and sub-sections that each control the motor. A main vehicle control interface box can provide control commands for controlling some of the torque generated by the motor. Sub-vehicle control interface boxes can provide control commands for controlling the remaining portion of the torque generated by the motor. Both the main and sub-vehicle control interface boxes can output identification information corresponding to whether the main and sub-sections of the steering system are malfunctioning, based on fault points in the control system.

[0012] With this configuration, when the vehicle platform fails, the autonomous driving suite can determine from which of the main bus and sub-bus it received identification information capable of recognizing the steering system's capabilities. Therefore, the autonomous driving suite can appropriately determine from which of the main bus and sub-bus to issue autonomous driving commands for the steering system based on the steering system's capabilities.

[0013] According to another aspect of this disclosure, a vehicle platform to which an autonomous driving kit can be attached and removed is provided. The autonomous driving kit provides autonomous driving commands. The vehicle platform is configured to be capable of autonomous driving. The vehicle platform includes a specific system performing specific functions of the vehicle platform, a main bus, a sub-bus, a main vehicle control interface box configured to communicate with the autonomous driving kit via the main bus, and a sub-vehicle control interface box configured to communicate with the autonomous driving kit via the sub-bus. The main vehicle control interface box provides control commands to the specific system based on commands from the autonomous driving kit, and the sub-vehicle control interface box provides control commands to the specific system based on commands from the autonomous driving kit. When the vehicle platform malfunctions, the main vehicle control interface box outputs identification information capable of recognizing the capability values ​​of the specific system to the autonomous driving kit via the main bus, while the sub-vehicle control interface box outputs the identification information to the autonomous driving kit via the sub-bus.

[0014] Based on this configuration, a vehicle can be provided in which the autonomous driving suite can appropriately determine, based on the capability values ​​of the specific system, which of the main bus and sub-bus it should receive autonomous driving commands from.

[0015] According to another aspect of this disclosure, an autonomous driving kit can be attached to and removed from a vehicle platform configured to drive autonomously, and provides autonomous driving commands. The vehicle platform includes a specific system performing specific functions of the vehicle platform, a main bus, sub-buses, a main vehicle control interface box configured to communicate with the autonomous driving kit via the main bus, and sub-vehicle control interface boxes configured to communicate with the autonomous driving kit via sub-buses. The main vehicle control interface box provides control commands to the specific system based on instructions from the autonomous driving kit, and the sub-vehicle control interface boxes provide control commands to the specific system based on instructions from the autonomous driving kit. When the vehicle platform malfunctions, the autonomous driving kit receives identification information from the main vehicle control interface box via the main bus, enabling the identification of the specific system's capability values, and receives identification information from the sub-vehicle control interface boxes via the sub-buses.

[0016] Based on this configuration, an autonomous driving kit can be provided that is capable of appropriately determining, based on the specific system's capability values, whether to issue autonomous driving commands from the main bus or the sub-bus.

[0017] The foregoing and other objects, features, aspects and advantages of this disclosure will become more apparent from the following detailed description of this disclosure when it is described in conjunction with the accompanying drawings. Attached Figure Description

[0018] Figure 1 This is a diagram showing an overview of a vehicle according to an embodiment of the present disclosure.

[0019] Figure 2 This is a diagram showing in detail the configuration of ADS, VCIB, and VP according to this embodiment.

[0020] Figure 3 This is a flowchart illustrating the process of braking control in a vehicle according to this embodiment.

[0021] Figure 4 This is a diagram illustrating an overview of the flow of information regarding braking in this embodiment.

[0022] Figure 5 This is a diagram showing the output and capability values ​​corresponding to the fault points related to braking in this embodiment.

[0023] Figure 6 This is a flowchart illustrating the process for steering control in a vehicle according to this embodiment.

[0024] Figure 7 This is a diagram illustrating an overview of the flow of information regarding steering in this embodiment.

[0025] Figure 8This is a diagram showing the output and capability values ​​corresponding to the fault points related to steering in this embodiment.

[0026] Figure 9 This is a diagram showing the overall structure of an Autono-MaaS vehicle.

[0027] Figure 10 This is a diagram illustrating the system architecture of an Autono-MaaS vehicle.

[0028] Figure 11 This is a diagram illustrating a typical workflow in ADS.

[0029] Figure 12 It is a diagram showing the relationship between the front wheel steering angle change rate limit and the speed.

[0030] Figure 13 This is the state machine diagram for power mode.

[0031] Figure 14 It is a diagram showing the details of the gear sequence.

[0032] Figure 15 This is a diagram showing the stop sequence.

[0033] Figure 16 This is a diagram showing the pause sequence.

[0034] Figure 17 It is a state machine diagram of autonomous states.

[0035] Figure 18 This is a diagram illustrating the authentication process. Detailed Implementation

[0036] Embodiments of this disclosure will now be described in detail with reference to the accompanying drawings. The same or corresponding elements in the drawings have the same reference numerals assigned to them, and their descriptions will not be repeated.

[0037] [Example]

[0038] <Overall Configuration>

[0039] Figure 1 This is an overview diagram of a vehicle 1 according to an embodiment of the present disclosure. The vehicle 1 includes an Autonomous Driving Kit (ADK) 10 and a Vehicle Platform (VP) 20. The ADK 10 is configured to be attachable to the VP 20 (which can be installed into and removed from the vehicle 1). The ADK 10 and the VP 20 are configured to communicate with each other via a vehicle control interface (VCIB 40, which will be described later).

[0040] VP 20 can drive autonomously based on control requests from ADK 10. Although Figure 1The ADK 10 is shown in a position away from the VP 20, but the ADK 10 is actually attached to the roof of the VP 20, etc. The ADK 10 can also be removed from the VP 20. When the ADK 10 is not attached, the VP 20 is controlled in manual mode (based on user operation).

[0041] ADK 10 includes an Autonomous Driving System (ADS) 11 for autonomous driving of vehicle 1. For example, ADS 11 creates a driving plan for vehicle 1. ADS 11 outputs various control requests to VP 20, instructing vehicle 1 to proceed according to the driving plan, based on an application programming interface (API) defined for each control request. ADS 11 receives various signals from VP 20 indicating the vehicle state (the state of VP 20) based on the API defined for each signal. ADS 11 then reflects the vehicle state in the driving plan. (See below for further details.) Figure 2 This describes the detailed configuration of ADS11.

[0042] VP 20 includes a basic vehicle 30 and a vehicle control interface box (VCIB) 40.

[0043] The base vehicle 30 performs various types of vehicle control based on control requests from ADK 10 (ADS11). The base vehicle 30 includes various systems and sensors for controlling itself. More specifically, the base vehicle 30 includes an integrated control manager 31, a braking system 32, a steering system 33, a powertrain system 34, an active safety system 35, a body system 36, wheel speed sensors 51 and 52, a pinion angle sensor 53, a camera 54, and radar sensors 55 and 56.

[0044] The integrated control manager 31 includes processors (such as a central processing unit (CPU)) and memories (such as read-only memory (ROM) and random access memory (RAM)) (although none of them are shown), and controls the systems involved in the operation of the vehicle 1 (brake system 32, steering system 33, powertrain system 34, active safety system 35, and main system 36) in a unified manner.

[0045] Braking system 32 is configured to control the braking devices provided in each wheel of the basic vehicle 30. The braking devices include, for example, a disc brake system (not shown) operated by hydraulic pressure regulated by an actuator.

[0046] Wheel speed sensors 51 and 52 are connected to the braking system 32. Wheel speed sensor 51 detects the rotational speed of the front wheels of the base vehicle 30 and outputs the detected rotational speed of the front wheels to the braking system 32. Wheel speed sensor 52 detects the rotational speed of the rear wheels of the base vehicle 30 and outputs the detected rotational speed of the rear wheels to the braking system 32. The braking system 32 outputs the rotational speed of each wheel as one of several pieces of information included in the vehicle status to the VCIB 40. The braking system 32 generates a braking command for the braking device based on a specified control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31. The braking system 32 controls the braking device based on the generated braking command. The integrated control manager 31 can calculate the speed (vehicle speed) of the vehicle 1 based on the rotational speed of each wheel.

[0047] The steering system 33 is configured to control the steering angle (wheel steering angle) of the steering wheels of the vehicle 1 using a steering mechanism. The steering mechanism includes, for example, a rack and pinion electric steering (EPS) system capable of adjusting the steering angle via an actuator.

[0048] The pinion angle sensor 53 is connected to the steering system 33. The pinion angle sensor 53 detects the rotation angle (pinion angle) of the pinion gear coupled to the rotating shaft of the actuator and outputs the detected pinion angle to the steering system 33. The steering system 33 outputs the pinion angle as one of several pieces of information included in the vehicle status to the VCIB 40. The steering system 33 generates a steering command for the steering mechanism based on a specified control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31. The steering system 33 controls the steering mechanism based on the generated steering command.

[0049] The powertrain system 34 controls an electric parking brake (EPB) system 341 provided in at least one of a plurality of wheels, a parking lock (P lock) system 342 provided in the transmission of the vehicle 1, and a propulsion system 343 including a shifting device (not shown) configured to allow selection of a range of gears. (See also...) Figure 2 To describe the detailed configuration of the powertrain system 34.

[0050] The active safety system 35 uses a camera 54 and radar sensors 55 and 56 to detect obstacles (pedestrians, bicycles, parked vehicles, utility poles, etc.) in front of or behind the vehicle. The active safety system 35 determines whether a collision with the obstacle is possible based on the distance between the vehicle 1 and the obstacle and the direction of the vehicle 1's movement. When the active safety system 35 determines that a collision is possible, it outputs a braking command to the braking system 32 via the integrated control manager 31 to increase the braking force.

[0051] The main system 36 is configured to control components such as turn indicators, horn, and wipers (none shown) based on the environment around the vehicle 1 or its state of travel. The main system 36 controls each component according to specified control requests output from the ADS 11 via the VCIB 40 and the integrated control manager 31.

[0052] VCIB 40 is configured to communicate with ADS11 via a Controller Area Network (CAN). VCIB 40 receives various control requests from ADS11 or outputs vehicle status to ADS11 by executing a predefined API for each signal. When VCIB 40 receives a control request from ADK 10, it outputs the control command corresponding to the control request to the corresponding system via the integrated control manager 31. VCIB 40 obtains various types of information about the base vehicle 30 from various systems via the integrated control manager 31 and outputs the status of the base vehicle 30 as vehicle status to ADS11.

[0053] Vehicle 1 can be used as one of the components of a Mobility as a Service (MaaS) system. In addition to Vehicle 1, the MaaS system also includes, for example, a data server and a Mobility Services Platform (MSPF) (neither of which are shown).

[0054] MSPF is an integrated platform to which various mobility services connect. Autonomous driving-related mobility services connect to MSPF. In addition to autonomous driving-related mobility services, mobility services provided by ride-sharing companies, car-sharing companies, car rental companies, taxi companies, and insurance companies can also connect to MSPF.

[0055] Vehicle 1 further includes a data communication module (DCM) (not shown) capable of wirelessly communicating with a data server. The DCM outputs vehicle information (such as speed, location, or autonomous driving status) to the data server. The DCM receives various types of data for managing the movement of the autonomous vehicle (including vehicle 10 in the mobility service) from autonomous driving-related mobility services via MSPF and the data server.

[0056] MSPF publishes APIs necessary for the development of ADS11, providing vehicle control and various types of data related to vehicle status. Various mobility services can utilize these APIs to access the diverse functionalities offered by MSPF, depending on their service content. For example, autonomous driving-related mobility services can use these APIs to obtain operational control data for vehicle 1 or information stored on a data server from MSPF. Furthermore, autonomous driving-related mobility services can use these APIs to send data used to manage autonomous vehicles, including vehicle 1, to MSPF.

[0057] <Detailed Configuration>

[0058] Figure 2 This is a diagram showing in detail the configuration of ADS11, VCIB 40, and VP 20 according to this embodiment. (See diagram for details.) Figure 2 As shown, ADS11 includes a computing assembly 111, a human-machine interface (HMI) 112, a sensor 113 for sensing, a sensor 114 for posture, and a sensor cleaning device 115.

[0059] The computing assembly 111 includes a processor (such as a central processing unit (CPU)) and memory (such as read-only memory (ROM) and random access memory (RAM)), although neither is shown. Processor-executable programs are stored in the memory. During autonomous driving of vehicle 1, computing assembly 210 obtains information from various sensors (described later) indicating the environment surrounding vehicle 1, as well as information indicating the attitude, behavior, and position of vehicle 1, obtains vehicle state from VP 20 via VCIB 40, and sets the next action of vehicle 1 (acceleration, deceleration, or turning). Computing assembly 111 outputs various commands to VCIB 40 to implement the set next action. Computing assembly 111 further includes communication modules (each also referred to below as a "Vehicle Control Interface Box (VIM)") 111A and 111B. Communication modules 111A and 111B are each configured to communicate with VCIB 40.

[0060] The HMI 112 presents information to the user and accepts user inputs during autonomous driving, during driving requiring user intervention, or when switching between autonomous driving and driving requiring user intervention. The HMI 112 is configured to connect to input and output devices (not shown), such as the touch panel display provided in the base vehicle 30.

[0061] The sensing sensor 113 is a sensor that senses the environment surrounding the vehicle 1. The sensing sensor 113 includes at least one of, for example, laser imaging detection and ranging (LIDAR), millimeter-wave radar, and a camera (none shown). The LIDAR, for example, measures the distance and direction of an object by emitting a laser beam of infrared pulses and detecting the laser beam reflected by the object. The millimeter-wave radar measures the distance or direction of an object by emitting millimeter waves and detecting the millimeter waves reflected by the object. The camera is positioned, for example, behind an interior mirror, and captures images of the front of the vehicle 1.

[0062] The attitude sensor 114 is a sensor that detects the attitude, behavior, or position of vehicle 1. The attitude sensor 114 includes, for example, an inertial measurement unit (IMU) and a global positioning system (GPS) (neither shown). The IMU detects, for example, the acceleration of vehicle 1 in the longitudinal, lateral, and vertical directions, and the angular velocities of vehicle 1 in the roll, pitch, and yaw directions. The GPS detects the position of vehicle 1 based on information received from multiple GPS satellites orbiting the Earth.

[0063] The sensor cleaning device 115 is configured to remove dirt adhering to various sensors (camera lenses or portions from which laser beams are emitted) using a cleaning solution or wipers while the vehicle 1 is in motion.

[0064] VCIB 40 includes a main VCIB 41 and a sub-VCIB 42. Each of VCIBs 41 and 42 includes a processor (such as a central processing unit (CPU)) and memory (read-only memory (ROM) and random access memory (RAM)), although neither is shown. Processor-executable programs are stored in the memory. VCIB 41 and communication module 111A are communicatively connected to each other via a main communication bus 43. VCIB 42 and communication module 111B are communicatively connected to each other via a sub-communication bus 44. VCIB 41 and VCIB 42 are communicatively connected to each other.

[0065] Both VCIB 41 and VCIB 42 relay control requests and vehicle information between ADS11 and VP 20. More specifically, each of VCIB 41 and VCIB 42 uses an API to generate control commands based on control requests from ADS11.

[0066] For example, control commands corresponding to control requests supplied from ADS11 to VCIB 40 include a forward direction command requesting to switch gear ranges, a stop command requesting to activate / deactivate EPB system 341 and P lock system 342, an acceleration command requesting to accelerate or decelerate vehicle 1, a wheel steering angle command requesting to adjust the wheel steering angle, an autonomous command requesting to switch between autonomous and manual modes, and a stop command requesting to keep the vehicle stationary or avoid stopping the vehicle.

[0067] Then, VCIBs 41 and 42 each output the generated control commands to the corresponding systems among the multiple systems included in VP 20. VCIBs 41 and 42 each use the API to generate information indicating the vehicle status from vehicle information from each system in VP 20. This information indicating the vehicle status can be the same as the vehicle information, or it can be information extracted from the vehicle information to be processed by ADS 11. VCIBs 41 and 42 each provide the generated information indicating the vehicle status to ADS 11.

[0068] Braking system 32 includes braking systems 321 and 322. Steering system 33 includes steering systems 331 and 332. Powertrain system 34 includes EPB system 341, P lock system 342, and propulsion system 343.

[0069] Although VCIB 41 and VCIB 42 are functionally equivalent, they differ in some aspects of the system connected to the VCIB included in VP 20. Specifically, VCIB 41, braking system 321, steering system 331, EPB system 341, P lock system 342, propulsion system 343, and main body system 36 are interconnected via a communication bus. VCIB 42, braking system 422, steering system 332, and P lock system 342 are interconnected via a communication bus.

[0070] Because VCIBs 41 and 42, which are functionally equivalent to those related to the operation of at least one of the systems (e.g., braking or steering), are thus included in VCIB 40, the control system between ADS11 and VP 20 is redundant. Therefore, in the event of a fault in the system, the functionality of VP 20 can be maintained by switching between control systems or disconnecting the faulty control system, as appropriate.

[0071] Brake systems 321 and 322 are each configured to control the braking device. Brake system 321 generates a braking command to the braking device based on a control request output from ADS11 via VCIB 41. Brake system 322 generates a braking command to the braking device based on a control request output from ADS11 via VCIB 42. Brake systems 321 and 322 may be functionally equivalent to each other. Alternatively, one of brake systems 321 and 322 may be configured to independently control the braking force of each wheel, while the other may be configured to control the braking force to produce equal braking force in the wheels. For example, brake systems 321 and 322 may control the braking device based on a braking command generated by either of them, and in the event of a malfunction in the brake system, they may control the braking device based on a braking command generated by the other of them.

[0072] Steering systems 331 and 332 are each configured to control the steering angle of the steering wheels of vehicle 1 using a steering mechanism. Steering system 331 generates a steering command for the steering mechanism based on a control request output from ADS11 via VCIB 41. Steering system 332 generates a steering command for the steering mechanism based on a control request output from ADS11 via VCIB 42. Steering systems 331 and 332 are functionally equivalent to each other. Alternatively, steering systems 331 and 332 can control the steering mechanism based on a steering command generated by either of them; in the event of a malfunction in the steering system, they can control the steering mechanism based on a steering command generated by the other of them.

[0073] The EPB system 341 controls the EPB according to a control request output from the ADS11 via the VCIB 41. The EPB is provided separately from the braking device (disc brake system, etc.) and secures the wheels by operation of an actuator. The EPB may, for example, use an actuator to activate a drum brake provided for at least one of a plurality of wheels to secure the wheels, or use an actuator separate from the braking systems 321 and 322 that is capable of adjusting the hydraulic pressure supplied to the braking device to activate the braking device to secure the wheels. The EPB system 341 performs a brake holding function and is configured to switch between activation and release of brake holding.

[0074] The P-lock system 342 controls the P-lock device according to control requests output from the ADS11 via VCIB 41. For example, when the control request includes a request to set the gear range to the parking range (P range), the P-lock system 342 activates the P-lock device; when the control request includes a request to set the gear range to a gear range other than the P range, it deactivates the P-lock device. The P-lock device engages a protrusion provided at the tip of the parking lock pawl with the teeth of a gear (locking gear) provided as a rotating element coupled to the transmission of the basic vehicle 1, the position of which is adjusted by an actuator. The rotation of the output shaft of the transmission is thus fixed, and the wheels are fixed.

[0075] The propulsion system 343 switches the gear range of the gear shifting device and controls the driving force from the drive source (electric generator and engine) according to the control request output from ADS11 via VCIB 41. In addition to the P range, the gear range also includes, for example, neutral range (N range), forward range (D range), and reverse range (R range).

[0076] The active safety system 35 is communicatively connected to the braking system 321. As previously described, the active safety system 35 detects obstacles ahead using a camera 54 and / or a radar sensor 55, and when it determines that there is a possibility of a collision, it outputs a braking command to the braking system 321 to increase the braking force.

[0077] The main system 36 controls components such as the turn indicator, horn, or wipers based on control requests received from the ADS11 via VCIB 41.

[0078] For example, autonomous driving occurs when the autonomous mode is selected by the user through operation on HMI 112 in vehicle 1. During autonomous driving, ADS 11 initially creates a driving plan as described above. Examples of driving plans include plans to continue straight travel, plans to turn left / right at designated intersections on a predetermined travel path, and plans to change lanes. ADS 11 calculates the controllable physical quantities (acceleration, deceleration, and wheel steering angle) necessary for the operation of vehicle 1 based on the created driving plan. ADS 11 divides the physical quantities for each execution cycle of the API. ADS 11 outputs control requests representing the divided physical quantities to VCIB 40 via the API. Furthermore, ADS 11 obtains the vehicle state (the actual direction of movement and stationary state of vehicle 1) from VP 20 and recreates a driving plan reflecting the obtained vehicle state. ADS 11 thus enables autonomous driving of vehicle 1.

[0079] When an abnormal condition of a system related to vehicle control is sensed in vehicle 1, ADK 10's ADS11 needs to appropriately determine which of the main communication bus 43 and the redundant sub-communication bus 44 to issue a command from.

[0080] When VP 20 fails, the main VCIB 41 outputs identification information of the capability value of the system that can identify VP 20 (e.g., braking system 321 or 322 or steering system 331 or 332) to ADK 10 via the main communication bus 43, while the sub VCIB 42 outputs identification information to ADK 10 via the sub communication bus 44.

[0081] When VP 20 malfunctions, ADK 10 can thus determine from which of the main bus and sub-bus it has received identification information that can recognize the system capability value of VP 20. Therefore, ADK 10 can appropriately determine from which of the main communication bus 43 and sub-communication bus 44 it should issue autonomous driving commands based on the system capability value of VP 20.

[0082] Braking Control

[0083] Figure 3This is a flowchart of the process for braking control in vehicle 1 in this embodiment. Figure 3 The braking command processing and braking control processing in ADK 10 are executed by the computational assembly 111 of ADS11 and the main VCIB 41 and sub-VCIB 42 of VP 20, which are called from higher-order processing in each specified control cycle. Although Figure 3 Each step included in the flowchart shown is performed by software processing via ADS11 (Computation Assembly 111) or VP 20 (VCIB 41 and VCIB 42), but it can be performed by hardware (circuit system) arranged in ADS11 or VP 20.

[0084] In ADK 10, the processor of the computing assembly 111 of ADS11 determines whether braking is required in the subsequent driving plan (step S111). When the processor of computing assembly 111 determines that braking is not required (no in step S111), it causes the process to continue to the process in step S113. When the processor of computing assembly 111 determines that braking is required (yes in step S111), it requests the main VCIB 41 and sub-VCIB 42 of VP 20 to send identification information that can identify the braking capability value via the main communication bus 43 and the sub-communication bus 44 (step S112), and causes the process to continue to the process in step S113.

[0085] Figure 4 This is a diagram illustrating an overview of the flow of information regarding braking in this embodiment. (Refer to...) Figure 4 In step S112, the request is sent from the main communication module 111A of ADS11 to the main VCIB 41 of VP 20, and from the sub-communication module 111B of ADS11 to the sub-VCIB 42 of VP 20.

[0086] The sub-brake system 322, located upstream of the brake hydraulic system, generates hydraulic pressure based on the user's operation on the brake pedal and sends this hydraulic pressure to the main brake system 321. The main brake system 321, based on the hydraulic pressure from the upstream section, regulates the pressure of the hydraulic brakes on each of the four wheels in the downstream section of the brake hydraulic system, and can generate pressure that can brake each wheel based on the user's operation on the brake pedal even when hydraulic pressure is not applied from the upstream section.

[0087] Figure 5 This is a diagram showing the output and capability values ​​corresponding to the braking-related failure point in this embodiment. (Refer to...) Figure 5The braking-related capability value refers to the maximum required braking acceleration for each of the main brake system 321 and the sub-brake system 322, and it is a pre-determined value for each fault point. Identification information that can identify the braking capability value includes VP_Autonomy_Fault and Brake_System_Degradation_Modes for each of the main brake system and the sub-brake system.

[0088] VP_Autonomy_Fault indicates the presence or absence of a fault related to the autonomous driving mode. A value of 0 indicates that the fault does not exist, and a value of 1 indicates that the fault exists.

[0089] Brake_System_Degradation_Modes indicates the degradation mode of the braking system's performance. A value of 0 indicates the normal mode. A value of 1 indicates the loss-of-function mode. A value of 2 indicates the degradation operation mode (DEGRADED_OPERATIONAL_MAIN) of the main brake system 321. A value of 3 indicates the degradation operation mode (DEGRADED_OPERATIONAL_SUB) of the sub-brake system 322. A value of 4 indicates the degradation operation mode (DEGRADED_OPERATIONAL_STANDSTILL) in the stopped state of both the main brake system 321 and the sub-brake system 322.

[0090] Refer back Figure 3 In VP 20, the processor in each of the main VCIB 41 and the sub-VCIB 42 determines whether it has received a request for identification information from ADK 10 (step S211). When the processor in each of VCIBs 41 and 42 determines that it has not yet received a request for identification information (no in step S211), it causes the process to proceed to the process in step S215. On the other hand, when the processor in each of VCIBs 41 and 42 determines that it has received a request for identification information (yes in step S211), it identifies the current braking-related fault point of the system (step S212).

[0091] The processors in each of VCIB 41 and 42 then identify identification information for braking (VP_Autonomy_Fault, Brake_System_Degradation_Modes) based on the identified fault point (step S213).

[0092] Refer again Figure 4 and Figure 5When the fault occurs in (13) communication from motion control 50 to master VCIB 41 or (14) communication from master VCIB 41 to motion control 50, the processor of master VCIB 41 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 1. Motion control 50 arbitrates commands from VCIB 41 and 42, as well as interventions by another system (such as a pre-collision safety (PCS) system) in braking and operation.

[0093] When the fault occurs in (13) communication from motion control 50 to main VCIB 41 or (14) communication from main VCIB 41 to motion control 50, the processor of sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 0 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 0.

[0094] When the fault is in the motion control (19) or the main brake system 321 (23), the processor of the main VCIB 41 recognizes the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 1.

[0095] When the fault is in the motion control (19) or the main brake system 321 (23), the processor of the sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 0 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 2.

[0096] When the fault point is in (15) communication from sub-brake system 322 to sub-VCIB 42 or (16) communication from sub-VCIB 42 to sub-brake system 322, the processor of main VCIB 41 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 0 and identifies the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 0.

[0097] When the fault point is in (15) communication from sub-brake system 322 to sub-VCIB 42 or (16) communication from sub-VCIB 42 to sub-brake system 322, the processor of sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 3.

[0098] When the fault point is in (28) sub-brake system 322, the processor of the main VCIB 41 recognizes the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 0 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 0.

[0099] When the fault point is in (28) sub-brake system 322, the processor of sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 3.

[0100] When the fault occurs in (17) communication from motion control 50 to sub-VCIB 42 or (18) communication from sub-VCIB 42 to motion control 50, the processor of main VCIB 41 recognizes the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 0 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 0.

[0101] When the fault occurs in (17) communication from motion control 50 to sub-VCIB 42 or (18) communication from sub-VCIB 42 to motion control 50, the processor of sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 2.

[0102] When the fault point is in (21) communication from motion control 50 to sub-brake system 322 or (22) communication from sub-brake system 322 to motion control 50, the processor of main VCIB 41 recognizes the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 0.

[0103] When the fault point is in (21) communication from motion control 50 to sub-brake system 322 or (22) communication from sub-brake system 322 to motion control 50, the processor of sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Brake_System_Degradation_Modes as Brake_System_Degradation_Modes = 0.

[0104] Refer back Figure 3 The processors of VCIB 41 and 42 send the identification information for braking to ADK 10 via the main communication bus 43 and the sub-communication bus 44, respectively (step S214).

[0105] In ADK 10, the processor of the computational assembly 111 of ADS11 determines whether it has received identification information for braking from VP 20 (step S113). When the processor of the computational assembly 111 of ADS11 determines that it has not yet received identification information (no in step 113), it causes the process to continue to the higher-level process from which it invoked the braking command.

[0106] On the other hand, when the processor of the computing assembly 111 of ADS11 determines that it has received the identification information (in S113), it uses the braking capability value identified by the received identification information for braking to calculate the braking command according to the driving plan at the current time point (step S114).

[0107] Refer again Figure 5 When the values ​​of VP_Autonomy_Fault and Brake_System_Degradation_Modes in the identification information received from the main VCIB 41 are 1 and 1 respectively, and the values ​​of VP_Autonomy_Fault and Brake_System_Degradation_Modes in the identification information received from the sub-VCIB 42 are 0 and 0 respectively, the processor of the calculation assembly 111 determines that the capability value of the main brake system 321 is 0G and the capability value of the sub-brake system 322 is 1G.

[0108] When the values ​​of VP_Autonomy_Fault and Brake_System_Degradation_Modes in the identification information received from the main VCIB 41 are 1 and 1 respectively, and the values ​​of VP_Autonomy_Fault and Brake_System_Degradation_Modes in the identification information received from the sub-VCIB 42 are 0 and 2 respectively, the processor of the calculation assembly 111 determines that the capability value of the main brake system 321 is 0G and the capability value of the sub-brake system 322 is 0.7G.

[0109] When the values ​​of VP_Autonomy_Fault and Brake_System_Degradation_Modes in the identification information received from the main VCIB 41 are 0 and 0 respectively, and the values ​​of VP_Autonomy_Fault and Brake_System_Degradation_Modes in the identification information received from the sub-VCIB 42 are 1 and 3 respectively, the processor of the calculation assembly 111 determines that the capability value of the main brake system 321 is 1G and the capability value of the sub-brake system 322 is 1G.

[0110] When the values ​​of VP_Autonomy_Fault and Brake_System_Degradation_Modes in the identification information received from the main VCIB 41 are 0 and 0 respectively, and the values ​​of VP_Autonomy_Fault and Brake_System_Degradation_Modes in the identification information received from the sub-VCIB 42 are 1 and 2 respectively, the processor of the computing assembly 111 determines that the capability value of the main brake system 321 is 1G and the capability value of the sub-brake system 322 is 0.7G.

[0111] When the values ​​of VP_Autonomy_Fault and Brake_System_Degradation_Modes in the identification information received from the main VCIB 41 are 1 and 0 respectively, and the values ​​of VP_Autonomy_Fault and Brake_System_Degradation_Modes in the identification information received from the sub-VCIB 42 are 1 and 0 respectively, the processor of the computing assembly 111 determines that the capability value of the main brake system 321 is 1G and the capability value of the sub-brake system 322 is 1G.

[0112] Refer back Figure 3 Within the range of the identified braking capability values, the processor of the ADS11 calculation assembly 111 calculates the braking command value based on the driving plan at the current point in time, and sends a braking guidance command indicating the calculated braking command to VP 20 (step S115), and it causes the process to be executed to return to the higher-level process from which the braking command process was called.

[0113] In VP 20, the processor of each of VCIB 41 and 42 determines whether it has received a braking guidance command from ADK 10 (step S215). When the processor of each of VCIB 41 and 42 determines that it has not yet received a braking guidance command (no in step S215), it causes the process to be executed to return to the higher-order process from which it called the braking control process.

[0114] When the processors of VCIB 41 and 42 determine that they have received a braking guidance command (as in step S215), they control the braking systems 321 and 322 respectively according to the braking guidance command (step S216), and they cause the process to be executed to return to the higher-order process from which the braking control process was called.

[0115] Steering Control

[0116] Figure 6 This is a flowchart illustrating the process of steering control in vehicle 1 in this embodiment. Figure 6 The steering command processing and steering control processing in ADK 10 are executed by the computational assembly 111 of ADS11 and the main VCIB 41 and sub-VCIB 42 of VP20, which are invoked from higher-order processing in each specified control cycle. Although Figure 6 Each step included in the flowchart shown is performed by software processing via ADS11 (Computation Assembly 111) or VP 20 (VCIB 41 and 42), but it can be performed by hardware (circuit system) arranged in ADS 11 or VP 20.

[0117] In ADK 10, the processor of the computing assembly 111 of ADS11 determines whether steering is required in the subsequent driving plan (step S121). When the processor of computing assembly 111 determines that steering is not required (no in step S121), it causes the process to continue to the process in step S123. On the other hand, when the processor of computing assembly 111 determines that steering is required (yes in step S121), it requests the main VCIB 41 and sub-VCIB 42 of VP 20 to send identification information that can identify the steering capability value via the main communication bus 43 and the sub-communication bus 44 (step S122), and causes the process to continue to the process in step S123.

[0118] Figure 7 This is a diagram illustrating an overview of the flow of information regarding steering in this embodiment. (Refer to...) Figure 7 In step S122, the request is sent from the main communication module 111A of ADS11 to the main VCIB 41 of VP 20, and from the sub-communication module 111B of ADS11 to the sub-VCIB 42 of VP 20.

[0119] The main steering system 331 and the sub-steering system 332 control a single steering motor 333. The steering motor 333 includes windings that are supplied with current from the main steering system 331 and windings that are supplied with the same amount of current from the sub-steering system 332. Each of the steering systems 331 and 332 can control 50% of the torque generated by the steering motor 333.

[0120] Figure 8 This is a diagram showing the output and capability values ​​corresponding to the steering-related failure points in this embodiment. (Refer to...) Figure 8 The steering-related capability value is the ratio of the maximum steering torque that the main steering system 331 and the sub-steering system 332 may require, and it is a pre-determined value for each fault point. Identification information that can identify the steering capability value includes VP_Autonomy_Fault and Steering_System_Degradation_Modes for each of the main steering system and the sub-steering system.

[0121] VP_Autonomy_Fault indicates the presence or absence of a fault related to the autonomous driving mode. A value of 0 indicates that the fault does not exist, and a value of 1 indicates that the fault exists.

[0122] Steering_System_Degradation_Modes indicates the degradation mode of the steering system's performance. A value of 0 indicates the Normal mode. A value of 1 indicates the Loss of Function mode. A value of 2 indicates the Degraded Operational Stationary Steering mode, which indicates a temporary degradation in performance, such as due to high temperature or voltage drop.

[0123] Refer back Figure 6 In VP 20, the processor in each of the main VCIB 41 and the sub-VCIB 42 determines whether it has received a request for identification information from ADK 10 (step S221). When the processor in each of VCIBs 41 and 42 determines that it has not yet received a request for identification information (no in step S221), it causes the process to proceed to the process in step S225. When the processor in each of VCIBs 41 and 42 determines that it has received a request for identification information (yes in step S221), it identifies the current steering-related fault point of the system (step S222).

[0124] The processors in VCIB 41 and 42 each identify identification information for steering (VP_Autonomy_Fault, Steering_System_Degradation_Modes) based on the identified fault points (step S223).

[0125] Refer again Figure 7 and Figure 8 When the fault point is in (13) communication from motion control 50 to main VCIB 41 or (14) communication from main VCIB 41 to motion control 50, the processor of main VCIB 41 recognizes the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 1.

[0126] When the fault occurs in (13) communication from motion control 50 to main VCIB 41 or (14) communication from main VCIB 41 to motion control 50, the processor of sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 0 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 0.

[0127] When the fault point is in (13') communication from the main steering system 331 to the motion control 50 or (14') communication from the motion control 50 to the main steering system 331, the processor of the main VCIB 41 recognizes the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 1.

[0128] When the fault point is in (13') communication from the main steering system 331 to the motion control 50 or (14') communication from the motion control 50 to the main steering system 331, the processor of the sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 0 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 0.

[0129] When the fault point is in motion control (19), the processor of the main VCIB 41 recognizes the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 1.

[0130] When the fault point is in motion control (19), the processor of subVCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 0 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 0.

[0131] When the fault is in the main steering system 331 (24), the processor of the main VCIB 41 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 1.

[0132] When the fault is in the main steering system 331 (24), the processor of sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 0.

[0133] When the fault point is in (15) communication from sub-steering system 332 to sub-VCIB 42 or (16) communication from sub-VCIB 42 to sub-steering system 332, the processor of main VCIB 41 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 0 and identifies the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 0.

[0134] When the fault point is in (15) communication from sub-steering system 332 to sub-VCIB 42 or (16) communication from sub-VCIB 42 to sub-steering system 332, the processor of sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and identifies the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 1.

[0135] When the fault point is in (29) sub-steering system 332, the processor of main VCIB 41 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 0.

[0136] When the fault point is in (29) sub-steering system 332, the processor of sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 1.

[0137] When the fault point is in (21) the communication from the main steering system 331 to the sub-steering system 332 or (22) the communication from the sub-steering system 332 to the main steering system 331, the processor of the main VCIB 41 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 0.

[0138] When the fault point is in (21) the communication from the main steering system 331 to the sub-steering system 332 or (22) the communication from the sub-steering system 332 to the main steering system 331, the processor of the sub-VCIB 42 identifies the value of VP_Autonomy_Fault as VP_Autonomy_Fault = 1 and the value of Steering_System_Degradation_Modes as Steering_System_Degradation_Modes = 0.

[0139] Refer back Figure 6 The processors of VCIB 41 and 42 send the identified information for identifying the turn to ADK 10 via the main communication bus 43 and the sub-communication bus 44 respectively (step S224).

[0140] In ADK 10, the processor of the compute assembly 111 of ADS11 determines whether it has received identification information for redirection from VP 20 (step S123). When the processor of the compute assembly 11 of ADS11 determines that it has not yet received identification information (no in step S123), it causes the process to be executed to return to the higher-level process from which it called the redirection command.

[0141] When the processor of the computing assembly 111 of ADS11 determines that it has received identification information (in S123), it uses the steering capability value identified by the received identification information for steering to calculate the steering command value according to the driving plan at the current point in time (step S124).

[0142] Refer again Figure 8 When the values ​​of VP_Autonomy_Fault and Steering_System_Degradation_Modes in the identification information received from the main VCIB 41 are 1 and 1 respectively, and the values ​​of VP_Autonomy_Fault and Steering_System_Degradation_Modes in the identification information received from the sub-VCIB 42 are 0 and 0 respectively, the processor calculating assembly 111 determines that the capability value of the main steering system 331 is 0% and the capability value of the sub-steering system 332 is 100%. In this case, control commands from the main VCIB 41 to the main steering system 331 cannot be sent; however, the main steering system 331 and the sub-steering system 332 can communicate with each other. Therefore, the steering command value on the sub-side can be sent from the sub-steering system 332 to the main steering system 331, so that the 100% torque of the steering motor 333 can be generated solely based on the steering command value on the sub-side.

[0143] When the values ​​of VP_Autonomy_Fault and Steering_System_Degradation_Modes included in the identification information received from the main VCIB 41 are 1 and 1 respectively, and the values ​​of VP_Autonomy_Fault and Steering_System_Degradation_Modes included in the identification information received from the sub-VCIB 42 are 1 and 0 respectively, the processor calculating assembly 111 determines that the capability value of the main steering system 331 is 0% and the capability value of the sub-steering system 332 is 50%.

[0144] When the values ​​of VP_Autonomy_Fault and Steering_System_Degradation_Modes in the identification information received from the main VCIB 41 are 0 and 0 respectively, and the values ​​of VP_Autonomy_Fault and Steering_System_Degradation_Modes in the identification information received from the sub-VCIB 42 are 1 and 1 respectively, the processor of the calculation assembly 111 determines that the capability value of the main steering system 331 is 100% and the capability value of the sub-steering system 332 is 0%.

[0145] When the values ​​of VP_Autonomy_Fault and Steering_System_Degradation_Modes in the identification information received from the main VCIB 41 are 1 and 0 respectively, and the values ​​of VP_Autonomy_Fault and Steering_System_Degradation_Modes in the identification information received from the sub-VCIB 42 are 1 and 1 respectively, the processor of the calculation assembly 111 determines that the capability value of the main steering system 331 is 50% and the capability value of the sub-steering system 332 is 0%.

[0146] When the values ​​of VP_Autonomy_Fault and Steering_System_Degradation_Modes in the identification information received from the main VCIB 41 are 1 and 0 respectively, and the values ​​of VP_Autonomy_Fault and Steering_System_Degradation_Modes in the identification information received from the sub-VCIB 42 are 1 and 0 respectively, the processor of the calculation assembly 111 determines that the capability value of the main steering system 331 is 100% and the capability value of the sub-steering system 332 is 100%.

[0147] Refer back Figure 6 Within the range of the identified capability values ​​for such steering, the processor of the ADS11 computing assembly 111 calculates the steering command value based on the driving plan at the current point in time, and sends a steering guidance command indicating the calculated steering command to VP 20 (step S125), and it causes the process to be executed to return to the higher-level process from which it called the steering command process.

[0148] In VP 20, the processor of each of VCIB 41 and 42 determines whether it has received a steering guidance command from ADK 10 (step S225). When the processor of each of VCIB 41 and 42 determines that it has not yet received a steering guidance command (no in step S225), it causes the process to be executed to return to the higher-order process from which it called the braking control process.

[0149] When the processors of VCIB 41 and 42 determine that they have received a steering guidance command (as in step S225), they control the steering systems 331 and 332 respectively according to the steering guidance command (step S226), and they cause the process to be executed to return to the higher-order process from which the steering control process was called.

[0150] [Revise]

[0151] (1) In the embodiments described above, VCIBs 41 and 42 directly control functional units of the basic vehicle 30, such as braking systems 321 and 322 and steering systems 331 and 332. Not limited thereto, each functional unit may include an ECU, and VCIB 40 may give control commands to the ECU of each functional unit, and the ECU may control the functional unit according to the control commands, so that VCIB indirectly controls the functional unit.

[0152] (2) In the embodiments described above, such as Figure 4 and Figure 7 As shown, the motion control 50 is located on the main side. However, it is not limited to this; the motion control 50 does not necessarily have to be located on the main side. Alternatively, the motion control can be located on the sub-side.

[0153] (3) In the embodiments described above, such as Figure 3 Step S214 and Figure 6 As shown in step S224, the main VCIB 41 and the sub-VCIB 42 send identification information that enables the identification of the capability values ​​of a specific system (such as the braking system 32 or the steering system 33) to the ADK 10. Not limited to this, the main VCIB 41 and the sub-VCIB 42 can send the capability values ​​of the specific system themselves to the ADK 10.

[0154] (4) The embodiments described above can be understood as disclosures of devices (such as vehicle 1, ADK 10, ADS11, VP 20, basic vehicle 30 or VCIB 40) or as disclosures of control methods or control programs in such devices.

[0155] [Summarize]

[0156] like Figure 1 and Figure 2 As shown, vehicle 1 is configured to be autonomously driven. Vehicle 1 includes VP 20, ADK 10, main communication bus 43, sub-communication bus 44, main VCIB 41, and sub-VCIB 42. VP 20 includes specific systems (e.g., braking system 32 or steering system 33) that perform specific functions of vehicle 1. ADK 10 can be attached to VP 20 and can be removed from VP 20. ADK 10 provides autonomous driving commands. Main VCIB 41 is configured to communicate with ADK 10 via main communication bus 43. Main VCIB 41 provides control commands to specific systems based on commands from ADK 10. Sub-VCIB 42 is configured to communicate with ADK 10 via sub-communication bus 44. Sub-VCIB 42 provides control commands to specific systems based on commands from ADK 10.

[0157] like Figures 3 to 8As shown, when VP 20 fails, the main VCIB 41 outputs identification information that can identify the capability value of a specific system to ADK 10 via the main communication bus 43 (e.g., Figure 3 Step S214 and Figure 6 In step S224), the sub-VCIB 42 displays the identification information to the ADK 10 via the sub-communication bus 44 (e.g., Figure 3 Step S214 and Figure 6 Step S224 in the process.

[0158] When VP 20 malfunctions, ADK 10 can thus determine from which of the main communication bus 43 and sub-communication bus 44 it has received identification information that can identify the capability value of a specific system. Therefore, ADK 10 can appropriately determine from which of the main communication bus 43 and sub-communication bus 44 it issues autonomous driving commands based on the capability value of the specific system.

[0159] (2) Figures 1 to 5 As shown, the specific system can be a brake system 32, which performs the function of braking VP 20. Brake system 32 can include a main brake system 321 and a sub-brake system 322, each capable of braking VP 20. The main VCIB 41 can directly send control commands to the main brake system 321. The sub-VCIB 42 can directly send control commands to both the main brake system 321 and the sub-brake system 322. The main VCIB 41 can output a capability value corresponding to each of the following: whether the main brake system 321 or sub-brake system 322 is faulty, based on a fault point in the control system. The sub-VCIB 42 can output identification information corresponding to each of the following: whether brake system 321 or 322 is faultless, whether the main brake system 321 is functionally degraded, and whether the sub-brake system 322 is functionally degraded, based on a fault point.

[0160] Therefore, when VP 20 malfunctions, ADK 10 can determine from which of the main communication bus 43 and sub-communication bus 44 it has received identification information capable of recognizing the capability value of braking system 321 or 322. Thus, ADK 10 can appropriately determine from which of the main communication bus 43 and sub-communication bus 44 it issues autonomous driving commands for braking system 321 or 322 based on the capability value of a specific system.

[0161] (3) Figure 1 , Figure 2 and Figures 6 to 8As shown, the specific system may be a steering system 33, which performs the function of steering VP 20. Steering system 33 may include a steering motor 333, which generates steering force for VP 20 and for both the main steering system 331 and the sub-steering system 332. Each of the main steering system 331 and the sub-steering system 332 is capable of controlling the motor 333. The main VCIB 41 may provide control commands for controlling a portion (e.g., 50%) of the torque generated by the steering motor 333. The sub-VCIB 42 may provide control commands for controlling the remaining portion (e.g., 50%) of the torque generated by the steering motor 333. Each of the main VCIB 41 and the sub-VCIB 42 may output a capability value corresponding to whether the main steering system 331 or the sub-steering system 332 is faulty, depending on a fault in the control system.

[0162] Therefore, when VP 20 malfunctions, ADK 10 can determine from which of the main communication bus 43 and sub-communication bus 44 it has received identification information capable of recognizing the capability values ​​of steering systems 331 or 332. Thus, ADK 10 can appropriately determine from which of the main communication bus 43 and sub-communication bus 44 it should issue autonomous driving commands for steering systems 331 or 332 based on the capability values ​​of steering systems 331 or 332.

[0163] [example]

[0164] API Specifications for Toyota Vehicle Platforms

[0165] Version 1.1

[0166] Revision history

[0167]

[0168] Table of contents

[0169] 1. Introduction

[0170] 1.1. Purpose of this specification

[0171] 1.2. Target Vehicle

[0172] 1.3. Definition of Terms

[0173] 2. Structure

[0174] 2.1. Overall Structure of Autono-MaaS Vehicles

[0175] 2.2. System Architecture of Autono-MaaS Vehicles

[0176] 3. Application Interface

[0177] 3.1. Typical Use of API

[0178] 3.2. APIs for Vehicle Motion Control

[0179] 3.2.1. List of APIs for Vehicle Motion Control

[0180] 3.2.2. Details of each API used for vehicle motion control

[0181] 3.3. APIs for Main Control

[0182] 3.3.1. List of APIs used for main control

[0183] 3.3.2. Details of each API used for main control

[0184] 3.4. API for Power Control

[0185] 3.4.1. List of APIs for Power Control

[0186] 3.4.2. Details of each API used for power control

[0187] 3.5. API for Fault Notification

[0188] 3.5.1. List of APIs used for fault notification

[0189] 3.5.2. Details of each API used for fault notification

[0190] 3.6. APIs for Security

[0191] 3.6.1. List of APIs for Security

[0192] 3.6.2. Details of each API used for security

[0193] 4. API Guidelines for Controlling Toyota Vehicles

[0194] 4.1. API for Vehicle Motion Control

[0195] 4.1.1. List of APIs for Vehicle Motion Control

[0196] 4.1.2. Details of the API guidelines for vehicle motion control

[0197] 4.2. APIs used for main control

[0198] 4.2.1 List of APIs used for main control

[0199] 4.3. API for Power Control

[0200] 4.3.1. List of APIs for Power Control

[0201] 4.4. API for Fault Notification

[0202] 4.4.1. List of APIs used for fault notification

[0203] 4.5. APIs for Security

[0204] 4.5.1. List of APIs for Security

[0205] 4.5.2. Details of the API guidelines for security

[0206] 1. Introduction

[0207] 1.1. Purpose of this specification

[0208] This document is the API specification for the vehicle control interface used in Autono-MaaS vehicles, and includes an overview, usage instructions, and API comments.

[0209] 1.2. Target Vehicle

[0210] This specification applies to Autono-MaaS vehicles as defined by the [Architecture Specification for Toyota Vehicle Platforms Attached to Automated Driving Systems].

[0211] 1.3. Definition of Terms

[0212] Table 1. Definitions of Terms

[0213]

[0214] 2. Structure

[0215] 2.1. Overall Structure of Autono-MaaS Vehicles

[0216] This shows the overall structure of Autono-MaaS ( Figure 9 ).

[0217] 2.2. System Architecture of Autono-MaaS Vehicles

[0218] Figure 10 The system architecture is shown in the diagram.

[0219] 3. Application Interface

[0220] 3.1. Typical Use of API

[0221] This section describes typical uses of the API.

[0222] Typical uses of the API are as follows ( Figure 11The following example uses CAN for physical communication.

[0223] 3.2. APIs for Vehicle Motion Control

[0224] This section describes the API used for vehicle motion control.

[0225] 3.2.1. List of APIs for Vehicle Motion Control

[0226] 3.2.1.1. Input

[0227] Table 3. Input APIs for Vehicle Motion Control

[0228]

[0229] * Response time in VP to requests from ADK

[0230] 3.2.1.2. Output

[0231] Table 4. Output APIs for Vehicle Motion Control

[0232]

[0233]

[0234]

[0235] 3.2.2. Details of each API used for vehicle motion control

[0236] 3.2.2.1. Direction of Advance Command

[0237] For requests to shift from forward (D range) to backward (R range) / from backward (R range) to forward (D range)

[0238] value

[0239] 0 No request 2 R Shift to R range 4 D Shift to D range other reserve

[0240] Remark

[0241] • This feature is only available when the vehicle mode status is "Autonomous Mode".

[0242] • This option is only available when the vehicle is stationary (direction of travel = "stop").

[0243] It is only available when the brake is applied.

[0244] 3.2.2.2. Stop command

[0245] Request to open / close wheel lock

[0246] value

[0247] The following diagram shows the situations where EPB and gear P are used for stopping.

[0248]

[0249] Remark

[0250] This API is used for parking.

[0251] • This feature is only available when the vehicle mode status is "Autonomous Mode".

[0252] • The direction of travel can only be changed when the vehicle is stationary (the direction of travel = "stop").

[0253] • This can only be changed when the brake is applied.

[0254] 3.2.2.3. Pause command

[0255] Request to apply / release brake holding function

[0256] value

[0257] 0 No request 1 Applied The brake holding function is enabled. 2 Released

[0258] Remark

[0259] This API is used to select whether the brake holding function is enabled.

[0260] • This feature is only available when the vehicle mode status is "Autonomous Mode".

[0261] The acceleration command (deceleration request) must continue until the pause status changes to "applied".

[0262] 3.2.2.4. Acceleration Command

[0263] For acceleration requests

[0264] value

[0265] From estimated maximum deceleration to estimated maximum acceleration [m / s] 2 ]

[0266] Remark

[0267] • This feature is only available when the vehicle mode status is "Autonomous Mode".

[0268] Acceleration (+) and deceleration (-) requests are based on the propulsion direction state direction.

[0269] The upper / lower limits will vary based on the estimated maximum deceleration and the estimated maximum acceleration.

[0270] When an acceleration greater than the estimated maximum acceleration is requested, the request is set to the estimated maximum acceleration.

[0271] When a deceleration greater than the estimated maximum deceleration is requested, the request is set to the estimated maximum deceleration.

[0272] The requested acceleration may not be achieved if the driver is operating the vehicle (over-ride).

[0273] When PCS are working simultaneously, VP should be selected with minimum acceleration (maximum deceleration).

[0274] 3.2.2.5. Front wheel steering angle command

[0275] value

[0276] - [Unit: rad]

[0277] Remark

[0278] • This feature is only available when the vehicle mode status is "Autonomous Mode".

[0279] Left represents a positive value (+). Right represents a negative value (-).

[0280] When the vehicle is traveling straight, the front wheel steering angle is set to the value (0).

[0281] The request is set to a relative value to the current value to prevent the misalignment of the "front wheel steering angle" from accumulating.

[0282] The requested value should be set within the front wheel steering angle change rate limit.

[0283] • When the driver is operating the vehicle (over-controlling), the requested front wheel steering angle may not be achieved.

[0284] 3.2.2.6. Vehicle Mode Command

[0285] Requests to switch from manual mode to autonomous mode / from autonomous mode to manual mode

[0286] value

[0287] 0 No request 1 Requests for autonomy 2 Discontinue request This refers to a request to switch to manual mode.

[0288] Remark

[0289] N / A

[0290] 3.2.2.7. High Dynamic Commands

[0291] If ADK wants to improve VP's braking response performance * Then the high dynamic command should be set to "high".

[0292] * Response time in VP to requests from ADK

[0293] value

[0294] 0 No request 1 high 2-3 reserve

[0295] Remark

[0296] N / A

[0297] 3.2.2.8. Propulsion Direction Status

[0298] Current gear status

[0299] value

[0300] 0 reserve 1 P 2 R 3 N 4 D 5 reserve 6 Invalid value

[0301] Remark

[0302] If VP does not know the current gear status, the output is set to "invalid value".

[0303] 3.2.2.9. Stopped state

[0304] Status of each stop system

[0305] value

[0306] The following diagram shows the situations where EPB and gear P are used for stopping.

[0307]

[0308] Remark

[0309] ˙N / A

[0310] 3.2.2.10. Pause state

[0311] paused state

[0312] value

[0313] 0 Released 1 Applied 2 reserve 3 Invalid value

[0314] Remark

[0315] ˙N / A

[0316] 3.2.2.11. Estimated gliding acceleration

[0317] Acceleration calculated in VP with the throttle valve closed, taking into account slope, road load, etc.

[0318] value

[0319] [Unit: m / s]2 ]

[0320] Remark

[0321] When the propulsion direction is "D", the acceleration used in the forward direction is shown as a positive value.

[0322] When the propulsion direction is "R", the acceleration used in the reverse direction is shown as a positive value.

[0323] 3.2.2.12. Estimated maximum acceleration

[0324] The acceleration calculated in VP with the throttle valve fully open takes into account factors such as slope and road load.

[0325] value

[0326] [Unit: m / s] 2 ]

[0327] Remark

[0328] When the propulsion direction is "D", the acceleration used in the forward direction is shown as a positive value.

[0329] When the propulsion direction is "R", the acceleration used in the reverse direction is shown as a positive value.

[0330] 3.2.2.13. Estimated maximum deceleration

[0331] The maximum deceleration calculated in VP when the brakes are requested to be at their maximum value, taking into account slope, road load, etc.

[0332] value

[0333] [Unit: m / s] 2 ]

[0334] Remark

[0335] When the propulsion direction is "D", the deceleration used in the forward direction is shown as a negative value.

[0336] When the propulsion direction is "R", the deceleration used in the reverse direction is shown as a negative value.

[0337] 3.2.2.14. Front wheel steering angle

[0338] value

[0339] Minimum value Invalid value other [Unit: rad]

[0340] Remark

[0341] Left represents a positive value (+). Right represents a negative value (-).

[0342] The signal should indicate an invalid value until VP can calculate the correct value, or when the sensor is invalid / malfunctioning.

[0343] 3.2.2.15. Rate of change of front wheel steering angle

[0344] Front wheel steering angle change rate

[0345] value

[0346] Minimum value Invalid value other [Unit: rad]

[0347] Remark

[0348] Left represents a positive value (+). Right represents a negative value (-).

[0349] The signal should display an invalid value until VP can calculate the correct value, or the current wheel steering angle shows a minimum value.

[0350] 3.2.2.16. Limitation on the rate of change of front wheel steering angle

[0351] Limit of front wheel steering angle change rate

[0352] value

[0353] [Unit: rad / s]

[0354] Remark

[0355] From Table 5 below and Figure 12 The calculation limitations of the "Vehicle Speed-Steering Angle Change Rate" graph shown in the figure.

[0356] A) Use a fixed value (0.751 [rad / s]) at low speeds or when stationary.

[0357] B) At higher speeds, use 3.432 m / s 3 The rate of change of steering angle is calculated from the vehicle speed.

[0358] Table 5. "Vehicle Speed-Steering Angle Conversion Rate" graph

[0359]

[0360] 3.2.2.17. Estimated maximum lateral acceleration

[0361] value

[0362] [Unit: m / s] 2 (Fixed value: 3.432)

[0363] Remark

[0364] ˙ is the maximum lateral acceleration defined by VP.

[0365] 3.2.2.18. Estimated maximum rate of change of lateral acceleration

[0366] value

[0367] [Unit: m / s] 2 (Fixed value: 3.432)

[0368] Remark

[0369] ˙ is the maximum rate of change of lateral acceleration defined for VP. 3.2.2.19. Accelerator pedal intervention.

[0370] This signal indicates whether the accelerator pedal has been pressed (intervened) by the driver.

[0371] value

[0372]

[0373]

[0374] Remark

[0375] When the accelerator pedal is positioned above a defined threshold, the signal will be set to "pressed".

[0376] The signal is set to "Exceeding Autonomous Acceleration" when the requested acceleration calculated from the accelerator pedal position is higher than the requested acceleration from the ADS.

[0377] 3.2.2.20. Brake pedal intervention

[0378] This signal indicates whether the brake pedal has been pressed (intervened) by the driver.

[0379] value

[0380] 0 Not suppressed 1 Suppressed 2 Exceeding autonomous deceleration

[0381] Remark

[0382] When the brake pedal position is higher than a defined threshold, the signal will be set to "pressed".

[0383] The signal is set to "exceeding autonomous deceleration" when the requested acceleration calculated from the position of the brake pedal is higher than the requested acceleration from the ADS.

[0384] 3.2.2.21. Steering wheel intervention

[0385] This signal indicates whether the steering wheel has been operated (intervened) by the driver.

[0386] value

[0387]

[0388]

[0389] Remark

[0390] When "steering wheel intervention = 1", the EPS system works with the human driver to drive the steering mechanism, taking into account the human driver's intentions.

[0391] When "Steering wheel intervention = 2", the steering request from ADS is not implemented, taking into account the human driver's intention. (Steering will be driven by the human driver).

[0392] 3.2.2.22. Intervention of the gear shift lever

[0393] This signal indicates whether the gear shift lever is being controlled (intervened) by the driver.

[0394] value

[0395] 0 closure 1 Open Controlled (moved to any gear position)

[0396] Remark

[0397] ˙N / A

[0398] 3.2.2.23. Wheel speed pulse (front left), wheel speed pulse (front right), wheel speed pulse (rear left), wheel speed pulse (rear right)

[0399] value

[0400]

[0401]

[0402] Remark

[0403] The pulse value is integrated during the pulse descent timing.

[0404] The wheel speed sensor outputs 96 pulses for each rotation.

[0405] Regardless of whether the wheel speed sensor is invalid or malfunctioning, the wheel speed pulse will be updated.

[0406] When "1" is subtracted from the pulse value showing "0", the value becomes "0×FF". When "1" is added to the pulse value showing "0×FF", the value becomes "0".

[0407] Before the ECU is started and its rotation direction is determined, pulse values ​​will be added together if the rotation direction is "forward".

[0408] When forward rotation is detected, the pulse values ​​will be added together.

[0409] When reverse rotation is detected, the pulse value will be subtracted.

[0410] 3.2.2.24. Wheel rotation direction (front left), wheel rotation direction (front right), wheel rotation direction (rear left), wheel rotation direction (rear right)

[0411] value

[0412] 0 forward 1 Reverse 2 reserve 3 Invalid value The sensor is malfunctioning.

[0413] Remark

[0414] "Forward" is set until the rotation direction is determined after VP is turned on.

[0415] 3.2.2.25. Direction of travel

[0416] Direction of movement of the vehicle

[0417] value

[0418] 0 forward 1 Reverse 2 pause 3 Undefined

[0419] Remark

[0420] When the speed of all four wheels is “0” during a constant time period, the signal indicates a “pause”.

[0421] • When the gear is changed immediately after the vehicle is started, it can be "undefined".

[0422] 3.2.2.26. Vehicle speed

[0423] Estimated longitudinal speed of the vehicle

[0424] value

[0425]

[0426] Remark

[0427] The signal value is positive in both the forward and reverse directions.

[0428] 3.2.2.27. Longitudinal acceleration

[0429] Estimated longitudinal acceleration of the vehicle

[0430] value

[0431]

[0432] Remark

[0433] ˙Acceleration (+) and deceleration (-) based on the propulsion direction and state direction. 3.2.2.28. Lateral acceleration

[0434] Lateral acceleration of the vehicle

[0435] value

[0436]

[0437] Remark

[0438] Positive values ​​indicate counter-clockwise rotation. Negative values ​​indicate clockwise rotation.

[0439] 3.2.2.29. Yaw rate

[0440] Yaw rate sensor value

[0441] value

[0442]

[0443] Remark

[0444] Positive values ​​indicate counter-clockwise rotation. Negative values ​​indicate clockwise rotation.

[0445] 3.2.2.30. Sliding Detection

[0446] Tire slippage / rotation / slippage detection

[0447] value

[0448] 0 No sliding 1 slide 2 reserve 3 Invalid value

[0449] Remark

[0450] The signal is identified as "slippery" when any of the following systems have been started.

[0451] -ABS (Anti-lock Braking System)

[0452] -TRC (Traction Control)

[0453] -VSC (Vehicle Stability Control)

[0454] -VDIM (Vehicle Dynamics Integration Management)

[0455] 3.2.2.31. Vehicle Mode Status

[0456] Autonomous or manual mode

[0457] value

[0458] 0 Manual mode The mode starts from manual mode. 1 Autonomous mode

[0459] Remark

[0460] The initial state is set to "manual mode".

[0461] 3.2.2.32. Autonomy Ready

[0462] This signal indicates whether the vehicle can switch to autonomous mode.

[0463] value

[0464] 0 Not prepared for autonomous mode 1 Preparing for an autonomous mode 3 invalid The status has not yet been determined.

[0465] Remark

[0466] ˙N / A

[0467] 3.2.2.33. Fault states of VP function for autonomous mode

[0468] This signal is used to indicate whether the VP function has some fault modes when the vehicle is operating in autonomous mode.

[0469] value

[0470] 0 No fault 1 Fault 3 invalid The status has not yet been determined.

[0471] Remark

[0472] ˙N / A

[0473] 3.2.2.34. PCS Warning Status

[0474] value

[0475] 0 normal 1 warn Request a warning from the PCS system 3 Unavailable

[0476] Remark

[0477] N / A

[0478] 3.2.2.35. PCS Preparation Status

[0479] Pre-filling state as preparation for PCS brakes

[0480] value

[0481]

[0482] Remark

[0483] "Active" is the state in which the PCS prepares the brake actuator to shorten the delay in response to a deceleration request issued by the PCS.

[0484] When the value changes to "Active" during the vehicle mode state = "Autonomous Mode", the "ADS / PCS Arbitration Status" will display "ADS".

[0485] 3.2.2.36. PCS Brake / PCS Brake Holding Status

[0486] value

[0487]

[0488]

[0489] Remark

[0490] N / A

[0491] 3.2.2.37. ADS / PCS Arbitration Status

[0492] Arbitration status

[0493] value

[0494] 0 No request 1 ADS ADS 2 PCS PCS brake or PCS brake holding 3 Invalid value

[0495] Remark

[0496] When the acceleration of the PCS system request in VP is less than the acceleration of the ADS request, the status is set to "PCS".

[0497] When the acceleration of the PCS system request in VP is greater than the acceleration of the ADS request, the status is set to "ADS".

[0498] 3.3. APIs for Main Control

[0499] 3.3.1. List of APIs used for main control

[0500] 3.3.1.1. Input

[0501] Table 6. Input APIs for Main Control

[0502]

[0503]

[0504]

[0505] 3.3.1.2. Output

[0506] Table 7. Output APIs used for main control

[0507]

[0508]

[0509] 3.3.2. Details of each API used for main control

[0510] 3.3.2.1. Turn signal command

[0511] Request to control turn signals

[0512] value

[0513]

[0514]

[0515] Remark

[0516] ˙N / A

[0517] 3.3.2.2. Headlight Command

[0518] Request to control headlights

[0519] value

[0520] 0 No request Keep the current mode 1 Tail pattern request Side light mode 2 Header pattern request Lo mode 3 Automatic mode request Automatic mode 4 HI mode request Hi mode 5 Close Mode Request 6-7 reserve

[0521] Remark

[0522] This command is valid when the headlight mode on the combination switch is set to "Off" or "Auto mode is On".

[0523] The driver issues the overdrive command.

[0524] 3.3.2.3. Hazard Light Command

[0525] Request to control hazard lights

[0526] value

[0527]

[0528]

[0529] Remark

[0530] The driver issues the overdrive command.

[0531] The hazard lights turn on when the "turn on" command is received.

[0532] 3.2.2.4. Horn Style Command

[0533] The request value specifies the style for selecting the start and stop times for each cycle.

[0534] 0 No request 1 Style 1 Start time: 250ms Close time: 750ms 2 Style 2 Start time: 500ms End time: 500ms 3 Style 3 reserve 4 Style 4 reserve 5 Style 5 reserve 6 Style 6 reserve 7 Style 7 reserve

[0535] Remark

[0536] N / S

[0537] 3.3.2.5. Horn Cycle Command

[0538] Request to select the number of on and off cycles

[0539] value

[0540] 0 to 7 [-]

[0541] Remark

[0542] N / A

[0543] 3.3.2.6. Continuous Horn Command

[0544] Request to turn the speaker on / off

[0545] value

[0546] 0 No request 1 Open

[0547] Remark

[0548] This command has higher priority than the 3.3.2.4 Horn Style and 3.3.2.5 Horn Cycle commands.

[0549] The speaker will turn on when the "turn on" command is received.

[0550] 3.2.2.7. Windshield wiper command

[0551] Request to control the windshield wipers

[0552] value

[0553] 0 Close Mode Request 1 Lo mode request 2 Hi mode request 3 Intermittent mode request 4 Automatic mode request 5 Fog mode request One scratch 6,7 reserve

[0554] Remark

[0555] This command is valid when the windshield wiper mode on the combination switch is set to "Off" or "Auto".

[0556] The driver enters the command to override the vehicle.

[0557] • When a command is received, maintain windshield wiper mode.

[0558] The wiping speed in intermittent mode is fixed.

[0559] 3.3.2.8. Rear windshield wiper command

[0560] Request to control rear windshield wipers

[0561] value

[0562] 0 Close Mode Request 1 Lo mode request 2 reserve 3 Intermittent mode request 4-7 reserve

[0563] Remark

[0564] The driver enters the command to override the vehicle.

[0565] • When a command is received, maintain windshield wiper mode.

[0566] The wiping speed in intermittent mode is fixed.

[0567] 3.3.2.9. HVAC (Row 1) Operation Commands

[0568] Request to start / stop the first row of air conditioning controls

[0569] value

[0570]

[0571]

[0572] Remark

[0573] ˙N / A

[0574] 3.3.2.10. HVAC (Row 2) Operation Commands

[0575] Request to start / stop the second row air conditioning control

[0576] value

[0577] 0 No request 1 Open 2 closure

[0578] Remark

[0579] ˙N / A

[0580] 3.3.2.11. Target Temperature (Leftmost) Command

[0581] Request to set the target temperature in the left front region

[0582] value

[0583]

[0584] Remark

[0585] ˙When ℃ is used in VP, the value should be set to ℃.

[0586] 3.3.2.12. Target Temperature (Rightmost) Command

[0587] Request to set the target temperature in the right front region

[0588] value

[0589]

[0590] Remark

[0591] ˙When ℃ is used in VP, the value should be set to ℃.

[0592] 3.3.2.13. Target Temperature (Second from Left) Command

[0593] Request to set the target temperature in the left rear region

[0594] value

[0595]

[0596] Remark

[0597] ˙When ℃ is used in VP, the value should be set to ℃.

[0598] 3.3.2.14. Target Temperature (Second from Right) Command

[0599] Request to set the target temperature in the right rear region

[0600] value

[0601]

[0602] Remark

[0603] ˙When ℃ is used in VP, the value should be set to ℃.

[0604] 3.3.2.15. HVAC Fan (Row 1) Command

[0605] Configure the fan level request for the preceding AC.

[0606] value

[0607] 0 No request 1 to 7 (maximum value) wind turbine level

[0608] Remark

[0609] If you want to switch the fan level to 0 (off), you should send "HVAC (Row 1) Operation Command = Off".

[0610] If you want to switch the fan level to automatic, you should send "HVAC (Row 1) Operation Command = On".

[0611] 3.3.2.16. HVAC Fan (Row 2) Command

[0612] Configure the fan level request for the AC.

[0613] value

[0614] 0 No request 1 to 7 (maximum value) wind turbine level

[0615] Remark

[0616] If you want to switch the fan level to 0 (off), you should send "HVAC (Row 2) Operation Command = Off".

[0617] If you want to switch the fan level to automatic, you should send "HVAC (Row 2) Operation Command = On".

[0618] 3.3.2.17. Air Outlet (Row 1) Command

[0619] Request to set the air outlet mode for row 1

[0620] value

[0621] 0 No operation 1 upper part Air flows to the upper body 2 U / F Air flows to the upper body and feet 3 foot Air flows to the feet 4 F / D Airflow to feet and windshield defroster

[0622] Remark

[0623] ˙N / A

[0624] 3.3.2.18. Air Outlet (Row 2) Command

[0625] Request to set the second row air outlet mode

[0626] value

[0627] 0 No operation 1 upper part Air flows to the upper body 2 U / F Air flows to the upper body and feet 3 foot Air flows to the feet

[0628] Remark

[0629] ˙N / A

[0630] 3.3.2.19. Air Recirculation Command

[0631] Request to set air recirculation mode

[0632] value

[0633] 0 No request 1 Open 2 closure

[0634] Remark

[0635] ˙N / A

[0636] 3.3.2.20. AC Mode Commands

[0637] Request to set AC mode

[0638] value

[0639] 0 No request 1 Open 2 closure

[0640] Remark

[0641] ˙N / A

[0642] 3.3.2.21. Turn signal light status

[0643] value

[0644] 0 closure 1 Left 2 right 3 invalid

[0645] Remark

[0646] ˙N / A

[0647] 3.3.2.22. Headlight Status

[0648] value

[0649] 0 closure 1 tail 2 Lo 3 reserve 4 Hi 5-6 reserve 7 invalid

[0650] Remark

[0651] N / A

[0652] 3.3.2.23. Hazard Light Status

[0653] value

[0654]

[0655]

[0656] Remark

[0657] N / A

[0658] 3.3.2.24. Horn Status

[0659] value

[0660] 0 closure 1 Open 2 reserve 3 invalid

[0661] Remark

[0662] When the 3.3.2.4 horn style command is in effect, the horn status is "1" even if there is a closed time period in some styles.

[0663] 3.3.2.25. Windshield wiper status

[0664] value

[0665]

[0666]

[0667] Remark

[0668] N / A

[0669] 3.3.2.26. Rear windshield wiper status

[0670] value

[0671] 0 closure 1 Lo 2 reserve 3 INT 4-5 reserve 6 Fault 7 invalid

[0672] Remark

[0673] N / A

[0674] 3.3.2.27. HVAC (Row 1) Status

[0675] value

[0676] 0 closure 1 Open

[0677] Remark

[0678] ˙N / A

[0679] 3.3.2.28. HVAC (Row 2) Status

[0680] value

[0681] 0 closure 1 Open

[0682] Remark

[0683] ˙N / A

[0684] 3.3.2.29. Target Temperature (first from left) Status

[0685] value

[0686] 0 Lo coldest 60 to 85 [unit: °F] Target temperature 100 Hi hottest FFh Unknown

[0687] Remark

[0688] ˙When ℃ is used in VP, the value should be set to ℃.

[0689] 3.3.2.30. Target Temperature (Rightmost) Status

[0690] value

[0691]

[0692]

[0693] Remark

[0694] ˙When ℃ is used in VP, the value should be set to ℃.

[0695] 3.3.2.31. Target Temperature (Second from Left) Status

[0696] value

[0697] 0 Lo coldest 60 to 85 [unit: °F] Target temperature 100 Hi hottest FFh Unknown

[0698] Remark

[0699] ˙When ℃ is used in VP, the value should be set to ℃.

[0700] 3.3.2.32. Target Temperature (Second from Right) Status

[0701] value

[0702] 0 Lo coldest 60 to 85 [unit: °F] Target temperature 100 Hi hottest FFh Unknown

[0703] Remark

[0704] ˙When ℃ is used in VP, the value should be set to ℃.

[0705] 3.3.2.33. HVAC Fan (Row 1) Status

[0706] value

[0707] 0 closure 1 to 7 wind turbine level 8 Undefined

[0708] Remark

[0709] ˙N / A

[0710] 3.3.2.34. HVAC Fan (Row 2) Status

[0711] value

[0712] 0 closure 1 to 7 wind turbine level 8 Undefined

[0713] Remark

[0714] ˙N / A

[0715] 3.3.2.35. Air outlet (row 1) status

[0716] value

[0717]

[0718]

[0719] Remark

[0720] ˙N / A

[0721] 3.3.2.36. Air outlet (row 2) status

[0722] value

[0723] 0 All closed 1 upper part Air flows to the upper body 2 U / F Air flows to the upper body and feet 3 foot Air flows down to your feet. 7 Undefined

[0724] Remark

[0725] ˙N / A

[0726] 3.3.2.37. Air recirculation status

[0727] value

[0728]

[0729]

[0730] Remark

[0731] ˙N / A

[0732] 3.3.2.38. AC Mode Status

[0733] value

[0734] 0 closure 1 Open

[0735] Remark

[0736] ˙N / A

[0737] 3.3.2.39. Seat Occupancy Status (Rightmost)

[0738] value

[0739]

[0740] Remark

[0741] When there is luggage on the seat, the signal can be set to "occupied".

[0742] 3.3.2.40. Seat belt (first from left) status

[0743] value

[0744]

[0745] Remark

[0746] N / A

[0747] 3.3.2.41. Seat belt (rightmost) status

[0748] value

[0749]

[0750] Remark

[0751] N / A

[0752] 3.3.2.42. Seat belt (second from left) status

[0753] value

[0754]

[0755]

[0756] Remark

[0757] Sensor malfunction cannot be detected.

[0758] 3.3.2.43. Seat belt (second from right) status

[0759] value

[0760]

[0761] Remark

[0762] Sensor malfunction cannot be detected.

[0763] 3.3.2.44. Seatbelt (third from left) status

[0764] value

[0765]

[0766]

[0767] Remark

[0768] Sensor malfunction cannot be detected.

[0769] 3.3.2.45. Seat belt (middle three) status

[0770] value

[0771]

[0772] Remark

[0773] Sensor malfunction cannot be detected.

[0774] 3.3.2.46. Seat belt (third from right) status

[0775] value

[0776]

[0777] Remark

[0778] Sensor malfunction cannot be detected.

[0779] 3.4. API for Power Control

[0780] 3.4.1. List of APIs for Power Control

[0781] 3.4.1.1. Input

[0782] Table 8. Input APIs for Power Control

[0783] Power mode command Commands to control the power mode of VP N / A

[0784] 3.4.1.2. Output

[0785] Table 9. Output APIs for Power Control

[0786] Power mode status The current power mode status of VP N / A

[0787] 3.4.2. Details of each API used for power control

[0788] 3.4.2.1. Power Mode Command

[0789] Request to control power mode

[0790] value

[0791]

[0792]

[0793] Remark

[0794] ˙ Figure 13 The state machine diagram for the power mode is shown below.

[0795] [Hibernation]

[0796] Vehicle power failure mode. In this mode, the main battery does not supply power to any system, and the VCIB and other VP ECUs are not activated.

[0797] [wake]

[0798] The VCIB is woken up by the auxiliary battery. In this mode, ECUs other than the VCIB are not woken up, except for some of the main electrical ECUs.

[0799] [Driver Mode]

[0800] Vehicle power status. In this mode, the main battery supplies power to the entire VP, and all VP ECUs, including the VCIB, are awakened.

[0801] 3.4.2.2. Power Mode Status

[0802] value

[0803] 0 reserve 1 hibernation 2 wake 3 reserve 4 reserve 5 reserve 6 drive 7 Unknown This means that an unhealthy situation will occur.

[0804] Remark

[0805] After executing the hibernation sequence, VCIB will continuously send the [hibernation] status as Power_Mode_Status for 3000 ms. Then, VCIB will shut down.

[0806] ADS should stop sending signals to VCIB while VCIB is sending [sleep] signals.

[0807] 3.5. API for Fault Notification

[0808] 3.5.1. List of APIs used for fault notification

[0809] 3.5.1.1. Input

[0810] Table 10. Input APIs for Fault Notification

[0811] N / A N / A N / A

[0812] 3.5.1.2. Output

[0813] Table 11. Output APIs for Fault Notification

[0814] Request for ADS operation Applied Impact detection signal N / A Reduced performance of the braking system Applied Reduced propulsion system performance N / A Reduced performance of gear control system N / A Reduced performance of the stopping system Applied Reduced performance of the steering system Applied Degraded performance of power supply system Applied Degraded performance of communication systems Applied

[0815] 3.5.2. Details of each API used for fault notification

[0816] 3.5.2.1. Requests for ADS operations

[0817] value

[0818] 0 No request 1 Maintenance required 2 Need to return to the garage 3 It needs to be stopped immediately. other reserve

[0819] Remark

[0820] This signal indicates the behavior that ADS expects to take based on a fault that occurs in VP.

[0821] 3.5.2.2. Impact Detection Signal

[0822] value

[0823]

[0824] Remark

[0825] When a collision detection event occurs, the signal is sent 50 times consecutively every 100 ms. If the collision detection state changes before the signal transmission is complete, a higher priority signal is sent.

[0826] Priority: Collision detection > Normal

[0827] Regardless of the normal response during a collision, a 5s request is sent because the vehicle failure assessment system should send a voltage shutdown request for 5s or less after a collision in an HV vehicle.

[0828] The transmission interval is 100ms within the fuel cut-off motion delay allowable time (1s) so that data can be transmitted more than 5 times.

[0829] In this case, momentary power interruptions are taken into account.

[0830] 3.5.2.3. Performance degradation of the braking system

[0831] value

[0832] 0 normal - 1 A decrease was detected -

[0833] Remark

[0834] ˙N / A

[0835] 3.5.2.4. Reduced performance of the propulsion system

[0836] value

[0837] 0 normal - 1 A decrease was detected -

[0838] Remark

[0839] ˙N / A

[0840] 3.5.2.5. Performance reduction of the gear control system

[0841] value

[0842] 0 normal - 1 A decrease was detected -

[0843] Remark

[0844] ˙N / A

[0845] 3.5.2.6. Reduced performance of the stopping system

[0846] value

[0847] 0 normal - 1 A decrease was detected -

[0848] Remark

[0849] ˙N / A

[0850] 3.5.2.7. Reduced performance of the steering system

[0851] value

[0852] 0 normal - 1 A decrease was detected -

[0853] Remark

[0854] ˙N / A

[0855] 3.5.2.8. Degraded performance of the power supply system

[0856] value

[0857] 0 normal - 1 A decrease was detected -

[0858] Remark

[0859] ˙N / A

[0860] 3.5.2.9. Degraded performance of the communication system

[0861] value

[0862] 0 normal - 1 A decrease was detected -

[0863] Remark

[0864] ˙N / A

[0865] 3.6. APIs for Security

[0866] 3.6.1. List of APIs for Security

[0867] 3.6.1.1. Input

[0868] Table 12. Input APIs for Security

[0869]

[0870]

[0871] 3.6.1.2. Output

[0872] Table 13. Output APIs for Security

[0873]

[0874] 3.6.2. Details of each API used for security

[0875] 3.6.2.1. Door lock (front) command, door lock (rear) command

[0876] value

[0877] 0 No request 1 Lock Not supported by Toyota VP 2 Unlock 3 reserve

[0878] Remark

[0879] If ADK requests to unlock the front, both front doors are unlocked.

[0880] If ADK requests to unlock the rear, the second-row doors and the trunk door will be unlocked.

[0881] If ADK requests to lock any door, it should use the "Central Door Lock Command".

[0882] (The ability to lock individually is not supported in Toyota VP.)

[0883] 3.6.2.2. Central door lock command

[0884] Request to control the locks of all doors

[0885] value

[0886] 0 No request 1 Lock (all) 2 Unlock (all) 3 reserve

[0887] Remark

[0888] ˙N / A

[0889] 3.6.2.3. First character of device authentication signature, second character of device authentication signature, third character of device authentication signature, fourth character of device authentication signature, first character of device authentication seed, second character of device authentication seed.

[0890] The first character of the device authentication signature is presented as bytes 1 through 8 of the signature.

[0891] The second character of the device authentication signature is presented as bytes 9 through 16 of the signature.

[0892] The third character of the device authentication signature is presented as bytes 17 through 24 of the signature.

[0893] The fourth character of the device authentication signature is presented as bytes 25 through 32 of the signature.

[0894] The first word of the device authentication seed is represented by the first to eighth bytes of the seed.

[0895] The second word of the device authentication seed is represented by bytes 9 through 16 of the seed.

[0896] 3.6.2.4. Door lock (leftmost) status

[0897] value

[0898] 0 reserve 1 Lock 2 Unlock 3 invalid

[0899] Remark

[0900] ˙N / A

[0901] 3.6.2.5. Door lock (rightmost) status

[0902] value

[0903] 0 reserve 1 Lock 2 Unlock 3 invalid

[0904] Remark

[0905] ˙N / A

[0906] 3.6.2.6. Door lock (second from left) status

[0907] value

[0908] 0 reserve 1 Lock 2 Unlock 3 invalid

[0909] Remark

[0910] ˙N / A

[0911] 3.6.2.7. Door lock (second from right) status

[0912] value

[0913] 0 reserve 1 Lock 2 Unlock 3 invalid

[0914] Remark

[0915] ˙N / A

[0916] 3.6.2.8. Lock status of all doors

[0917] value

[0918] 0 reserve 1 Lock them all 2 Unlock all 3 invalid

[0919] Remark

[0920] "Unlock all" if any door is unlocked.

[0921] "All doors are locked" means "all doors are locked".

[0922] 3.6.2.9. Alarm System Status

[0923] value

[0924] 0 Unequip The alarm system was not activated. 1 equipment The alarm system was activated, but no alarm was sounded. 2 kick in The alarm system was activated, and the alarm beeped. 3 invalid

[0925] Remark

[0926] N / A

[0927] 3.6.2.9.1. Mileage Counter

[0928] This counter is incremented in mileage by the freshness value management main ECU.

[0929] value

[0930] 0-FFFFh

[0931] Remark

[0932] This value is used to create the freshness value.

[0933] For details, please refer to other materials [Toyota MAC Module Specifications].

[0934] 3.6.2.9.2. Reset the counter

[0935] This counter is periodically incremented by the freshness value managed by the main ECU.

[0936] value

[0937] 0-FFFFFh

[0938] Remark

[0939] This value is used to create the freshness value.

[0940] For details, please refer to other materials [Toyota MAC Module Specifications].

[0941] 3.6.2.10. Left door open

[0942] The current open / closed status of the vehicle platform's left door.

[0943] value

[0944] 0 reserve 1 Open 2 closure 3 invalid

[0945] Remark

[0946] N / A

[0947] 3.6.2.11. Right door open

[0948] Current status of the right door open / closed

[0949] value

[0950] 0 reserve 1 Open 2 closure 3 invalid

[0951] Remark

[0952] N / A

[0953] 3.6.2.12. Second door on the left is open.

[0954] Current status of the second door on the left open / closed

[0955] value

[0956] 0 reserve 1 Open 2 closure 3 invalid

[0957] Remark

[0958] N / A

[0959] 3.6.2.13. Right second door open

[0960] Current status of the second right door open / closed

[0961] value

[0962]

[0963]

[0964] Remark

[0965] N / A

[0966] 3.6.2.14. Trunk Status

[0967] Current trunk door open / closed status

[0968] value

[0969] 0 reserve 1 Open 2 closure 3 invalid

[0970] Remark

[0971] N / A

[0972] 3.6.2.15. Hood open

[0973] Current hood open / closed status

[0974] value

[0975]

[0976]

[0977] Remark

[0978] N / A

[0979] 4. API Guidelines for Controlling Toyota Vehicles

[0980] This section shows in detail how the API is used for Toyota vehicles.

[0981] 4.1. APIs for Vehicle Motion Control

[0982] 4.1.1. List of APIs for Vehicle Motion Control

[0983] The input and output APIs for vehicle motion control are shown in Tables 14 and 15, respectively. Usage guidelines for some of these APIs are presented in the following subsections as indicated in each table.

[0984] 4.1.1.1. Input

[0985] Table 14. Input APIs for Vehicle Motion Control

[0986]

[0987]

[0988] * Response time in VP to requests from ADK

[0989] 4.1.1.2. Output

[0990] Table 15. Output APIs for Vehicle Motion Control

[0991]

[0992]

[0993]

[0994] 4.1.2. Details of the API guidelines for vehicle motion control

[0995] 4.1.2.1. Direction of Advance Command

[0996] Please refer to section 3.2.2.1 for detailed information on the values ​​and notes.

[0997] Figure 14 The shift sequence is shown in detail.

[0998] The first deceleration is requested via an acceleration command, and the vehicle comes to a stop. When the direction of travel is set to "stop," any gear position can be requested via a forward direction command. Figure 14 In Chinese, “D” → “R”.

[0999] Deceleration must be requested via an acceleration command until the gear shift is complete.

[1000] After the gear position is changed, you can select to accelerate or decelerate based on the acceleration command.

[1001] When the vehicle mode is set to autonomous mode, the driver's gear shift lever operation is not accepted.

[1002] 4.1.2.2. Stop command

[1003] Please refer to section 3.2.2.2 for detailed information on the values ​​and notes.

[1004] Figure 15 This shows how to enable / disable the stop function.

[1005] An acceleration command is used to request deceleration to bring the vehicle to a stop. When the vehicle speed reaches zero, the stop function is activated by setting the stop command to "Applied". The acceleration command is set to deceleration until the stop state is set to "Applied".

[1006] When the stop function is disabled, the stop command = "released" must be requested, and the acceleration command must be set to deceleration until the stop status = "released" is confirmed.

[1007] After the stop function is disabled, the vehicle can be accelerated / decelerated based on acceleration commands.

[1008] 4.1.2.3. Pause command

[1009] Please refer to section 3.2.2.3 for detailed information on the values ​​and notes.

[1010] When the stop command is set to "applied", the brake holding function is ready to be used, and it is activated when the vehicle stops and the acceleration command is set to decelerate (<0). Then, the stop state changes to "applied". On the other hand, when the stop command is set to "released", the brake holding function is deactivated.

[1011] Figure 16 The pause sequence is shown.

[1012] To bring the vehicle to a stop, use an acceleration command to request acceleration.

[1013] When the vehicle stops for a moment, the direction of travel changes to "stop". Even during the "stop" state = "applied", the acceleration command should be used to request deceleration.

[1014] If you want the vehicle to move forward, the acceleration command is set to accelerate (>0). Then, the brake holding function is released, and the vehicle is accelerated.

[1015] 4.1.2.4. Speed-up command

[1016] Please refer to section 3.2.2.4 for detailed information on the values ​​and notes.

[1017] The following shows how the vehicle behaves when the accelerator pedal is pressed.

[1018] When the accelerator pedal is operated, either 1) the value calculated from the accelerator pedal travel, or 2) the acceleration command input from ADK, is selected as the maximum acceleration value. ADK can determine which value is selected by examining the accelerator pedal intervention.

[1019] The following shows how the vehicle behaves when the brake pedal is operated.

[1020] The deceleration values ​​in the vehicle are 1) the deceleration value calculated from the brake pedal travel and 2) the sum of the deceleration values ​​requested from ADK.

[1021] 4.1.2.5. Front wheel steering angle command

[1022] Please refer to section 3.2.2.5 for detailed information on the values ​​and notes.

[1023] The following shows how to use the front wheel steering angle command.

[1024] The front wheel steering angle command is set to a relative value with respect to the front wheel steering angle.

[1025] For example, when the front wheel steering angle is 0.1 rad and the vehicle is traveling straight;

[1026] If ADK wants to go straight, the front wheel steering angle command should be set to 0 + 0.1 = 0.1 [rad].

[1027] If ADK requests a steering angle of -0.3 [rad], then the front wheel steering angle command should be set to -0.3 + 0.1 = -0.2 [rad].

[1028] The following shows how the vehicle behaves when the driver operates the steering wheel.

[1029] The maximum value is either selected from 1) the value calculated from the steering wheel operation performed by the driver, or from 2) the value requested by ADK.

[1030] Note that if the driver forcefully operates the steering wheel, the front wheel steering angle command will not be accepted. This situation can be detected by intervention from the steering wheel indicator.

[1031] 4.1.2.6. Vehicle Mode Command

[1032] Figure 17 The diagram shows the state machine for mode transitions of Autono-MaaS vehicles.

[1033] The description of each state is shown below.

[1034]

[1035]

[1036] The explanation of each transformation is shown below:

[1037]

[1038] 4.2. APIs used for main control

[1039] 4.2.1. List of APIs used for main control

[1040] 4.2.1.1. Input

[1041] Table 16. Input APIs for Main Control

[1042]

[1043]

[1044] 4.2.1.2. Output

[1045] Table 17. Output APIs for Main Control

[1046]

[1047]

[1048] 4.3. API for Power Control

[1049] 4.3.1. List of APIs for Power Control

[1050] 4.3.1.1. Input

[1051] Table 18. Input APIs for Power Control

[1052] Power mode command Commands to control the power mode of VP N / A -

[1053] 4.3.1.2. Output

[1054] Table 19. Output APIs for Power Control

[1055] Power mode status The current power mode status of VP N / A -

[1056] 4.4. API for Fault Notification

[1057] 4.4.1. List of APIs used for fault notification

[1058] 4.4.1.1. Input

[1059] Table 20. Input APIs for Fault Notification

[1060] N / A - - -

[1061] 4.4.1.2. Output

[1062] Table 21. Output APIs for Fault Notification

[1063] Request for ADS operation - Applied - Impact detection signal - N / A - Reduced performance of the braking system - Applied - Reduced propulsion system performance - N / A - Reduced performance of gear control system - N / A - Reduced performance of the stopping system - Applied - Reduced performance of the steering system - Applied - Degraded performance of power supply system - Applied - Degraded performance of communication systems - Applied -

[1064] 4.5. APIs for Security

[1065] 4.5.1. List of APIs for Security

[1066] The input and output APIs for security purposes are shown in Tables 22 and 23, respectively. Usage guidelines for some of these APIs are presented in the following subsections as indicated in each table.

[1067] 4.5.1.1. Input

[1068] Table 22. Input APIs for Security

[1069]

[1070]

[1071] 4.5.1.2. Output

[1072] Table 23. Output APIs for Security

[1073]

[1074]

[1075] 4.5.2. Details of the API guidelines for security

[1076] 4.5.2.1. Equipment Authentication Agreement

[1077] When VCIB is started from "hibernation" mode, device authentication is applied.

[1078] After successful authentication, VCIB can begin communicating with ADK.

[1079] Authentication processing such as Figure 18 As shown in the authentication process.

[1080] Certification Standards

[1081]

[1082]

[1083] Although embodiments of this disclosure have been described above, it should be understood that the embodiments disclosed herein are illustrative and non-limiting in all respects. The scope of the technology in this disclosure is defined by the terminology of the claims and is intended to include any modifications within the scope and meaning equivalent to the terminology of the claims.

Claims

1. A vehicle configured to be autonomously driven, the vehicle comprising: Vehicle platform, the vehicle platform including specific systems that perform specific functions of the vehicle; An autonomous driving kit, which can be attached to and removed from the vehicle platform, and which provides autonomous driving commands; Main bus; Sub-bus; A main vehicle control interface box, configured to communicate with the autonomous driving suite via the main bus, wherein the main vehicle control interface box provides control commands to the specific system based on instructions from the autonomous driving suite; as well as A sub-vehicle control interface box, configured to communicate with the autonomous driving suite via the sub-bus, wherein the sub-vehicle control interface box provides control commands to the specific system based on instructions from the autonomous driving suite, wherein... When the vehicle platform malfunctions, the main vehicle control interface box outputs identification information capable of recognizing the specific system's capability values ​​to the autonomous driving kit via the main bus, while the sub-vehicle control interface box outputs the identification information to the autonomous driving kit via the sub-bus. The specific system includes a braking system that performs the function of braking the vehicle platform as said specific function. The braking system includes a main part and sub-parts, each of which enables the vehicle platform to brake. The main vehicle control interface box directly sends the control commands to the main part. The sub-vehicle control interface box directly transmits the control commands to the main part and the sub-part. The main vehicle control interface box outputs corresponding identification information based on the fault points in the control system, specifically regarding whether the main part of the braking system and the sub-parts of the braking system are faulty. The sub-vehicle control interface box outputs corresponding identification information for each of the following based on the fault point: no fault in the braking system, degradation of the main part's function, and degradation of the sub-part's function.

2. The vehicle according to claim 1, wherein The specific system also includes a steering system that performs the function of steering the vehicle platform as part of the specific function. The steering system includes a motor, a main section, and a sub-section. The motor generates steering force for the vehicle platform, and each of the main section and the sub-section can control the motor. The main vehicle control interface box provides control commands for controlling some of the torque generated by the motor. The sub-vehicle control interface box provides control commands for controlling the remaining portion of the torque generated by the motor, and Each of the main vehicle control interface box and the sub-vehicle control interface box outputs identification information corresponding to each of the fault points in the control system, namely, whether the main part of the steering system is faulty and whether the sub-part of the steering system is faulty.

3. A vehicle platform, wherein an autonomous driving kit is attachable to and removable from the vehicle platform, the autonomous driving kit provides autonomous driving commands, the vehicle platform is configured to be capable of autonomous driving, the vehicle platform comprising: A specific system that performs a specific function of the vehicle platform; Main bus; Sub-bus; A main vehicle control interface box, configured to communicate with the autonomous driving suite via the main bus, wherein the main vehicle control interface box provides control commands to the specific system based on instructions from the autonomous driving suite; as well as A sub-vehicle control interface box, configured to communicate with the autonomous driving suite via the sub-bus, wherein the sub-vehicle control interface box provides control commands to the specific system based on instructions from the autonomous driving suite, wherein... When the vehicle platform malfunctions, the main vehicle control interface box outputs identification information capable of recognizing the specific system's capability values ​​to the autonomous driving kit via the main bus, while the sub-vehicle control interface box outputs the identification information to the autonomous driving kit via the sub-bus. The specific system is a braking system that performs the function of braking the vehicle platform as described in the specific function. The braking system includes a main part and sub-parts, each of which enables the vehicle platform to brake. The main vehicle control interface box directly sends the control commands to the main part. The sub-vehicle control interface box directly transmits the control commands to the main part and the sub-part. The main vehicle control interface box outputs corresponding identification information based on the fault points in the control system, specifically regarding whether the main part of the braking system and the sub-parts of the braking system are faulty. The sub-vehicle control interface box outputs corresponding identification information for each of the following based on the fault point: no fault in the braking system, degradation of the main part's function, and degradation of the sub-part's function.

4. An autonomous driving kit, the autonomous driving kit being attachable to and removable from a vehicle platform configured to drive autonomously, the autonomous driving kit providing autonomous driving commands. The vehicle platform includes: A specific system that performs a specific function of the vehicle platform; Main bus; Sub-bus; A main vehicle control interface box, configured to communicate with the autonomous driving suite via the main bus, wherein the main vehicle control interface box provides control commands to the specific system based on instructions from the autonomous driving suite; as well as A sub-vehicle control interface box, configured to communicate with the autonomous driving suite via the sub-bus, wherein the sub-vehicle control interface box provides control commands to the specific system based on instructions from the autonomous driving suite, wherein... When the vehicle platform malfunctions, the autonomous driving kit receives identification information from the main vehicle control interface box via the main bus, which identifies the capability values ​​of the specific system. The autonomous driving kit also receives this identification information from the sub-vehicle control interface box via the sub-bus. The specific system is a braking system that performs the function of braking the vehicle platform as described in the specific function. The braking system includes a main part and sub-parts, each of which enables the vehicle platform to brake. The main vehicle control interface box directly sends the control commands to the main part. The sub-vehicle control interface box directly transmits the control commands to the main part and the sub-part. The main vehicle control interface box outputs corresponding identification information based on the fault points in the control system, specifically regarding whether the main part of the braking system and the sub-parts of the braking system are faulty. The sub-vehicle control interface box outputs corresponding identification information for each of the following based on the fault point: no fault in the braking system, degradation of the main part's function, and degradation of the sub-part's function.

Images