Vehicle control device, vehicle control system, reception determination method, and program

Abstract

This vehicle control device is provided with a cooperative control unit (73), a function module (50), an acceptance determination unit (75), and an output control unit (77). The cooperation control unit causes an application to cooperate with a function module that executes a predetermined process, and the function module converts a first command transmitted from the application in a vehicle-independent form into a second command in a vehicle-dependent form, and outputs the second command to an operation control unit that controls an object to be controlled. The reception determination unit determines whether or not the first command follows the intention of the user, and the output control unit does not cause the output unit to output the second command when it is determined by the reception determination unit that the first command does not follow the intention of the user.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This international application claims the priority based on Japanese Patent Application No. 2022-140066 filed with the Japan Patent Office on September 2, 2022, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure relates to a vehicle control device. Background Art

[0004] The following patent document 1 discloses a vehicle-mounted device for appropriately preventing the execution of inappropriate vehicle remote control operations from a user. Specifically, when the air conditioner is operated by the vehicle remote control from a user, if the presence of a person or an animal is detected in the vehicle cabin or around the vehicle, the vehicle-mounted device ignores the cooling, heating designation and the set temperature designation from the user and forcibly operates the air conditioner in automatic mode.

[0005] Patent document 1: Japanese Patent No. 4639924.

[0006] In the future, it is expected that a large number of third-party applications will access the vehicle system. The inventors have conducted detailed studies and found that these applications may access the functions and information of the vehicle at a timing or content that the user does not want, and may cause the vehicle to operate. Summary of the invention

[0007] An aspect of the present disclosure provides a technology capable of suppressing execution of an application irrespective of a user's intention.

[0008] One aspect of the present disclosure is a vehicle control device configured to be mounted on a vehicle and to control the vehicle.

[0009] The vehicle control device includes a cooperation control unit (73) which realizes cooperation between an application (61, 62, 63, 64) configured to provide a service to the vehicle and a functional module (50) configured to execute a predetermined process in the vehicle.

[0010] The functional module includes an output unit (51-59) configured to convert a first instruction sent from an application in a form independent of the vehicle into a second instruction in a form dependent on the vehicle, and output the second instruction to an action control unit (91-99) for controlling a controlled object. In addition, the cooperation control unit forwards the first instruction sent from the application to the functional module.

[0011] Furthermore, the vehicle control device includes an acceptance determination unit (75, S103) and an output control unit (77, S103).

[0012] The acceptance determination unit is configured to determine whether the first instruction complies with the user's intention, and the output control unit is configured to prevent the output unit from outputting the second instruction when the acceptance determination unit determines that the first instruction does not comply with the user's intention.

[0013] According to such a configuration, it is possible to suppress the execution of an application irrelevant to the user's intention. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a block diagram showing the structure of a vehicle control system.

[0015] Figure 2 It is a block diagram showing the functional structure of the processing unit.

[0016] Figure 3 Yes means Figure 2 Flowchart of basic operation of the processing unit shown.

[0017] Figure 4 This is a flowchart of the notification setting process.

[0018] Figure 5 This is a flowchart showing a modified example of the basic operation of the processing unit. DETAILED DESCRIPTION

[0019] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings.

[0020] [1. Implementation Method]

[0021] [1-1. Correspondence between the structure of the embodiment and the structure of the present disclosure]

[0022] In the following embodiment, the ECU A 10 corresponds to the vehicle control device in the present disclosure.

[0023] The processing of S103 in the embodiment is equivalent to the functions of the acceptance determination unit and the output control unit in the present disclosure. The processing of S104 in the embodiment is equivalent to the function of the output unit in the present disclosure. The processing of S105 in the embodiment is equivalent to the function of the consistency determination unit in the present disclosure. The processing of S106 in the embodiment is equivalent to the function of the output permission unit and the storage unit in the present disclosure. The processing of S107 in the embodiment is equivalent to the function of the notification unit in the present disclosure. The processing of S204 in the embodiment is equivalent to the function of the notification setting unit in the present disclosure.

[0024] [1-2. Structure]

[0025] Figure 1Most of the configuration of the vehicle control system 1 shown is mounted on a vehicle such as a passenger car, and includes a plurality of ECUs 10, 15, 41 to 49 (hereinafter referred to as a plurality of ECUs 10, etc.) The vehicle control system 1 may include a center 35 outside the vehicle.

[0026] The center 35 is configured as a server capable of providing functions to the vehicle. For example, the center 35 can provide functions related to autonomous driving, etc. to the vehicle.

[0027] The plurality of ECUs 10 and the center 35 are respectively configured with a well-known microcomputer having CPUs 11, 16, 36 (hereinafter referred to as CPUs 11 to 36) and semiconductor memories 12, 17, 37 (hereinafter referred to as memories 12 to 37) such as RAM, ROM, and flash memory as the center. In addition, ECUs 41 to 49 also have CPUs and memories, but they are omitted from the figure. In addition, ECU means an electronic control unit.

[0028] The plurality of ECUs 10 and the center 35 are configured to control controlled objects mounted on the vehicle. The controlled objects include, for example, engines, brakes, motors, various lights, display devices, air conditioners, seats, speakers, generators, etc. In addition, illustration of the controlled objects is omitted.

[0029] The controlled objects are independently controlled by ECU41 to 49 as motion control devices. ECU41 to 49 include: ECUC41 with a camera control unit 91, ECUD42 with a millimeter wave control unit 92, ECUE43 with a brake control unit 93, and ECUF44 with a steering control unit 94. In addition, it includes: ECUG45 with a display control unit 95, ECUH46 with a sound control unit 96, ECUI47 with a light control unit 97, ECUJ48 with an HVAC control unit 98, and ECUK49 with a seat control unit 99.

[0030] Each control unit 91 to 99 includes an action control unit for causing the controlled object to move. As an example, the action control unit is an action control program. The camera control unit 91 obtains the image captured by the vehicle-mounted camera and controls the exposure of the vehicle-mounted camera. The millimeter wave control unit 92 controls the millimeter wave radar of the vehicle and obtains the detection results obtained by the millimeter wave radar.

[0031] The brake control unit 93 controls the brakes. The steering control unit 94 controls the steering wheel. The display control unit 95 controls displays such as meters and warning lights. The sound control unit 96 controls sounds such as alarms and voices generated from speakers. The light control unit 97 controls various lights mounted on the vehicle.

[0032] The HVAC control unit 98 controls the vehicle air conditioner. HVAC is an abbreviation for Heating Ventilation and Air-Conditioning. The seat control unit 99 controls the electric seat of the vehicle.

[0033] The various functions of the multiple ECUs 10 and the center 35 are realized by the CPUs 11 to 36 executing the programs stored in the non-transitional physical recording medium. In this example, the memories 12 to 37 are equivalent to the non-transitional physical recording medium storing the programs. In addition, by executing the programs, the method corresponding to the programs is executed. In addition, the non-transitional physical recording medium means the recording medium other than electromagnetic waves. In addition, the number of microcomputers constituting the multiple ECUs 10 and the center 35 can be one or more.

[0034] ECUA10 among the plurality of ECUs 10 realizes functions as applications (hereinafter, applications) 61, 62 and a processing unit 71 by executing a program. ECUB15 realizes functions as an application 63. Center 35 realizes functions as an application 64.

[0035] Applications 61 to 64 are programs for providing services to vehicle users. Applications 61 to 64 indirectly send instructions to controlled objects to cause them to operate, thereby providing functions that are beneficial to users. These applications 61 to 64 can be installed in ECU A 10, ECU B 15, or center 35.

[0036] More specifically, the applications 61 to 64 are configured to generate a first instruction, which is an instruction that does not specify the control units 91 to 99 described later, to the processing unit 71. In addition, the "instruction" includes instructions such as action requests, instructions such as arguments, function calls, etc. in the data used by the processing unit 71. The "instruction" may also include priority information indicating which instruction should be processed first.

[0037] Applications 61 to 64 are not programs made specifically for vehicle models, grades, etc., but are general programs that can correspond to many vehicle models, grades, etc. Therefore, applications 61 to 64 cannot determine how the vehicle on which they are installed controls the controlled object. Therefore, applications 61 to 64 output the control amount of the specific controlled object, in other words, the instructions that the output processing unit 71 uses without specifying the control units 91 to 99. On the other hand, applications 61 to 64 generate the desired abstract action content. For example, applications 61 to 64 only indicate the action content of lighting a light, and do not include which specific light is lit in the action content.

[0038] Hereinafter, at least one of the applications 61 to 64 will also be referred to as a service application 6 .

[0039] The processing unit 71 has a program specially made for the vehicle type, grade, etc., different from the applications 61 to 64. That is, the processing unit 71 has a program that absorbs the difference in vehicle type, grade, etc., so that the applications 61 to 64 do not need to be aware of the difference in vehicle type, grade, etc.

[0040] The processing unit 71 is mounted on the ECU A 10. The processing unit 71 receives instructions (hereinafter referred to as first instructions) from a plurality of applications 61 to 64 mounted on the ECU A 10 as itself, the ECU B 15 as another ECU, and the center 35.

[0041] The processing unit 71 is also a program for controlling the controlled object. For example, the processing unit 71 calculates the movement amount of the actuator as the controlled object, and sends the instruction (hereinafter, the second instruction) containing the movement amount to various control units 91 to 99. That is, the processing unit 71 includes the cooperation control unit 73, the functional module group 50, the acceptance determination unit 75, and the output control unit 77.

[0042] Here, if the first instruction is input from the plurality of applications 61 to 64, the cooperation control unit 73 selects the controlled object to be controlled according to the first instruction and outputs the first instruction to the functional module group 50. The cooperation control unit 73 may also coordinate the first instructions when the first instructions are input from the plurality of applications 61 to 64 at the same time. The cooperation control unit 73 outputs the first instruction determined to be executable as a result of the coordination to the functional module group 50.

[0043] The acceptance determination unit 75 determines whether the first instruction complies with the user's intention based on the instruction from the cooperation control unit 73. If the acceptance determination unit 75 determines that the first instruction does not comply with the user's intention, the output control unit 77 does not output the second instruction corresponding to the first instruction from the output units 51 to 59 to each ECU 41 to 49. In this case, the output control unit 77 may not output the first instruction from the cooperation control unit 73 to the functional module group 50.

[0044] In addition, the functional module group 50 includes output units 51 to 59, which convert the first instruction input from the cooperative control unit 73 into a specific second instruction and output it to the ECUs 41 to 49 of the corresponding control units 91 to 99. The output units 51 to 59 output the second instruction that specifies the control parameters, operation amount, etc. of the controlled object to the corresponding ECUs 41 to 49.

[0045] For example, when the cooperative control unit 73 receives a first instruction to light a lamp from the applications 61 to 64, it determines a specific controlled object such as which lamp to light, and outputs it to the functional module group 50. Then, in the functional module group 50, the output units 51 to 59 set the lighting mode of the lamp (for example, the interval when flashing, etc.) according to the first instruction, and outputs it to the control units 91 to 99 as a second instruction to light the lamp.

[0046] The processing unit 71 is also a program for sending data obtained from sensors and the like to the service application 6. In other words, the processing unit 71 realizes the function of "state recognition" and the function of "equipment control". In the state recognition function, the sensor data obtained from each control unit 91 to 99 described later is converted into a form suitable for the processing unit 71. In the equipment control function, the driving instruction from the processing unit 71 is distributed to each control unit 91 to 99.

[0047] The state recognition function realizes a function of classifying individual sensor raw data acquired from vehicle sensors into data for each sensing object that can be easily used by the service application 6. In addition, the data is integrated and converted into information with a higher degree of abstraction.

[0048] For example, in the state recognition function, each control unit 91 to 99 obtains individual information such as vehicle speed 0 km / h, gear position P, and no driver in the vehicle, and outputs that the vehicle is parked based on this information. This information is transmitted to the service application 6.

[0049] For example, when the service application 6 requests to find the vehicle, the processing unit 71 may also summarize the responses to the control requests for the lights and the horn, that is, the ACK from the lights and the ACK from the horn, into one action result and respond to the service application 6. In addition, finding the vehicle is a function of an application that makes it easy to understand the location of the vehicle in a parking lot, etc. and informs the user.

[0050] In addition, in the equipment control function, as described above, in order to realize the vehicle action request from the service application 6, the best control units 91 to 99 (for example, engine, steering wheel, gear, door, window, air conditioner, etc.) are selected. In addition, the data is converted into a format that can be accepted by each control unit 91 to 99, and the data is distributed in consideration of the order in which it is sent.

[0051] For example, if the vehicle behavior request is "turn the vehicle at 200 m to the left while accelerating at 0.3 G", the equipment control function outputs "request to output 1000 Nm to the engine and request to output -0.1 rad to the steering wheel".

[0052] For example, suppose the vehicle action request is "move to parking state". In this case, in the equipment control function, "request to set the gear to P, request to turn off the air conditioner, request to close all windows, request to move the doors to the locked parking state if the left request is completed and there is no occupant" is output.

[0053] [1-3. Processing]

[0054] Next, use Figure 3 The flowchart of FIG. 7 illustrates the basic processing performed by the processing unit 71 to realize the functions of the receiving determination unit 75 and the output control unit 77. In this processing, a series of processes are described when a hazard warning action request is received from the service application 6. The service application 6 in this processing is, for example, an application related to finding a vehicle that notifies the user of the location of the vehicle by flashing the hazard warning lights.

[0055] First, in S101 , the processing unit 71 determines whether a new first command is input from the service application 6 .

[0056] When it is determined in S101 that a new first command has been input from the service application 6 , the processing unit 71 proceeds to S102 .

[0057] On the other hand, when it is determined in S101 that a new first command has not been input from the service application 6 , the processing unit 71 repeats S101 .

[0058] In S102 , the processing unit 71 determines whether the new first command is a command indicating a danger warning operation request.

[0059] When it is determined in S102 that the new first command is a command indicating a danger warning operation request, the processing unit 71 proceeds to S103 .

[0060] On the other hand, when it is determined in S102 that the new first command is not a command indicating a danger warning operation request, the processing unit 71 returns to S101 .

[0061] In S103, processing unit 71 executes processing as acceptance determination unit 75 to determine whether the first instruction complies with the user's intention. Specifically, processing unit 71 determines whether the first instruction complies with the user's intention based on at least one of vehicle equipment, vehicle state, and vehicle environment.

[0062] “Following the user's intention” means that a state in which the user's safety is ensured, the user does not feel uneasy, the user is more comfortable, the vehicle can run smoothly, etc. can be maintained, or a transition to such a state can be made.

[0063] Regarding whether the first instruction complies with the user's intention, the viewpoints of "timing" and "content" may also be included. The viewpoint of "timing" refers to the viewpoint of determining whether it is an inappropriate time to execute the first instruction. The viewpoint of "content" refers to the viewpoint of determining whether the scene in which the first instruction is executed will cause a contradiction or cause discomfort to the user.

[0064] The situation in which a contradiction occurs when the first instruction is executed refers to a situation in which, assuming that the first instruction is executed, a state before the first instruction is executed is shifted to a completely opposite state. For example, as described later in another embodiment (2a), a situation in which the first instruction to start cooling is input while the heating is on, or a situation in which the first instruction to close the side window is input even though the side window opening button is pressed.

[0065] Here, for example, if the battery level decreases and there is a possibility that the vehicle cannot be driven if the application is executed, it is determined that the user's intention is not followed. In addition, if the vehicle search function is not needed and the lighting of the hazard warning lights is not appropriate, such as when the vehicle is driving, it is also determined that the user's intention is not followed. In addition, when other applications for opening the vehicle door are implemented, for example, when the vehicle door is not appropriate to open, such as when the vehicle is driving at high speed on a highway, it is determined that the user's intention is not followed.

[0066] The vehicle equipment indicates the equipment in the vehicle equipped with the vehicle control system 1. For example, the vehicle equipment includes the voltage value of the device, the power supply status of the device, etc. The vehicle status indicates the status of the interior of the vehicle equipped with the vehicle control system 1. For example, the vehicle status includes the status of various switches, the temperature inside the vehicle, etc. The vehicle environment indicates the environment around the vehicle equipped with the vehicle control system 1. For example, the vehicle environment includes information on weather and time period, etc. In addition, the processing unit 71 may also determine whether the first instruction complies with the user's intention based on two or more information among the vehicle equipment, the vehicle status, and the vehicle environment.

[0067] In this embodiment, the processing unit 71 determines whether the hazard warning operation request complies with the user's intention based on the vehicle equipment. If it is determined in S103 that the first command complies with the user's intention, the processing unit 71 moves to S104 and activates the hazard warning lights.

[0068] That is, in S104, one or more control units 91 to 99 that are most suitable for operating the hazard warning lights are selected, and the data are converted into a format that can be accepted by each control unit 91 to 99, and the data are distributed in consideration of the order in which they are to be transmitted.

[0069] On the other hand, if it is determined in S103 that the first command does not follow the user's intention, the processing unit 71 moves to S105. That is, if it is determined in S103 that the first command does not follow the user's intention, the processing unit 71 does not output the second command based on the first command.

[0070] In S104, the processing unit 71 activates the hazard warning lights. At this time, the processing unit 71 can operate the application for activating the hazard warning lights. As a result, the processing unit 71 can output the second command based on the first command to the operation control unit for controlling the controlled object.

[0071] Each control unit 91 to 99 is equipped with an action control unit for causing the controlled object to act, and each control unit 91 to 99 that receives an action instruction executes the action control unit. That is, the memory of each ECU 41 to 49 as each action control device stores an action control program constituting each control unit 91 to 99, and the program is executed by the CPU.

[0072] In this embodiment, the processing unit 71 outputs a second instruction based on the first instruction to the light control unit 97 for controlling various lights. Specifically, the processing unit 71 outputs a "request to flash the headlights and taillights" as the second instruction. The light control unit 97 performs motion control of the controlled object based on the second instruction. Then, the processing unit 71 ends this processing.

[0073] In S105 , processing unit 71 determines whether a notification inquiring whether to execute the application that output the first instruction has been output.

[0074] When it is determined in S105 that a notification inquiring whether to execute the application outputting the first instruction has been output, the processing unit 71 moves to S106 .

[0075] However, if the conditions when the user was previously queried are different from the current conditions, the processing unit 71 may query again. This is because even if the user has already responded to whether the application can be executed, the user may want to select a different response from the previous response depending on the conditions (e.g., whether the vehicle is moving or stopped, the surrounding brightness, etc.).

[0076] Therefore, even when it is determined that a notification inquiring whether to execute the application outputting the first instruction has been output, if it is determined in S105 that the comparison condition and the permission condition do not match, the processing unit 71 moves to S107.

[0077] In more detail, the processing unit 71 determines whether the comparison condition is consistent with the permission condition. The comparison condition is at least one of the vehicle equipment, vehicle state, and vehicle environment when the first instruction related to the application is input. In this embodiment, the information of the vehicle equipment in this processing cycle is equivalent to the comparison condition. The permission condition is at least one of the vehicle equipment, vehicle state, and vehicle environment when the application that outputs the first instruction is allowed to be executed by the user. The permission condition is stored in the memory 12. In this embodiment, in the past processing cycle, the information of the vehicle equipment stored in the memory 12 in S106 is equivalent to the permission condition.

[0078] That is, when it is determined in S105 that the comparison condition and the permission condition do not match, the processing unit 71 again inquires of the user whether to execute the first command.

[0079] On the other hand, when it is determined in S105 that a notification inquiring whether to execute the application outputting the first command has not been output, the processing unit 71 moves to S107.

[0080] In S106, the processing unit 71 determines whether the user permits the application that outputs the first instruction to be executed. In this embodiment, the processing unit 71 determines whether the user permits the danger warning action.

[0081] If it is determined in S106 that the user permits the application that outputs the first instruction to be executed, the processing unit 71 stores the conditions for permitting, i.e., the permitting conditions, in the memory 12. Then, the processing unit 71 moves to S104. That is, if the user permits the application to be executed in response to the inquiry, the processing unit 71 permits the output of the second instruction based on the first instruction regardless of the determination result in S103. In addition, even if the processing unit 71 determines in S105 that the comparison condition is consistent with the permitting condition, it determines in S106 that the user permits the application that outputs the first instruction to be executed.

[0082] On the other hand, when it is determined in S106 that the user does not permit execution of the application that outputs the first command, processing unit 71 does not execute the application that outputs the first command and ends the present process.

[0083] In S107, the processing unit 71 notifies the user of the content that the application that outputs the first instruction cannot be executed, and also inquires the user whether to execute the application that outputs the first instruction. At the same time, the processing unit 71 also notifies the reason why the application that outputs the first instruction cannot be executed. Then, the processing unit 71 ends the present processing. Here, the processing unit 71 may also use different means of notifying the user depending on the situation. For example, in a case where the user is not riding in a vehicle and operates the execution of an application from outside the vehicle using a portable terminal such as a smartphone, the processing unit 71 may also display a notification on the display screen of the portable terminal. In addition, for example, in a case where the user is riding in a vehicle and operates the execution of an application using a vehicle-mounted device, the processing unit 71 may also display a notification on the vehicle-mounted display.

[0084] Here, even if it is determined in S105 that a notification asking whether to execute the application outputting the first instruction has not been output, the processing unit 71 skips the processing of S107 if the application is set in advance not to notify. The notification setting processing for setting whether to inquire the user for the application will be described in detail later.

[0085] [1-4. Notification setting process]

[0086] use Figure 4 The flowchart of FIG. 7 will explain the notification setting process executed by the processing unit 71. This process is executed when an application is newly added.

[0087] First, in S201 , the processing unit 71 determines whether a new application has been added.

[0088] When it is determined in S201 that a new application has been added, the processing unit 71 proceeds to S202 .

[0089] On the other hand, when it is determined in S201 that a new application has not been added, the processing unit 71 repeats S201.

[0090] In S202, the processing unit 71 displays a notification setting screen on the monitor, for example. In the notification setting screen, various settings can be made for the application determined to be newly added in S201. For example, it can be set whether to inquire in the above-mentioned S105, that is, it can be set whether to inquire the user whether to execute the action when there is an action request at a timing that may not comply with the user's intention.

[0091] Next, in S203 , processing unit 71 determines whether there is an input from the notification setting screen.

[0092] When it is determined in S203 that there is an input from the notification setting screen, processing unit 71 moves to S204.

[0093] On the other hand, when it is determined in S203 that no input has been made from the notification setting screen, the processing unit 71 skips the process of S204 and ends the present notification setting process.

[0094] In S204, processing unit 71 sets the presence or absence of an inquiry input from the notification setting screen. Then, processing unit 71 ends this notification setting process.

[0095] The method of setting whether to inquire is not limited to the method using the notification setting screen. For example, the processing unit 71 may receive the setting content of whether to inquire using a communication device such as a portable terminal of the user, and may set whether to inquire based on the setting content.

[0096] [1-5. Effect]

[0097] According to the embodiments described in detail above, the following effects can be obtained.

[0098] (1a) If it is determined in S103 that the first command does not comply with the user's intention, the processing unit 71 does not proceed to S104 and does not output the second command based on the first command. With such a configuration, it is possible to suppress the execution of an application irrespective of the user's intention.

[0099] (1b) The processing unit 71 determines whether the first instruction complies with the user's intention based on at least one of the vehicle equipment, the vehicle state, and the vehicle environment. According to such a structure, the user's intention is determined based on the information of the vehicle equipment, the vehicle state, and the vehicle environment of the vehicle used by the user, so that the user's intention can be appropriately determined.

[0100] (1c) In S107, the processing unit 71 notifies the user of the content that the application outputting the first instruction cannot be executed, and furthermore inquires the user whether to execute the application outputting the first instruction. Furthermore, in the case where the user permits the execution of the application in response to the inquiry, the processing unit 71 permits the output of the second instruction based on the first instruction regardless of the determination result based on S103. According to such a structure, the user can know the content that the application cannot be executed. In addition, the user's intention can be reflected as to whether to execute the application.

[0101] (1d) When the processing unit 71 determines in S105 that the comparison condition is consistent with the permission condition, it determines in S106 that the user has permitted the application that outputs the first instruction to execute, and outputs the second instruction based on the first instruction without asking the user. According to such a structure, when it is not necessary to confirm the user's intention again, by not notifying the user, it is possible to prevent the user from feeling troubled.

[0102] (1e) When the processing unit 71 determines in S105 that the comparison condition and the permission condition do not match, it inquires the user again whether to execute the first command. With this configuration, when the situation has changed since the last time the user permitted the application to be executed, the user's intention can be confirmed again.

[0103] (1f) Processing unit 71 also notifies the reason why the application outputting the first command cannot be executed in S107. With such a configuration, the user can know the reason why the application outputting the first command cannot be executed, and the user can determine whether to execute the application taking into account the reason.

[0104] (1g) When adding an application, the processing unit 71 can set whether to inquire the user whether the application can be executed. Moreover, even if it is determined in S105 that a notification inquiring whether to execute the application that output the first instruction has not been output, if the application is pre-set to not notify, the processing unit 71 skips the processing of S107 and can change it to not notify. According to such a structure, it is possible to set whether the notification is appropriate. For example, with respect to pursuing real-time performance, an application that may have performance degradation if it waits for a response to the notification to execute can be set to not inquire.

[0105] [2. Other embodiments]

[0106] As mentioned above, although embodiment of this disclosure was described, this disclosure is not limited to the said embodiment, It is a matter of course that various forms can be adopted.

[0107] (2a) In the above embodiment, a series of processes are described in the case where a hazard warning action request is received from the service application 6. Furthermore, an example is given in which, for example, when the vehicle is in motion and the vehicle search function is not required, and when the lighting of the hazard warning lights is inappropriate and undesirable, it is determined that the user's intention is not followed. That is, in the above embodiment, an example is given in which the first instruction is input at a timing not intended by the user. However, the request received from the service application 6 is not limited to the hazard warning action request. For example, the case in which an air conditioning action request is received from the service application 6 is described in which the first instruction with content not desired by the user is input. In the following, only the differences from the processing in the case in which a hazard warning action request is received from the service application 6 are described.

[0108] In S102, processing unit 71 determines whether the new first command is a command indicating an air conditioning operation request. If it is determined in S102 that the new first command is a command indicating an air conditioning operation request, processing unit 71 proceeds to S103.

[0109] On the other hand, when it is determined in S102 that the new first command is not a command indicating an air-conditioning operation request, the processing unit 71 returns to S101.

[0110] In S103, the processing unit 71 determines whether the air conditioning operation request complies with the user's intention based on the vehicle state. More specifically, the processing unit 71 determines whether the air conditioning operation request complies with the user's intention based on the state of the air conditioning switch and the temperature in the vehicle. For example, when the air conditioning switch is in the heating mode and the temperature in the vehicle is 26 degrees and an air conditioning operation request is input to switch to the cooling mode set to 18 degrees, the processing unit 71 determines that the air conditioning operation request does not comply with the user's intention.

[0111] If it is determined in S103 that the air conditioning operation request complies with the user's intention, the processing unit 71 proceeds to S104. On the other hand, if it is determined in S103 that the air conditioning operation request does not comply with the user's intention, the processing unit 71 proceeds to S105.

[0112] In S104, the processing unit 71 outputs a second command based on the first command to the HVAC control unit 98 for controlling the air conditioner. The HVAC control unit 98 performs motion control of the controlled object based on the second command.

[0113] (2b) In the above embodiment, the processing unit 71 determines whether the first instruction complies with the user's intention in S103. Figure 3 As indicated by the middle dotted line, the processing unit 71 may execute the process of S301 before the process of S103.

[0114] In more detail, the processing unit 71 may also perform the processing as a safety determination unit to determine whether the safety of the vehicle is maintained when the first instruction is received in S301. At this time, the processing unit 71 may also determine whether the safety of the vehicle is maintained when the first instruction is received based on at least one of the vehicle equipment, the vehicle state, and the vehicle environment.

[0115] Here, "maintaining the safety of the vehicle" is to prioritize the safety of the user, and the processing unit 71, for example, rejects the first instruction to open the door when the vehicle is traveling at a speed of 100 km / h. The processing unit 71 may also move to S103 to determine whether the first instruction complies with the user's intention when it determines in S301 that the safety of the vehicle is maintained when the first instruction is received.

[0116] On the other hand, the processing unit 71 may also skip the subsequent processing and end the processing if it is determined in S301 that the safety of the vehicle is not maintained when the first instruction is received. According to such a structure, it is possible to consider both the safety of the vehicle and the intention of the user to determine whether to accept the first instruction. Therefore, the application can be executed more safely and in accordance with the user's intention. In addition, the processing of S301 is a process that separates part of the processing of S103. In the above embodiment, the processing of S301 may also be included in the processing of S103.

[0117] (2c) In the above embodiment, the processing unit 71 determines whether the first instruction complies with the user's intention in S103. Figure 5 As shown, the processing unit 71 may determine whether the first command is a determination target to be determined by S103 as the acceptance determination unit by executing the process of S401 before the process of S103.

[0118] The determination process of S401 is equivalent to the process of the determination object determination unit of the present disclosure. Moreover, in this determination process, for example, depending on whether the first instruction is a data acquisition instruction for state recognition, the type of the first instruction or the application 61 to 64 to which the first instruction is input, etc., it is sometimes not necessary to determine whether the first instruction is appropriate in S103.

[0119] Therefore, in Figure 5 In the determination process of S401, it is determined whether the first instruction becomes the determination object in S103 according to the instruction content, type, etc. of the first instruction. In S401, if the first instruction is not the determination object, the processing of S103 is not executed and moves to S104.

[0120] As a result, for example, regarding the first instruction from a safety-related application or an application requiring real-time performance, the determination process of S103 is not executed, and control such as the danger warning operation of S104 can be implemented, thereby improving the safety of control.

[0121] (2d) The multiple ECUs 10 and the methods thereof described in the present disclosure may also be implemented by a dedicated computer, which is provided by a processor and a memory programmed to implement one or more functions embodied by a computer program. Alternatively, the multiple ECUs 10 and the methods thereof described in the present disclosure may also be implemented by a dedicated computer provided by a processor constituted by one or more dedicated hardware logic circuits. Alternatively, the multiple ECUs 10 and the methods thereof described in the present disclosure may also be implemented by one or more dedicated computers, which are composed of a combination of a processor and a memory programmed to implement one or more functions, and a processor constituted by one or more hardware logic circuits. In addition, a computer program may also be stored as an instruction executed by a computer in a non-transitional tangible recording medium that can be read by a computer. In the method for implementing the functions of each part included in multiple ECUs 10 and the like, it is not necessarily necessary to include software, and all of its functions may also be implemented using one or more hardware.

[0122] (2e) Multiple functions of one component in the above-mentioned embodiment can be realized by multiple components, or one function of one component can be realized by multiple components. In addition, multiple functions of multiple components can be realized by one component, or one function realized by multiple components can be realized by one component. In addition, part of the structure of the above-mentioned embodiment can be omitted. In addition, at least part of the structure of the above-mentioned embodiment can be added to or replaced with the structure of other above-mentioned embodiments.

[0123] (2f) In addition to the above-mentioned vehicle control system 1, the present disclosure can also be implemented in various ways such as ECU10 etc. which is a component of the vehicle control system 1, a vehicle control program for enabling a computer to function as the ECU10 etc., a non-transitional physical recording medium such as a semiconductor memory which records the program, a vehicle control method, etc.

[0124] [Technical ideas disclosed in this specification]

[0125] [Item 1] A vehicle control device, configured to be mounted on a vehicle and to control the vehicle, wherein:

[0126] The vehicle control device comprises a cooperation control unit (73), wherein the cooperation control unit (73) is configured to realize cooperation between applications (61, 62, 63, 64) and functional modules (50), wherein the applications are configured to provide services to the vehicle, and the functional modules are configured to execute predetermined processing in the vehicle.

[0127] The functional module comprises an output unit (51-59), wherein the output unit (51-59) is configured to convert a first instruction transmitted from the application in a form independent of the vehicle into a second instruction in a form dependent on the vehicle, and output the second instruction to an action control unit (91-99) for controlling a controlled object.

[0128] The cooperation control unit is configured to forward the first instruction sent from the application to the functional module.

[0129] Furthermore, the vehicle control device comprises:

[0130] an acceptance determination unit (75, S103) configured to determine whether the first instruction complies with the user's intention; and

[0131] The output control unit (77, S103) is configured to prevent the output unit from outputting the second instruction when the acceptance determination unit determines that the first instruction does not comply with the user's intention.

[0132] [Item 2] A vehicle control device according to Item 1, wherein the device is configured as follows:

[0133] The acceptance determination unit determines whether the first instruction complies with the user's intention based on at least one of vehicle equipment, vehicle status, and vehicle environment.

[0134] [Item 3] The vehicle control device according to Item 1 or Item 2, further comprising:

[0135] a notification unit (S107) configured to notify the user that the application that outputs the first instruction cannot be executed, and to inquire of the user whether to execute the application that outputs the first instruction, if the acceptance determination unit determines that the first instruction does not comply with the user's intention; and

[0136] The output permission unit (S106) permits the output unit to output the second command based on the first command regardless of the determination result of the acceptance determination unit when the execution of the application is permitted in response to the inquiry.

[0137] [Item 4] A vehicle control device according to Item 3, wherein the device is configured as follows:

[0138] The device further comprises a notification setting unit (S204), wherein the notification setting unit (S204) is configured to be able to set whether to inquire the user through the notification unit when adding the application.

[0139] The notification unit changes whether to inquire the user according to a setting of the notification setting unit.

[0140] [Item 5] A vehicle control device according to Item 3 or Item 4, wherein the device is configured as follows:

[0141] Also available:

[0142] a storage unit (S106) configured to store in a memory at least one of vehicle equipment, vehicle state, and vehicle environment as a permission condition when the application outputting the first instruction is permitted by the user in response to the inquiry of the notification unit; and

[0143] A consistency determination unit (S105) is configured to determine whether at least one comparison condition of the vehicle equipment, the vehicle state, and the vehicle environment when the first instruction related to the application is input is consistent with the permission condition after the permission condition is stored.

[0144] When the match determination unit determines that the comparison condition matches the permission condition, the notification unit does not inquire the user, and the output permission unit permits the output unit to output the second command based on the first command.

[0145] [Item 6] A vehicle control device according to Item 5, wherein the device is configured as follows:

[0146] When the consistency determination unit determines that the comparison condition and the permission condition do not match,

[0147] The notification unit again inquires the user whether to execute the first instruction.

[0148] [Item 7] A vehicle control device according to any one of Items 3 to 6, wherein the device is configured as follows:

[0149] The notification unit further notifies the user of the reason why the application outputting the first command cannot be executed.

[0150] [Item 8] A vehicle control device according to any one of Items 1 to 7, wherein the device is configured as follows:

[0151] The acceptance determination unit further includes a safety determination unit (S301), and the safety determination unit (S301) determines whether the safety of the vehicle is maintained when the first instruction is received.

[0152] When the safety determination unit determines that the safety of the vehicle is maintained when the first command is received, the acceptance determination unit determines whether the first command complies with the user's intention.

[0153] [Item 9] A vehicle control device according to any one of Items 1 to 8, wherein the device is configured as follows:

[0154] The acceptance determination unit further includes a determination target determination unit (S401), and the determination target determination unit (S401) determines whether the first instruction sent from the application is a determination target based on the acceptance determination unit.

[0155] When the determination target determination unit determines that the first command is the determination target, the acceptance determination unit determines whether the first command complies with the user's intention.

[0156] [Item 10] A vehicle control system comprising: a plurality of electronic control devices (41 to 49) for controlling a controlled object as equipment of a vehicle; and a vehicle control device (10) connected to the plurality of electronic control devices so as to be communicable therewith, wherein the configuration is as follows:

[0157] The vehicle control device comprises a cooperation control unit (73), wherein the cooperation control unit (73) is configured to realize cooperation between an application (61, 62, 63, 64) and a functional module (50), wherein the application is configured to provide a service to the vehicle, and the functional module is configured to execute a predetermined process in the vehicle.

[0158] The functional module comprises an output unit (52), the output unit (52) being configured to convert a first instruction sent from the application into a second instruction and output the second instruction to the electronic control device for controlling the controlled object, the first instruction being expressed in a form independent of the vehicle, and the second instruction being expressed in a form dependent on the vehicle.

[0159] The cooperation control unit is configured to forward the first instruction sent from the application to the functional module.

[0160] Furthermore, the vehicle control device comprises:

[0161] an acceptance determination unit (75, S103) configured to determine whether the first instruction complies with the user's intention; and

[0162] The output control unit (77, S103) is configured to prevent the output unit from outputting the second instruction when the acceptance determination unit determines that the first instruction does not comply with the user's intention.

[0163] The at least one electronic control device includes an object control unit (91-99), and the object control unit (91-99) receives the second instruction and controls the controlled object.

[0164] [Item 11] An acceptance determination method is implemented by a vehicle control device configured to be mounted on a vehicle and to control the vehicle, wherein:

[0165] The above acceptance determination method includes:

[0166] If a first instruction is input from the application, a second instruction based on the first instruction is output to the motion control unit for controlling the controlled object (S104);

[0167] Determining whether the first instruction complies with the user's intention (S103);

[0168] If it is determined that the first command does not comply with the user's intention, the second command is not output ( S103 ).

[0169] [Item 12] A program for causing a computer mounted on a vehicle to implement the following functions:

[0170] If a first instruction from the application is input, a second instruction based on the first instruction is output to the function of the motion control unit for controlling the controlled object (S104);

[0171] A function for determining whether the first instruction complies with the user's intention (S103);

[0172] When it is determined that the first command does not comply with the user's intention, a function of not outputting the second command is performed ( S103 ).

Claims

1. A vehicle control device, configured to be mounted on a vehicle and control the vehicle, wherein: The vehicle control device comprises a cooperation control unit (73), the cooperation control unit (73) being configured to realize cooperation between an application (61, 62, 63, 64) and a functional module (50), the application being configured to provide a service to the vehicle, and the functional module being configured to execute a predetermined process in the vehicle, The functional module includes an output unit (51-59), the output unit (51-59) is configured to convert a first instruction sent from the application into a second instruction and output the second instruction to an action control unit (91-99) for controlling a controlled object, the first instruction being expressed in a form independent of the vehicle, and the second instruction being expressed in a form dependent on the vehicle, The cooperation control unit is configured to forward the first instruction sent from the application to the functional module, Furthermore, the vehicle control device further comprises: an acceptance determination unit (75, S103) configured to determine whether the first instruction complies with the user's intention; and The output control unit (77, S103) is configured to prevent the output unit from outputting the second command when the acceptance determination unit determines that the first command does not comply with the user's intention.

2. The vehicle control device according to claim 1, wherein: It is composed of The acceptance determination unit determines whether the first instruction complies with the user's intention based on at least one of vehicle equipment, vehicle status, and vehicle environment.

3. The vehicle control device according to claim 1 or 2, wherein: Also available: a notification unit (S107) configured to notify the user that the application outputting the first instruction cannot be executed, and to inquire the user whether to execute the application outputting the first instruction, if the acceptance determination unit determines that the first instruction does not comply with the user's intention; and The output permission unit (S106) permits the output unit to output the second instruction based on the first instruction regardless of the determination result of the acceptance determination unit when the execution of the application is permitted in response to the inquiry.

4. The vehicle control device according to claim 3, wherein: It is composed of The system further comprises a notification setting unit (S204), wherein the notification setting unit (S204) is configured to be able to set whether to query the user through the notification unit when adding the application. The notification unit changes whether to inquire the user according to the setting of the notification setting unit.

5. The vehicle control device according to claim 3, wherein: The structure further comprises: a storage unit (S106) configured to store in a memory at least one of vehicle equipment, vehicle state, and vehicle environment as a permission condition when the user permits execution of the application outputting the first instruction in response to the inquiry of the notification unit; and a consistency determination unit (S105) configured to determine whether at least one comparison condition of the vehicle equipment, the vehicle state, and the vehicle environment when the first instruction related to the application is input is consistent with the permission condition after the permission condition is stored, When the match determination unit determines that the comparison condition matches the permission condition, the notification unit does not inquire the user, and the output permission unit permits the output unit to output the second command based on the first command.

6. The vehicle control device according to claim 5, wherein: It is composed of When the consistency determination unit determines that the comparison condition and the permission condition do not match, The notification unit inquires the user again whether to execute the first instruction.

7. The vehicle control device according to claim 3, wherein: It is composed of The notification unit further notifies a reason why the application that outputs the first instruction cannot be executed.

8. The vehicle control device according to claim 1 or 2, wherein: It is composed of The acceptance determination unit further includes a safety determination unit (S301) for determining whether the safety of the vehicle is maintained when the first instruction is received. When the safety determination unit determines that the safety of the vehicle is maintained when the first instruction is received, the acceptance determination unit determines whether the first instruction complies with the user's intention.

9. The vehicle control device according to claim 1 or 2, wherein: It is composed of The acceptance determination unit further includes a determination target determination unit (S401) for determining whether the first instruction sent from the application is a determination target of the acceptance determination unit. When the determination target determination unit determines that the first instruction is the determination target, the acceptance determination unit determines whether the first instruction complies with the user's intention.

10. A vehicle control system comprising: a plurality of electronic control devices (41-49) for controlling a controlled object as equipment of a vehicle; and a vehicle control device (10) connected to the plurality of electronic control devices in a communicable manner, wherein: It is composed of The vehicle control device comprises a cooperation control unit (73), the cooperation control unit (73) being configured to realize cooperation between an application (61, 62, 63, 64) and a functional module (50), the application being configured to provide a service to the vehicle, and the functional module being configured to execute a predetermined process in the vehicle, The functional module comprises an output unit (52), the output unit (52) being configured to convert a first instruction sent from the application into a second instruction and output the second instruction to the electronic control device for controlling the controlled object, the first instruction being expressed in a form independent of the vehicle, and the second instruction being expressed in a form dependent on the vehicle, The cooperation control unit is configured to forward the first instruction sent from the application to the functional module, Furthermore, the vehicle control device further comprises: an acceptance determination unit (75, S103) configured to determine whether the first instruction complies with the user's intention; and an output control unit (77, S103) configured to prevent the output unit from outputting the second instruction when the acceptance determination unit determines that the first instruction does not comply with the user's intention, At least one of the electronic control devices includes an object control unit (91-99), and the object control unit (91-99) receives the second instruction and controls the controlled object.

11. An acceptance determination method, the acceptance determination method being implemented by a vehicle control device configured to be mounted on a vehicle and to control the vehicle, wherein: The acceptance determination method comprises: If a first instruction is input from the application, a second instruction based on the first instruction is output to the motion control unit for controlling the controlled object (S104); Determining whether the first instruction complies with the user's intention (S103); If it is determined that the first instruction does not comply with the user's intention, the second instruction is not output ( S103 ).

12. A program for causing a computer mounted on a vehicle to implement the following functions: If a first instruction from the application is input, a second instruction based on the first instruction is output to the function of the motion control unit for controlling the controlled object (S104); Determining whether the first instruction complies with the user's intention (S104); If it is determined that the first instruction does not comply with the user's intention, the function of the second instruction is not output ( S104 ).

Images