Vehicle control device, inquiry method, program, and vehicle control system

Abstract

The invention provides a vehicle control device. A vehicle control device is provided with an acceptance determination unit (711, S11), an output unit (711, S103), a period determination unit (713, S13), and a notification unit (713, S105). The notification unit is configured to, if there is a first command determined to be unacceptable for a predetermined period or longer and the first command is not classified as a preset function relating to the safety of the vehicle, ask a user whether or not to execute an operation of a target application, using the application that outputs the first command as the target application.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] The present international application claims the priority based on Japanese Patent Application No. 2022-123424 filed in the Japan Patent Office on August 2, 2022, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure relates to a vehicle control device. Background Art

[0004] The following patent document 1 discloses an arbitration system for a vehicle, which has a main manager and a sub-manager, and arbitrates requests from multiple applications to control the movement of the vehicle. The main manager receives a request from a first application execution unit to determine the request for the sub-manager. The main manager selects one request from the multiple requests received, or sets the order of implementation of the multiple requests received, or rejects the request. The sub-manager arbitrates the request from the second application execution unit and the request determined by the main manager. When opposite requests are input at the same time, the sub-manager selects any one of the requests based on a pre-prepared selection criterion. In the arbitration system for a vehicle, when a new function is added to the vehicle, the function can be easily expanded by adding an application that implements the new function and a first application execution unit that executes the application to the main manager side.

[0005] Patent Document 1: Japanese Patent Application Publication No. 2020-64489

[0006] However, the inventors have found the following problem after detailed research: in the vehicle arbitration system described in Patent Document 1, the application desired by the user may always fail in arbitration in the main manager or the sub-manager and cannot be executed. However, if only the application desired by the user is executed preferentially, the safety of the vehicle may not be maintained. Summary of the invention

[0007] A technical solution of the present disclosure provides a vehicle control device that can maintain the safety of the vehicle and preferentially execute an application desired by a user.

[0008] One embodiment of the present disclosure is a vehicle control device that is mounted on a vehicle and controls the vehicle, and includes an acceptance determination unit, an output unit, a period determination unit, and a notification unit. The acceptance determination unit is configured to determine whether the first instruction can be accepted when a first instruction from at least one application is input. The output unit is configured to output a second instruction based on the first instruction to a work control unit for controlling a controlled object for a first instruction that is determined to be acceptable. The period determination unit determines whether there is a first instruction that is determined to be unacceptable for more than a specified period. When there is a first instruction that is unacceptable for more than a specified period, and the first instruction is not classified as a pre-set function related to the safety of the vehicle, the notification unit inquires the user whether to execute the action of the object application. In addition, the application that outputs the first instruction is regarded as the object application.

[0009] According to such a configuration, it is possible to maintain the safety of the vehicle and to preferentially execute an application desired by the user. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a block diagram showing the structure of a vehicle control system.

[0011] Figure 2 1 is a ladder diagram showing basic operations performed by the vehicle control system in the embodiment.

[0012] FIG. 3 is a schematic diagram of a priority table.

[0013] Figure 4 This is a ladder diagram showing a basic operation when an application program that requests an execution operation for a vehicle function related to a non-safety function is added.

[0014] Figure 5 This is a ladder diagram showing a basic operation when an application program that requests execution of an operation is added to a vehicle function related to a high-level safety function. DETAILED DESCRIPTION

[0015] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings.

[0016] [1. Implementation Method]

[0017] [1-1. Correspondence between the structure of the embodiment and the structure of the present disclosure]

[0018] In the following embodiment, ECU A10 is equivalent to the vehicle control device in the present disclosure. The processing of the request arbitration unit 711 in the embodiment is equivalent to the functions of the acceptance determination unit, the output control unit, and the execution priority unit in the present disclosure. The processing of the arbitration priority management unit 712 in the embodiment is equivalent to the functions of the table recording unit and the table change unit in the present disclosure. The processing of the arbitration result management unit 713 in the embodiment is equivalent to the functions of the period determination unit and the notification unit in the present disclosure.

[0019] [1-2. Structure]

[0020] Figure 1 Most of the structure of the vehicle control system 1 shown is installed in a vehicle such as a passenger car, and includes a plurality of ECUs 10, 15, 41 to 49 (hereinafter referred to as a plurality of ECUs 10, etc.). The vehicle control system 1 may also include a center 35 outside the vehicle. The plurality of ECUs 10, etc. are connected in a communicative manner via an in-vehicle network centered on the ECU 10. In addition, the center 35 is also connected in a communicative manner via the in-vehicle network.

[0021] The center 35 is configured as a server capable of providing functions to the vehicle. For example, the center 35 can provide functions related to autonomous driving and the like to the vehicle.

[0022] The plurality of ECUs 10 and the center 35 are respectively constructed around a known microcomputer having CPUs 11, 16, 36, 41A to 49A (hereinafter referred to as CPUs 11 to 49A) and semiconductor memories 12, 17, 37, 41B to 49B (hereinafter referred to as memories 12 to 49B) such as RAM, ROM, and flash memory. ECU stands for electronic control unit.

[0023] ECU A10 among the plurality of ECUs 10 includes a communication unit 13 configured as a communication module such as a known transceiver. ECU A10 has a relay function for relaying communication between other devices in the vehicle connected to ECU 10A (eg, other ECUs) using the communication unit 13 .

[0024] ECU10A communicates with multiple ECU10, etc., and manages multiple ECU10, etc., so as to realize the coordinated control of the whole vehicle. Multiple ECU10, etc. are set according to each domain divided according to the function in the vehicle, and mainly perform the control of multiple ECUs existing in the domain. ECU10A is connected to the subordinate ECU41~49 via the lower layer network that communicates through CAN, for example. In addition, CAN is the abbreviation of Controller Area Network. CAN is a registered trademark. Domains are, for example, powertrain, body, chassis, and cockpit.

[0025] The ECUs belonging to the domain of the powertrain may include, for example, an ECU for controlling an engine, an ECU for controlling a motor, an ECU for controlling a battery, and the like.

[0026] The ECU belonging to the domain of the vehicle body includes, for example, the ECU J48 for controlling the air conditioner and the ECU K49 for controlling the seat. In addition, the ECU belonging to the domain of the vehicle body may also include the ECU for controlling the door and the like.

[0027] The ECUs belonging to the chassis domain include, for example, ECU E43 for controlling brakes and ECU F44 for controlling steering wheels.

[0028] The plurality of ECUs 10 and the center 35 are configured to control the controlled objects mounted on the vehicle based on the second command outputted inside the processing unit 71. The controlled objects include, for example, engines, brakes, motors, various lights, display devices, air conditioners, seats, speakers, generators, etc. In addition, illustration of the controlled objects is omitted.

[0029] The controlled objects are individually controlled by ECU41 to 49 as working control devices. ECU41 to 49 include ECUC41 with a camera control unit 91, ECUD42 with a millimeter wave control unit 92, ECUE43 with a brake control unit 93, and ECUF44 with a steering control unit 94. In addition, ECUG45 with a display control unit 95, ECUH46 with a sound control unit 96, ECUI47 with a light control unit 97, ECUJ48 with an HVAC control unit 98, and ECUK49 with a seat control unit 99 are included.

[0030] Each control unit 91 to 99 includes a work control unit for operating a controlled object. As an example, the work control unit refers to a work control program. The camera control unit 91 obtains images captured by a vehicle-mounted camera and controls the exposure of the vehicle-mounted camera. The millimeter wave control unit 92 controls the millimeter wave radar of the vehicle and obtains the detection results obtained by the millimeter wave radar.

[0031] The brake control unit 93 controls the brakes. The steering control unit 94 controls the steering wheel. The display control unit 95 controls displays such as meters and warning lights. The sound control unit 96 controls sounds such as alarm sounds and voices generated from the speaker. The light control unit 97 controls various lights mounted on the vehicle.

[0032] The HVAC control unit 98 controls the vehicle air conditioner. HVAC is an abbreviation for Heating Ventilation and Air-Conditioning. The seat control unit 99 controls the electric seat of the vehicle.

[0033] The various functions of the plurality of ECUs 10 and the center 35 are realized by executing the programs stored in the non-migrating physical recording medium by the CPUs 11 to 49A. In this example, the memories 12 to 49B correspond to the non-migrating physical recording medium storing the programs. In addition, the method corresponding to the program is executed by executing the program. In addition, the non-migrating physical recording medium means anything other than the electromagnetic waves in the recording medium. In addition, the number of microcomputers constituting the plurality of ECUs 10 and the center 35 may be one or more.

[0034] The ECUA 10 implements functions as application programs (hereinafter, applications) 61 and 62 and a processing unit 71 by executing programs. The ECUB 15 implements functions as an application 63. The center 35 implements functions as an application 64.

[0035] Applications 61 to 64 are programs for providing services to vehicle users. Applications 61 to 64 indirectly send instructions to controlled objects to operate the controlled objects, thereby providing useful functions to users. These applications 61 to 64 can be installed in ECU A 10, ECU B 15, or center 35.

[0036] More specifically, the applications 61 to 64 are configured to generate a first instruction that does not specify the control units 91 to 99 described later to the processing unit 71. In addition, the "instruction" includes instructions such as action requests, instructions such as arguments, function calls, etc., among the data used in the processing unit 71. The "instruction" may also include priority information indicating which instruction should be processed first.

[0037] Applications 61 to 64 are not programs created specifically for a vehicle model, grade, etc., but are general programs that can correspond to multiple vehicle models, grades, etc. Therefore, applications 61 to 64 cannot determine how the vehicle on which they are installed controls the controlled object. Therefore, applications 61 to 64 output the control amount of a specific controlled object, in other words, the output does not specify the instructions of the control units 91 to 99 used by the processing unit 71. On the other hand, applications 61 to 64 generate desired abstract work content. For example, applications 61 to 64 only instruct work content such as lighting a lamp, and the work content does not include which lamp is specifically to be lit.

[0038] Hereinafter, at least one of the applications 61 to 64 will also be referred to as a service application 6 .

[0039] Unlike the applications 61 to 64, the processing unit 71 has a program created specifically for the vehicle model, grade, etc. That is, the processing unit 71 has a program that absorbs the difference in vehicle model, grade, etc., so that the applications 61 to 64 do not need to be aware of the difference in vehicle model, grade, etc.

[0040] The processing unit 71 is mounted on the ECU A 10 . The processing unit 71 receives instructions from the ECU A 10 as itself, the ECU B 15 as another ECU, and the plurality of applications 61 to 64 mounted on the center 35 .

[0041] The processing unit 71 includes a request arbitration unit 711, an arbitration priority management unit 712, and an arbitration result management unit 713 as functional modules, i.e., virtual components, implemented by the CPU 11 executing a program. The processing in the request arbitration unit 711, the arbitration priority management unit 712, and the arbitration result management unit 713 will be described in detail later.

[0042] The processing unit 71 is also a program for controlling the controlled object. The processing unit 71, for example, calculates the workload of the actuator that is the controlled object, and sends an instruction containing the workload to various control units 91 to 99. That is, the processing unit 71 has the following function, when an abstract first instruction is input, it generates a second instruction that materializes the first instruction. For example, if a first instruction such as turning on a light is input from an application 61 to 64, the processing unit 71 generates a specific second instruction such as which light to turn on. In more detail, for example, the processing unit 71 identifies what kind of equipment the vehicle has, and selects the type of light to be turned on according to the type of equipment the vehicle has. In addition, the processing unit 71 sets the lighting mode of each selected light (for example, the interval when flashing, etc.), and sends a second instruction containing the lighting mode to each control unit 91 to 99 that controls the light to be turned on.

[0043] The processing unit 71 is also a program for sending data obtained from sensors and the like to the service application 6. In other words, the processing unit 71 realizes the function of "state recognition" and the function of "equipment control". In the state recognition function, the sensor data obtained from each control unit 91 to 99 described later is converted into a form suitable for the processing unit 71. In the equipment control function, the driving instruction from the processing unit 71 is distributed to each control unit 91 to 99.

[0044] The state recognition function realizes a function of classifying individual sensor raw data acquired from vehicle sensors into data of each sensing object that can be easily used by the service application 6. In addition, the data is integrated and converted into information with a higher degree of abstraction.

[0045] For example, in the state recognition function, each control unit 91 to 99 obtains individual information such as vehicle speed 0 km / h, gear position P, and no driver in the vehicle, and outputs that the vehicle is parked based on this information. This information is transmitted to the service application 6.

[0046] For example, when the service application 6 makes a request for the car finder, the processing unit 71 may also respond to the service application 6 by summarizing the response to the control request for the light and the horn, that is, the ACK from the light and the ACK from the horn into one action result. In addition, the car finder refers to the function of an application that notifies the user of the location of the vehicle in a parking lot or the like in an easy-to-understand manner.

[0047] In the equipment control function, the best control units 91 to 99 (for example, engine, steering wheel, gear shift, door, window, air conditioner, etc.) are selected to realize the vehicle action request from the service application 6. In addition, the data is converted into a format that can be accepted by each control unit 91 to 99 and distributed in consideration of the order in which the data is sent.

[0048] For example, if the vehicle action request is "turn the vehicle to the left at R200m and accelerate at 0.3G", the equipment control function outputs "request for engine output of 1000Nm and request for steering output of -0.1rad".

[0049] For example, suppose the vehicle action request is "transfer to parking state". In this case, in the equipment control function, "request to shift to P, request to turn off the air conditioner, request to fully close the windows, request to lock the doors and transfer to parking state after the requests in the left column are completed and there is no occupant" are output.

[0050] [1-3. Processing]

[0051] Next, use Figure 2 The ladder diagram of the vehicle control system 1 illustrates the basic processing performed in the vehicle control system 1. This processing is the processing when the action request of the vehicle function i related to the non-safety function is sent from different service applications 6. Here, the classification of safety function or non-safety function is, for example, the automotive safety level (hereinafter, ASIL). ASIL is a risk classification system defined in the ISO26262 standard regarding the functional safety of vehicles traveling on the road. ASIL is determined by three parameters: probability of exposure, controllability, and severity, and is represented by four stages A to D. A is the lowest level, and D corresponds to the highest level. In this embodiment, ASIL A is classified as vehicle function i related to non-safety functions, ASIL D is classified as vehicle function ii related to high-level safety functions, and ASIL B and ASIL C are classified as vehicle function iii related to safety functions below the high level. In addition, the classification of safety functions does not necessarily require the use of ASIL, as long as it is defined as a safety level with multiple levels. Therefore, the safety level does not need to be the four stages A to D, but can also be less than three stages or more than five stages. In addition, hereinafter, “safety function” is also expressed as “function related to vehicle safety”.

[0052] In S101 , application 61 including application A sends an operation request for vehicle function i (ie, a first instruction in the present disclosure) to request arbitration unit 711 . Substantially simultaneously, application 63 including application B also sends an operation request for vehicle function i to request arbitration unit 711 in S102 .

[0053] In S11, the request arbitration unit 711 determines whether any first instruction can be accepted. Specifically, the request arbitration unit 711 determines whether any first instruction can be executed by referring to the priority table. The priority table is a table that establishes a corresponding priority for each application or for each type of request from an application.

[0054] For example, Figure 3A As shown, the priority table manages the priority of the vehicle functions requested by the application in each scenario. For example, the scenarios are classified according to the driving state. In addition, the scenarios can also be classified according to the power state of the vehicle equipment, the driving load, the automation level, etc. In addition, for example, the vehicle function i requested by the application is classified according to each category of the request from the application (for example, application A request i, application A request ii, etc.).

[0055] The request arbitration unit 711 determines that the first instruction can be accepted for the vehicle function i with a higher priority. In other words, the vehicle function i with a higher priority is set to have a higher priority when executing the corresponding application program.

[0056] also, Figure 3A The table shown is a table that establishes a corresponding priority for each category of requests from an application. Therefore, there may be a situation where after a part of multiple requests from an application are executed, the execution of another part is waiting. In this case, during the waiting period, other processing with a higher priority can be completed earlier.

[0057] In addition, if Figure 3B As shown, it is also possible to have a corresponding table established for each application instead of for each category of request, and the table can also be used with Figure 3A Use the tables shown in the table. Figure 3B In the case of the table shown in FIG. 1 , the request arbitration unit 711 can execute the processing according to the priority order set for each application. In this case, it is possible to prevent multiple processing of the application from being interrupted midway.

[0058] In S103, the request arbitration unit 711 outputs a second instruction based on the first instruction to the operation control unit for controlling the controlled object for the first instruction determined to be acceptable. In this embodiment, the request arbitration unit 711 determines that the operation request of the vehicle function i sent from the application 61 is acceptable, and outputs the second instruction to the vehicle function i.

[0059] Furthermore, in S104 , the request arbitration unit 711 transmits the arbitration result that the first command of the application 61 can be accepted but the first command of the application 63 cannot be accepted to the arbitration result management unit 713 .

[0060] In S12 , the arbitration result management unit 713 records the arbitration result. At this time, the arbitration result management unit 713 counts the number of times the first command of the application 63 cannot be accepted, and stores it in the memory 12 .

[0061] Next, in S13, the arbitration result management unit 713 determines whether there is a first command that has been determined to be unacceptable for more than a predetermined period. In this embodiment, the arbitration result management unit 713 determines whether there is a first command that has been determined to be unacceptable for more than a predetermined number of times as the predetermined period.

[0062] In addition, the prescribed period is not limited to the number of times set in advance, but may be a period set in advance. In addition, the prescribed period may be set to a different value for each application, for each instruction from an application, etc. In addition, the prescribed period may be set each time according to an application, an instruction from an application, and an operation based on conditions when processing is performed by the arbitration result management unit 713, etc.

[0063] In S105, when there is a first instruction that is determined to be unacceptable for a predetermined period of time or longer, and the first instruction is not classified as a pre-set function related to vehicle safety, the arbitration result management unit 713 inquires the user whether to execute the target application. In addition, the application that outputs the first instruction is set as the target application. In this embodiment, the arbitration result management unit 713 sets application B as the target application and inquires the user whether to execute the target application. As an example, the inquiry is executed during parking. This is because the user's answer to the inquiry can be executed more safely.

[0064] In S14, the answer to the inquiry is received. If the user answers to execute the target application, in S106, the information terminal 81 requests to stop other applications competing with the target application. In this embodiment, the information terminal 81 requests to stop application A, and in S15, the application 61 stops the action request for the vehicle function i of application A.

[0065] In S16 , the request arbitration unit 711 determines again whether or not any first command can be accepted.

[0066] In S107, the request arbitration unit 711 determines that the first instruction is acceptable as a result of the re-determination, and outputs a second instruction based on the first instruction to the operation control unit for controlling the controlled object. In this embodiment, the request arbitration unit 711 determines that the action request of the vehicle function i sent from the application 63 is acceptable, and outputs the second instruction to the vehicle function i.

[0067] Furthermore, in S108 , the request arbitration unit 711 transmits the arbitration result indicating that the first command from the application 63 can be accepted to the arbitration result management unit 713 .

[0068] Next, in S17 , similarly to S13 , the arbitration result management unit 713 determines whether there is a first command that has been determined to be unacceptable for a predetermined period of time or longer.

[0069] If there is no first instruction determined to be unacceptable for a predetermined period of time or longer, in S109 , the arbitration result management unit 713 inquires the user whether to change the setting of the priority order in the same scene next time or later.

[0070] In S18 , a response to the inquiry regarding the next and subsequent settings is received, and in S110 , the information terminal 81 requests a change in the priority order of the vehicle function i.

[0071] In S19 , the arbitration priority management unit 712 updates the priority table based on the user's answer.

[0072] Next, use Figure 4 The ladder diagram of FIG. 1 will explain an operation example when a new application is added. In this process, a case where an application that executes an operation request is added with respect to a vehicle function i related to a non-safety function will be explained.

[0073] In S201 , when an application B is newly added from the information terminal 81 , the application 63 requests the arbitration priority management unit 712 to add the vehicle function i requested by the application B to the priority table in S202 .

[0074] In S21, the arbitration priority management unit 712 determines whether it is possible to add to the priority table. Specifically, the arbitration priority management unit 712 determines whether the vehicle function (hereinafter referred to as the additional function) requested to be added to the priority table is a function related to the safety of the vehicle. In the case where the additional function is a function related to the safety of the vehicle, the arbitration priority management unit 712 does not allow it to be added to the priority table. For example, in the case where the additional function has a high-level safety function like vehicle function ii, it is not allowed to be added to the priority table. This is because, in the case where the additional function is a function related to the safety of the vehicle, it should be executed with the highest priority, and the priority should not be changed to a lower level. In the present embodiment, in the case where the additional function is vehicle function i, vehicle function i is a non-safety function and does not meet the function related to the safety of the vehicle, so the addition of the additional function to the priority table is allowed.

[0075] In S22, the arbitration priority management unit 712 associates the new application with the default priority and adds it to the priority table. At this time, the types of requests that can be sent from the new application may be associated with the default priority and added to the priority table.

[0076] If a change in the priority order is requested by a user operation in S203 , then in S23 the arbitration priority management unit 712 changes the priority order recorded in the priority order table from the default priority order to the priority order instructed by the user operation.

[0077] Next, in S204 , the arbitration priority management unit 712 transmits the changed priority order to the information terminal 81 .

[0078] Next, use Figure 5 The ladder diagram of FIG. 1 will explain another operation example when a new application is added. In this process, a case where an application that executes an operation request is added to a vehicle function ii related to a high-level safety function is explained.

[0079] In S301 , when the application B is newly added from the information terminal 81 , the application 63 requests the arbitration priority management unit 712 to add the vehicle function ii requested by the application B to the priority table in S302 .

[0080] In S31, similar to S21, the arbitration priority management unit 712 determines whether to add to the priority table. In this embodiment, the vehicle function ii is a high-level safety function, which is equivalent to a function related to vehicle safety, and therefore is not added to the priority table.

[0081] Next, in S303 , the arbitration priority management unit 712 stops the request to add the vehicle function ii to the priority table, and in S32 , the application 63 stops the request.

[0082] In addition, since application B is a security-related function, the arbitration priority management unit 712 notifies the user that it cannot be added to the priority table.

[0083] [1-4. Effect]

[0084] According to the above-described detailed embodiments, the following effects are obtained.

[0085] (1a) In S13, the arbitration result management unit 713 determines whether there is a first instruction that is determined to be unacceptable more than a preset number of times. Furthermore, in S105, when there is a first instruction that is determined to be unacceptable more than a preset number of times, and the first instruction is not classified as a preset function related to the safety of the vehicle, the arbitration result management unit 713 inquires the user whether to execute the target application. According to such a structure, it is possible to avoid a situation where the application desired by the user is not executed more than a preset number of times. In addition, if it is configured so that the function related to the safety of the vehicle is executed preferentially without inquiring the user, the safety of the vehicle can be maintained. Therefore, the safety of the vehicle can be maintained, and the application desired by the user can be executed preferentially.

[0086] (1b) When the user replies to execute the target application, in S107, the request arbitration unit 711 receives the first instruction based on the target application and executes the target application in priority to other application programs. With this configuration, it is possible to avoid a situation where the target application is not executed for a predetermined period of time.

[0087] (1c) When the user replies to execute the target application, in S106, the information terminal 81 requests to stop other applications competing with the target application. According to such a configuration, since other competing applications are stopped, the target application can be executed immediately.

[0088] (1d) When a new application is added, in S22, the arbitration priority management unit 712 records the new application in the priority table in correspondence with the priority. In addition, in S11, the request arbitration unit 711 refers to the priority table to determine whether any first instruction can be executed. According to such a structure, the priority of the application can be managed in a simple way. In addition, when a new application is added, the category of the instruction from the application can also be recorded in the priority table in correspondence with the priority.

[0089] (1e) In S203, when a change in priority is requested for vehicle function i through a user's operation, in S23, the arbitration priority management unit 712 can change the priority recorded in the priority table. On the other hand, in S31, vehicle function ii is a high-level safety function, which is equivalent to a function related to the safety of the vehicle, so the addition to the priority table is abandoned and the priority cannot be changed. According to such a structure, the priority can be set according to the user's intention. In addition, for functions related to the safety of the vehicle, the priority will not be set to a lower level, so the safety of the vehicle can be maintained.

[0090] [2. Other embodiments]

[0091] As mentioned above, although embodiment of this disclosure was described, this disclosure is not limited to the said embodiment, It is needless to say that various forms can be adopted.

[0092] (2a) In the above embodiment, the following structure is illustrated: in S13, the arbitration result management unit 713 determines whether there is a first instruction that is determined to be unacceptable for more than a predetermined number of times. That is, the number of times the arbitration fails is counted, and the count value is used as the arbitration failure period to determine whether it is acceptable. However, the method of determining whether there is a first instruction that is determined to be unacceptable for more than a specified period is not limited to this. For example, the arbitration result management unit 713 may also determine whether there is a first instruction that is determined to be unacceptable for more than a certain period of time. That is, the time for the arbitration failure may be measured, and the time may be used as the arbitration failure period to determine whether it is acceptable. In addition, the predetermined number of times and the certain time may be fixed values ​​or different for each type of application. In addition, the predetermined number of times and the certain time may also be changed according to the situation.

[0093] (2b) In the above embodiment, the following structure is illustrated: in S105, the arbitration result management unit 713 inquires the user whether to execute the target application while the vehicle is parked. However, the timing of inquiring the user is not limited to this. For example, the arbitration result management unit 713 may also notify the user in at least one of the conditions of the vehicle being parked and being driven, and the method of inquiring the user is different when the vehicle is parked and when it is driven. As an example, it is preferable to display the inquiry content on the monitor when the vehicle is parked, and to notify the user by voice when the vehicle is driving. According to such a structure, the user can be inquired in an appropriate method according to the situation.

[0094] (2c) In the above embodiment, the following structure is illustrated: in S14, a response to the inquiry is received, and when the user responds to execute the target application, in S106, the information terminal 81 requests to stop other applications that compete with the target application. However, the structure for executing the target application in priority to other applications is not limited to this. For example, the information terminal 81 may request to execute the target application instead of requesting to stop other applications that compete with the target application. As a result, other applications that compete with the target application may be stopped by executing the target application.

[0095] (2d) In the above-mentioned embodiment, the following structure is illustrated: when the vehicle function is equivalent to a function related to the safety of the vehicle, addition to the priority table is not allowed. However, even when the vehicle function is equivalent to a function related to the safety of the vehicle, addition to the priority table may be allowed. However, it is preferably configured so that the priority cannot be changed when the vehicle function is equivalent to a function related to the safety of the vehicle. According to such a structure, the priority is not set to a lower level for the function related to the safety of the vehicle, so the safety of the vehicle can be maintained. In addition, the priority of the application classified as the function related to the safety of the vehicle is set higher than the priority of the application not classified as the function related to the safety of the vehicle. For example, the application classified as the function related to the safety of the vehicle is set to never fail in arbitration. As a result, arbitration failure can be avoided for the application classified as the function related to the safety of the vehicle, and the user's intention can be reflected for the application not classified as the function related to the safety of the vehicle.

[0096] (2e) In the above-mentioned embodiment, the following structure is illustrated: in S105, the arbitration result management unit 713 takes application B as the object application and asks the user whether to execute the object application. That is, the structure of asking whether the application itself is allowed to be executed is illustrated. In the case of allowing execution, the entire application is temporarily or permanently executed with priority. However, in the vehicle control system 1, it is also possible to have a structure in which a part of the action executed by the application is asked whether execution is allowed. In the case of allowing execution, it is also possible to temporarily or permanently give priority to a part of the action executed by the application. For example, consider the following situation, in which a driving professor application that monitors the user's driving condition and performs driving diagnosis and a music player application that plays music are in execution. In this case, it is also possible to have a structure in which, when the arbitration of the voice output of driving advice in the driving professor application fails, it is asked whether the voice output is allowed to be executed. Even if the voice output is not allowed to be executed, the driving professor application itself can continue to operate.

[0097] (2f) The multiple ECUs 10 and the methods thereof described in the present disclosure may also be implemented by a dedicated computer provided with a processor and a memory programmed to implement one or more functions embodied by a computer program. Alternatively, the multiple ECUs 10 and the methods thereof described in the present disclosure may also be implemented by a dedicated computer provided with a processor composed of one or more dedicated hardware logic circuits. Alternatively, the multiple ECUs 10 and the methods thereof described in the present disclosure may also be implemented by one or more dedicated computers composed of a combination of a processor and a memory programmed to implement one or more functions and a processor composed of one or more hardware logic circuits. In addition, a computer program may also be stored as an instruction executed by a computer in a computer-readable non-migratable tangible recording medium. In the method of implementing the functions of each part included in the multiple ECUs 10 and the like, it is not necessarily necessary to include software, and all of its functions may also be implemented using one or more hardware.

[0098] (2g) It is also possible to implement multiple functions of one component of the above-mentioned embodiment by multiple components, or to implement one function of one component by multiple components. In addition, it is also possible to implement multiple functions of multiple components by one component, or to implement one function implemented by multiple components by one component. In addition, it is also possible to omit a part of the structure of the above-mentioned embodiment. In addition, it is also possible to add or replace at least a part of the structure of the above-mentioned embodiment with respect to the structure of other above-mentioned embodiments.

[0099] (2h) In addition to the above-mentioned vehicle control system 1, the present disclosure can also be implemented in various ways such as ECU10 etc. which is a component of the vehicle control system 1, a vehicle control program for enabling a computer to function as the ECU10 etc., a non-migrating physical recording medium such as a semiconductor memory which records the program, a vehicle control method, etc.

Claims

1. A vehicle control device is a vehicle control device configured to be mounted on a vehicle and control the vehicle, comprising: an acceptance determination unit (711, S11) configured to determine whether the first instruction can be accepted when a first instruction from at least one application program is input; an output unit (711, S103) configured to output a second instruction based on the first instruction to a work control unit for controlling a controlled object, with respect to the first instruction determined to be acceptable; a period determination unit (713, S13) configured to determine whether there is the first instruction determined to be unacceptable for a predetermined period or longer; and The notification unit (713, S105) is configured to, when the above-mentioned first instruction is determined to be unacceptable for more than a prescribed period based on the above-mentioned period determination unit, and the first instruction is not classified as a pre-set function related to the safety of the vehicle, treat the application that outputs the first instruction as an object application and inquire the user whether to execute the action of the object application.

2. The vehicle control device according to claim 1, wherein: It also has an execution priority unit (711, S107), which is configured to receive an answer to the inquiry of the above-mentioned notification unit. When the above-mentioned user answers to execute the action of the above-mentioned object application, the above-mentioned acceptance judgment unit is made to accept the above-mentioned first instruction based on the object application, thereby executing the action of the object application with priority over the actions of other applications.

3. The vehicle control device according to claim 2, wherein: The execution prioritizing unit is configured to stop other application programs competing with the target application so that the target application is determined to be acceptable by the acceptance determining unit.

4. The vehicle control device according to any one of claims 1 to 3, wherein: A priority table is created for each application. The system further comprises a table adding unit (712, S21) configured to add the new application to the priority table in correspondence with the priority order when a new application is added. The acceptance determination unit is configured to refer to the priority table to determine whether the first command is executable.

5. The vehicle control device according to any one of claims 1 to 4, wherein: A priority table is created for each category of instructions from the application program. The system further comprises a table appending unit (712, S21) configured to append the type of the command related to the new application to the priority table in correspondence with the priority order when a new application is added. The acceptance determination unit is configured to refer to the priority table to determine whether the first command is executable.

6. The vehicle control device according to claim 4 or 5, wherein: further comprising a table changing unit (712, S23) configured to be able to change the priority order recorded in the priority order table through the operation of the user, The table changing unit is configured to be unable to change the priority order regarding the functions related to the safety of the vehicle.

7. The vehicle control device according to any one of claims 1 to 6, wherein: The notification unit is configured to make a notification in at least one of a state in which the vehicle is parked and a state in which the vehicle is traveling, and to make a different inquiry method to the user in the state in which the vehicle is parked and in the state in which the vehicle is traveling.

8. The vehicle control device according to any one of claims 1 to 7, wherein: Pre-set priorities for each application. The priority order of the application program classified as a function related to vehicle safety is set higher than the priority order of the application program not classified as a function related to vehicle safety, The acceptance determination unit is configured to determine whether the first command is executable by referring to the priority order.

9. An inquiry method is an inquiry method implemented by a vehicle control device, the vehicle control device being configured to be mounted on a vehicle and control the vehicle, the inquiry method comprising: When a first instruction from at least one application is input, determining whether the first instruction can be accepted (711, S11); For the first instruction determined to be acceptable, a second instruction based on the first instruction is output to a work control unit for controlling a controlled object (711, S103); Determine whether there is the first instruction that is determined to be unacceptable for a predetermined period of time or longer (713, S13); and When there is the above-mentioned first instruction that is determined to be unacceptable for more than the prescribed period and the first instruction is not classified as a pre-set function related to vehicle safety, the application that outputs the first instruction is treated as an object application, and the user is asked whether to execute the action of the object application (713, S105).

10. A program for causing a computer mounted on a vehicle to: When a first instruction from at least one application is input, determining whether a function of the first instruction can be accepted (711, S11); A function of outputting a second instruction based on the first instruction to a work control unit for controlling a controlled object for the first instruction determined to be acceptable (711, S103); Determining whether there is a function that is determined to be unable to accept the first instruction for a predetermined period of time or longer (713, S13); and When there is the above-mentioned first instruction that is determined to be unacceptable for more than a prescribed period of time and the first instruction is not classified as a pre-set function related to vehicle safety, the application that outputs the first instruction is used as an object application, and the user is asked whether to execute the action of the object application (713, S105).

11. A vehicle control system is a vehicle control system mounted on a vehicle, comprising: A vehicle control device (10) configured to control the vehicle and having a relay function in a network within the vehicle; and The electronic control device (41-49) is connected to the vehicle control device via the network in a communicable manner. The vehicle control device comprises: an acceptance determination unit (711, S11) configured to determine whether the first instruction can be accepted when a first instruction from at least one application program is input; an output unit (711, S103) configured to output a second instruction based on the first instruction to the electronic control device for controlling the controlled object, in response to the first instruction determined to be acceptable; a period determination unit (713, S13) configured to determine whether there is the first instruction determined to be unacceptable for a predetermined period or longer; and The notification unit (713, S105) is configured to, when the first instruction is determined by the period determination unit to be unacceptable for more than a predetermined period and the first instruction is not classified as a pre-set function related to vehicle safety, use the application that outputs the first instruction as a target application and inquire the user whether to execute the action of the target application, The electronic control device includes a control unit (91-99) configured to execute control of the controlled object based on the second command output from the output unit.

Images