Vehicle control system, vehicle manufacturing method, program, and information processing device

Abstract

Provided is a vehicle control system that secures safety by invalidating a remote or automatic vehicle control function while executing remote or automatic vehicle control. A vehicle control system (100) is provided with: a vehicle (101) provided with a communication terminal (102) having a communication function; an ECU (103) mounted in the vehicle and configured to execute driving control of the vehicle using communication via the communication terminal; a transmission unit (104) that transmits a control instruction value used for driving control of the vehicle to the ECU via the communication terminal from outside the vehicle; and an invalidation request unit (105) that requests the ECU from outside the vehicle via the communication terminal to invalidate the driving control of the vehicle irreversibly, and after execution of the driving control, executes the invalidation of the driving control irreversibly.

Description

Technical Field

[0001] The present disclosure relates to a vehicle control system, a vehicle manufacturing method, a program, and an information processing device. Background Art

[0002] In Patent Document 1, an invention of an authentication system and an authentication method capable of ensuring high security is described. In the invention described in Patent Document 1, in the case of performing challenge-response authentication between a vehicle and a terminal, an original value of a random number is generated on the vehicle side. The original value is transformed into a first transformed random number at the vehicle, and a first authentication value is generated based on the first transformed random number value. The first authentication value on the vehicle side is sent from the vehicle to the terminal and compared with the first authentication value generated in the same manner at the terminal. In addition, the terminal transforms the original value of the random number received from the vehicle into a second transformed random number value, and generates a second authentication value based on the second transformed random number value. The second authentication value on the terminal side is sent from the terminal to the vehicle and compared with the second authentication value generated in the same manner at the vehicle. If the comparison of both the first authentication value and the second authentication value is successful, the challenge-response authentication is considered successful. Prior Art Documents Patent Documents

[0003] Patent Document 1: Japanese Unexamined Patent Application Publication No. 2021-129158 Summary of the Invention

[0004] However, in the invention of Patent Document 1, in order to generate a random number for generating an authentication value, it is required to install a true random number generator in the terminal or the in-vehicle ECU (Electronic Control Unit). In addition, when sharing a random number between the vehicle and the terminal, in order to sufficiently ensure the confidentiality of the message including the random number, security measures such as encrypting the message using a public key cryptography method are required.

[0005] Therefore, an object of the present disclosure is to provide a vehicle control system that ensures security by invalidating a remote or automatic vehicle control function while performing remote or automatic vehicle control.

[0006] The vehicle control system of the present disclosure includes: a vehicle including a communication terminal having a communication function; an ECU (Electronic Control Unit) mounted on the vehicle, which performs driving control of the vehicle using communication via the communication terminal; a transmission unit that transmits a control instruction value used for driving control of the vehicle from the outside of the vehicle to the ECU via the communication terminal; and An invalidation request unit that requests, from the outside of the vehicle via the communication terminal, the ECU to irreversibly invalidate the driving control of the vehicle. After performing the driving control, the irreversible invalidation of the driving control is performed.

[0007] According to the above configuration, it is possible to provide a vehicle control system that ensures safety by invalidating the remote or automatic vehicle control function while performing remote or automatic vehicle control.

[0008] The vehicle control system of the present disclosure is characterized in that, further, The control instruction value is communicated using CAN (Controller Area Network) communication. The invalidation of the driving control is communicated using diagnostic communication.

[0009] According to the above configuration, by differentiating the use of existing communication standards, it is possible to provide a vehicle control system that is inexpensive and relatively safe.

[0010] The vehicle control system of the present disclosure is characterized in that, further, After performing the invalidation of the driving control, the invalidation is confirmed using diagnostic communication.

[0011] According to the above configuration, it is possible to confirm the invalidation using existing communication standards.

[0012] The vehicle control system of the present disclosure is characterized in that, further, The vehicle control system performs driving control during inspection in a vehicle factory and performs invalidation before shipment.

[0013] According to the above configuration, it is possible to control the vehicle before shipment through autonomous driving.

[0014] The vehicle control system of the present disclosure is characterized in that The communication terminal is a dongle or a data communication module.

[0015] The above configuration is an example of a communication terminal in which the vehicle can communicate with a telematics device such as a server.

[0016] The vehicle control system of the present disclosure is characterized in that The communication terminal is retrieved by an operator after the invalidation of the driving control.

[0017] According to the above configuration, after shipment, communication for remote or autonomous driving cannot be performed anymore, and safety can be ensured.

[0018] The vehicle control system of the present disclosure is characterized in that The invalidation of the driving control is performed in the following manner: Burn out the circuit of the ECU; or Delete the application program stored in the ECU that performs the communication function; or Rewrite the software stored in the ECU that performs the communication function.

[0019] According to the above configuration, irreversible invalidation of the driving control can ensure safety.

[0020] The vehicle control system of the present disclosure is characterized in that The invalidation of the driving control is performed under the following circumstances: It is detected that the vehicle has reached a specified position; or An operator has performed a specified operation; or It is confirmed with reference to production management information that driving control is not required; or An invalidation instruction is received; or The vehicle has completed a specified power supply using a power supply device; or The vehicle has been packaged.

[0021] The above configuration is an example of the trigger point for the invalidation of the driving control.

[0022] The vehicle control system of the present disclosure is characterized in that The vehicle control system performs driving control based on the information of a photographing device provided in a vehicle factory, and performs the invalidation of the driving control based on the information of the actions of an operator photographed by the photographing device.

[0023] According to the above configuration, it is possible to perform driving control and perform the invalidation of the driving control using a photographing device provided in a vehicle factory for various purposes such as safety.

[0024] The vehicle control system of the present disclosure is characterized in that After performing the irreversible invalidation of the driving control, the vehicle performs a specified action.

[0025] According to the above configuration, an operator can confirm the irreversible invalidation of the driving control of the vehicle.

[0026] The vehicle control system of the present disclosure is characterized in that The specified action is: The emergency flasher is turned on; or The horn sounds; or The windshield wiper operates; or Move the wheels left and right; or A display performed on a monitor provided outside the vehicle.

[0027] The above configuration is an example of an action of a regulation for confirming invalidation of irreversible driving control.

[0028] A vehicle manufacturing method according to the present disclosure, During inspection in a vehicle factory, perform driving control of the vehicle according to a request received from outside the vehicle via a communication terminal, Before shipment, invalidate the irreversible driving control of the vehicle according to a request received from outside the vehicle via the communication terminal.

[0029] According to the above configuration, it is possible to provide a vehicle manufacturing method that ensures safety by invalidating remote or automatic vehicle control functions while performing remote or automatic vehicle control. In addition, it is possible to manufacture a vehicle by controlling the vehicle before shipment through autonomous driving.

[0030] A program according to the present disclosure causes an ECU (Electronic Control Unit) mounted on a vehicle to execute: Driving control of the vehicle according to a request received from outside the vehicle via a communication terminal; and Invalidation of the irreversible driving control of the vehicle according to a request received from outside the vehicle via the communication terminal.

[0031] According to the above configuration, it is possible to provide a program that ensures safety by invalidating remote or automatic vehicle control functions while performing remote or automatic vehicle control.

[0032] A server according to the present disclosure is an information processing device including: A transmission unit that transmits a control instruction value used for driving control of the vehicle from outside the vehicle to the ECU via a communication terminal; and An invalidation request unit that requests the ECU to irreversibly invalidate the driving control of the vehicle from outside the vehicle via the communication terminal.

[0033] According to the above configuration, it is possible to provide an information processing device that ensures safety by invalidating remote or automatic vehicle control functions while performing remote or automatic vehicle control.

[0034] According to the present disclosure, it is possible to provide a vehicle control system that ensures safety by invalidating remote or automatic vehicle control functions while performing remote or automatic vehicle control. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 is a schematic diagram of the vehicle control system related to the embodiment. Figure 2 is a block diagram showing a configuration example of the vehicle control system related to the embodiment. Figure 3 is a flowchart of the manufacturing method of the vehicle related to the embodiment. Figure 4 is a conceptual diagram showing the configuration of the system 50 in the first embodiment. Figure 5 is a block diagram showing the configuration of the system 50. Figure 6 is a flowchart showing the processing flow of the driving control of the vehicle 400 in the first embodiment. Figure 7 is an explanatory diagram showing the schematic configuration of the system 50v in the second embodiment. Figure 8 is a flowchart showing the processing flow of the driving control of the vehicle 400v in the second embodiment. Detailed Embodiment

[0036] Embodiment Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the invention described in the claims is not limited to the following embodiments. In addition, the configurations described in the embodiments are not necessarily essential as technical means for solving the problems. For the sake of clarity, the following description and drawings have been appropriately omitted and simplified. In each drawing, the same reference numerals are assigned to the same elements, and repeated descriptions are omitted as needed.

[0037] (Description of the vehicle control system related to the embodiment) Figure 1 is a schematic diagram of the vehicle control system related to the embodiment. Figure 2 is a block diagram showing a configuration example of the vehicle control system related to the embodiment. While referring to Figure 1 and Figure 2 , the vehicle control system related to the embodiment will be described.

[0038] The vehicle control system 100 is used, for example, in a vehicle manufacturing factory. When manufacturing a vehicle, it is necessary to move the vehicle remotely or automatically during inspection and invalidate the remote or automatic control before shipment. By performing remote or automatic control during inspection, unmanned operation can be achieved and it is difficult to cause human accidents. In addition, by invalidating the remote or automatic control before shipment, it is possible to prevent remote control during the use of the vehicle. According to the vehicle control system 100, it is possible to control the vehicle before shipment through autonomous driving.

[0039] As Figure 1 and Figure 2 shown, the vehicle control system 100 includes a vehicle 101, a communication terminal 102, an ECU (Electronic Control Unit) 103, a transmission unit 104, and an invalidation request unit 105.

[0040] The vehicle 101 can be used as all manufactured vehicles. The vehicle 101 is a vehicle such as a passenger car, a truck, a bus, and a construction vehicle that has been manufactured and inspected.

[0041] The communication terminal 102 is a terminal having a communication function for communicating with an external device of the vehicle. The communication terminal 102 is, for example, a wireless communication terminal such as a dongle mounted on the vehicle 101. The dongle is recovered by an operator before shipment after remote or automatic control invalidation. In addition, the communication terminal may be a data communication module (DCM (Data Communication Module)). The communication terminal 102 may also be a wired communication terminal. The communication terminal 102 can communicate using normal CAN (Controller Area Network) communication and diagnostic communication during vehicle control and inspection. CAN communication refers to a communication standard that can send and receive in multiple directions. Diagnostic communication is a communication standard in which requests and responses can be one-to-one and is used for fault diagnosis and the like.

[0042] The ECU 103 is, for example, a normal ECU such as a brake ECU mounted on the vehicle 101 and controlling the vehicle 101. The ECU 103 remotely or automatically executes vehicle driving control using communication via the communication terminal. Therefore, the ECU 103 controls the vehicle actuator according to a control instruction value via CAN communication. The control instruction value is data required for driving control such as steering angle, acceleration, map and path information for autonomous driving, and shooting. Driving control refers to control of acceleration, speed, steering angle, etc. In addition, after executing remote or automatic driving control, the ECU 103 irreversibly executes invalidation of remote or automatic driving control of the vehicle according to an instruction via diagnostic communication. Therefore, the ECU 103 includes a safety microcomputer equipped with an FPGA (Field Programmable Gate Array) and a flash memory. The ECU 103, for example, includes a hardware security module. By differentiating the use of existing communication standards, security can be improved inexpensively.

[0043] The transmitting unit 104 is an information processing device outside the vehicle, such as a PC (Personal Computer) or a server. The transmitting unit 104 transmits a control instruction value for requesting remote or automatic driving control of the vehicle from outside the vehicle 101 to the ECU 103 via the communication terminal 102. Therefore, the transmitting unit 104 transmits a control instruction value for remote or automatic driving control to the vehicle 101 via CAN communication.

[0044] The invalidation request unit 105 is an information processing device outside the vehicle, such as an electronic inspection device. The invalidation request unit 105 requests the ECU 103 from outside the vehicle 101 via the communication terminal 102 to irreversibly invalidate the remote or automatic driving control of the vehicle. Therefore, the invalidation request unit 105 requests the invalidation of the remote or automatic driving control of the vehicle 101 via diagnostic communication.

[0045] Here, the transmitting unit 104 is described as an information processing device different from the invalidation request unit 105, but it can also be the same information processing device. The information processing device can be either one information processing device or multiple information processing devices. In addition, part or all of the functions of the information processing device can be distributed in the cloud. In addition, the communication terminal 102 is described as one. However, there can also be multiple communication terminals 102, and the communication terminals are used separately according to each communication standard.

[0046] Using these devices, the vehicle control system 100 executes the irreversible invalidation of the remote or automatic driving control after executing the remote or automatic driving control. The irreversible invalidation of the driving control is achieved by burning out the circuit used in the remote or automatic driving control. To burn out the circuit, using a fuse or short-circuiting it with solder can be considered. In addition, the irreversible invalidation of the driving control can be achieved by deleting the application program for remote or automatic driving control from the software installed in the vehicle or rewriting the software installed in the vehicle.

[0047] The irreversible invalidation of the driving control can use the situation that the vehicle has reached a specified position in the process as a trigger point. The specified position refers to, for example, the position where the process in the factory ends, the position before shipment, or the position of the process where remote or automatic driving is no longer performed. The specified position can be obtained either by the information processing device or by the vehicle.

[0048] The invalidation of irreversible driving control can use the situation where the operator has performed a specified operation as a trigger point. The specified operation refers to, for example, operating the direction indicator, or when the operator makes a specified action, such as a specified posture, while being photographed by the photographing device. In this way, the specified operation of the operator can be obtained by the information processing device or by the vehicle.

[0049] The invalidation of irreversible driving control can use the situation where it is confirmed that no driving control is required by referring to the production management information as a trigger point. The production management information is information on where each vehicle is at this time. It can be that the information processing device refers to the production management information and sends an invalidation instruction from the sending unit 104.

[0050] The invalidation of irreversible driving control can use the situation where an invalidation instruction for remote or automatic driving control is received as a trigger point. For example, the sending unit 104 of the information processing device sends an invalidation instruction.

[0051] The invalidation of irreversible driving control can use the situation where the vehicle has completed a specified power supply using the power supply device as a trigger point. It can be that the photographing device records the time of entering the power supply device, and notifies the information processing device of the completion of the specified power supply according to the power supply time as a trigger point. Additionally, it can be that the vehicle monitors the SOC (State Of Charge), and uses the detected completion of the specified power supply as a trigger point.

[0052] The invalidation of irreversible driving control can use the situation where the operator has wrapped the vehicle as a trigger point. Wrapping refers to the pasting of a protective seal before vehicle delivery.

[0053] In addition, after performing the invalidation of driving control, the invalidation is confirmed using diagnostic communication. In this way, the invalidation can be confirmed using existing communication standards. Additionally, in the case where the invalidation is not achieved, the invalidation request unit 105 performs communication for invalidation again.

[0054] In addition to confirming the invalidation of driving control using diagnostic communication, the invalidation of driving control can also be visually confirmed by a person. For example, after performing the invalidation of irreversible driving control, the vehicle performs a specified action. The specified action is the lighting of the emergency flasher, or the sounding of the horn, or the operation of the windshield wiper, or the movement of the wheels to the left and right, or the display of a completion meaning on a monitor provided outside the vehicle.

[0055] The operator who has confirmed the specified action gets into the vehicle to retrieve the dongle, or starts driving towards the next destination.

[0056] In this way, it is possible to provide a vehicle remote control system that uses existing technologies and ensures safety by invalidating the remote or automatic vehicle control function while performing remote or automatic vehicle control. Therefore, it is possible to construct an inexpensive and safe system.

[0057] (Description of the vehicle manufacturing method according to the embodiment) Figure 3 It is a flowchart of the manufacturing method of the vehicle according to the embodiment. While referring to Figure 3 , the manufacturing method of the vehicle according to the embodiment will be described.

[0058] The manufacturing method of the vehicle according to the embodiment uses the vehicle control system 100. First, the vehicle 101 is controlled remotely or automatically (step S301). After the vehicle is assembled in the vehicle factory, during inspection, in response to a request from the outside of the vehicle 101 via the communication terminal 102, the vehicle is remotely or automatically driven and controlled. Therefore, the transmission unit 104 transmits the vehicle 101 control instruction value to the ECU 103 via the communication terminal 102 using CAN communication. Then, the ECU 103 receives the control instruction value. The ECU 103 implements the driving control, and the vehicle travels through remote or automatic control.

[0059] Next, the remote or automatic driving control is invalidated (step S302). Before shipment, in response to a request from the outside of the vehicle via the communication terminal, the irreversible invalidation of the remote driving control of the vehicle is performed. Therefore, when remote or automatic vehicle control is no longer required, the invalidation request unit 105 transmits an invalidation request to the ECU 103 via the communication terminal 102 using diagnostic communication. Then, the ECU 103 receives the invalidation request. Finally, the ECU 103 changes to a state where the reception of the control instruction value from the transmission unit 104 is invalidated. Thereby, safety is ensured.

[0060] In this way, it is possible to provide a manufacturing method of a vehicle that ensures safety by invalidating the remote or automatic vehicle control function while performing remote or automatic vehicle control. In addition, it is possible to manufacture a vehicle by controlling the vehicle before shipment through autonomous driving.

[0061] (Description of the system in the first embodiment) Figure 4 It is a conceptual diagram showing the configuration of the system 50 in the first embodiment. The system 50 includes one or more vehicles 400 as moving bodies, a server 200, and one or more external sensors 300.

[0062] In the present disclosure, a "mobile body" means an object capable of moving, such as a vehicle or an electric vertical take-off and landing aircraft (so-called flying car). The vehicle may be a vehicle traveling on wheels or a vehicle traveling on tracks, such as a passenger car, a truck, a bus, a two-wheeler, a four-wheeler, a tank, a construction vehicle, etc. Vehicles include battery electric vehicles (BEVs), gasoline vehicles, hybrid vehicles, and fuel cell vehicles. When the mobile body is other than a vehicle, the expressions "vehicle" and "car" in the present disclosure may be appropriately replaced with "mobile body", and the expression "travel" may be appropriately replaced with "move".

[0063] The vehicle 400 is configured to be able to travel autonomously. "Autonomous driving" means driving that does not depend on the driving operation of the occupant. The driving operation means an operation related to at least any one of "traveling", "steering", and "stopping" of the vehicle 400. Autonomous driving is achieved by automatic or manual remote control using a device located outside the vehicle 400, or by autonomous control of the vehicle 400. It is also possible to have an occupant who does not perform a driving operation in the vehicle 400 traveling autonomously. Occupants who do not perform a driving operation include, for example, a person who just sits on the seat of the vehicle 400, and a person who performs an operation different from the driving operation, such as assembly, inspection, or switch operation, while riding in the vehicle 400. In addition, driving that depends on the driving operation of the occupant is sometimes called "piloted driving".

[0064] In this specification, "remote control" includes "full remote control" that completely determines all the actions of the vehicle 400 from outside the vehicle 400 and "partial remote control" that determines a part of the actions of the vehicle 400 from outside the vehicle 400. In addition, "autonomous control" includes "full autonomous control" in which the vehicle 400 autonomously controls its own actions without receiving any information from a device outside the vehicle 400 and "partial autonomous control" in which the vehicle 400 autonomously controls its own actions using the information received from a device outside the vehicle 400.

[0065] In the present embodiment, the system 50 is used in the factory FC that manufactures the vehicle 400. The reference coordinate system of the factory FC is the global coordinate system GC. That is, any position within the factory FC is represented by the coordinates of X, Y, and Z in the global coordinate system GC. The factory FC has a first place PL1 and a second place PL2. The first place PL1 and the second place PL2 are connected by a travel road TR on which the vehicle 400 can travel. A plurality of external sensors 300 are provided along the travel road TR in the factory FC. The positions of the respective external sensors 300 in the factory FC are adjusted in advance. The vehicle 400 moves from the first place PL1 to the second place PL2 through the travel road TR by autonomous driving.

[0066] Figure 5 It is a block diagram showing the configuration of system 50. Vehicle 400 includes a vehicle control device 410 for controlling each part of vehicle 400, an actuator group 420 including one or more actuators driven under the control of vehicle control device 410, and a communication device 430 for communicating with external devices such as server 200 through wireless communication. Actuator group 420 includes an actuator of a driving device for accelerating vehicle 400, an actuator of a steering device for changing the traveling direction of vehicle 400, and an actuator of a braking device for decelerating vehicle 400.

[0067] Vehicle control device 410 is composed of a computer including a processor 411, a memory 412, an input / output interface 413, and an internal bus 414. Processor 411, memory 412, and input / output interface 413 are connected via internal bus 414 in a manner enabling two-way communication. Actuator group 420 and communication device 430 are connected to input / output interface 413. Processor 411 realizes various functions including the function as vehicle control unit 415 by executing program PG1 stored in memory 412.

[0068] Vehicle control unit 415 makes vehicle 400 travel by controlling actuator group 420. Vehicle control unit 415 can make vehicle 400 travel by using the driving control signal received from server 200 to control actuator group 420. The driving control signal is a control signal for making vehicle 400 travel. In the present embodiment, the driving control signal includes the acceleration and steering angle of vehicle 400 as parameters. In other embodiments, the driving control signal may include the speed of vehicle 400 as a parameter instead of the acceleration of vehicle 400, or may include the speed of vehicle 400 in addition to the acceleration of vehicle 400.

[0069] Server 200 is composed of a computer including a processor 201, a memory 202, an input / output interface 203, and an internal bus 204. Processor 201, memory 202, and input / output interface 203 are connected via internal bus 204 in a manner enabling two-way communication. A communication device 205 for communicating with various external devices of server 200 is connected to input / output interface 203. Communication device 205 can communicate with vehicle 400 through wireless communication and can communicate with each external sensor 300 through wired communication or wireless communication. Processor 201 realizes various functions including the function as remote control unit 210 by executing program PG2 stored in memory 202.

[0070] The remote control unit 210 obtains the detection result based on the sensor, uses the detection result to generate a driving control signal for controlling the actuator group 420 of the vehicle 400, and sends the driving control signal to the vehicle 400. Thus, the vehicle 400 is driven by remote control. Not only the driving control signal, but also the remote control unit 210 can generate and output, for example, a control signal for controlling the actuators that actuate various auxiliary machines, windshield wipers, electric windows, lights, and other various equipment provided in the vehicle 400. That is, the remote control unit 210 can also actuate such various equipment and various auxiliary machines by remote control.

[0071] The external sensor 300 is a sensor located outside the vehicle 400. The external sensor 300 in the present embodiment is a sensor that captures the vehicle 400 from outside the vehicle 400. The external sensor 300 includes a communication device (not shown) and can communicate with other devices such as the server 200 through wired communication or wireless communication.

[0072] Specifically, the external sensor 300 is composed of a camera. The camera of the external sensor 300 captures a captured image including the vehicle 400 and outputs the captured image as a detection result.

[0073] Figure 6 It is a flowchart showing the processing flow of the driving control of the vehicle 400 in the first embodiment. In Figure 6 In the processing flow, the processor 201 of the server 200 functions as the remote control unit 210 by executing the program PG2. In addition, the processor 411 of the vehicle 400 functions as the vehicle control unit 415 by executing the program PG1.

[0074] In step S1, the processor 201 of the server 200 obtains the vehicle position information of the vehicle 400 using the detection result output from the external sensor 300. The vehicle position information is the position information that forms the basis for generating the driving control signal. In the present embodiment, the vehicle position information includes the position and orientation of the vehicle 400 in the global coordinate system GC of the factory FC. Specifically, in step S1, the processor 201 obtains the vehicle position information using the captured image obtained from the camera serving as the external sensor 300.

[0075] Specifically, in step S1, the processor 201 detects the shape of the vehicle 400 from the captured image, for example, calculates the coordinates of the measurement points of the vehicle 400 in the coordinate system of the captured image, that is, the local coordinate system, and transforms the calculated coordinates into the coordinates in the global coordinate system GC, thereby obtaining the position of the vehicle 400. The shape of the vehicle 400 included in the captured image can be detected, for example, by inputting the captured image into a detection model DM using artificial intelligence. The detection model DM is prepared, for example, inside or outside the system 50 and is pre-stored in the memory 202 of the server 200. As the detection model DM, for example, a learned machine learning model learned in a manner to achieve either semantic segmentation or instance segmentation can be cited. As this machine learning model, for example, a convolutional neural network (hereinafter referred to as CNN) learned through supervised learning using a learning dataset can be used. The learning dataset has, for example, a plurality of training images including the vehicle 400 and labels indicating whether each region in the training image represents a region of the vehicle 400 or a region other than the vehicle 400. When learning the CNN, preferably, the parameters of the CNN are updated by backpropagation (error backpropagation method) in a manner to reduce the error between the output result of the detection model DM and the label. In addition, the processor 201 can obtain the orientation of the vehicle 400, for example, by using the optical flow method and making a presumption based on the orientation of the movement vector of the vehicle 400 calculated based on the position change of the feature points of the vehicle 400 between frames of the captured image.

[0076] In step S2, the processor 201 of the server 200 determines the target position that the vehicle 400 should go to next. In the present embodiment, the target position is represented by the coordinates of X, Y, and Z in the global coordinate system GC. A reference path RR, which is the path that the vehicle 400 should travel, is pre-stored in the memory 202 of the server 200. The path is represented by nodes indicating the departure point, nodes indicating waypoints, nodes indicating the destination, and links connecting the respective nodes. The processor 201 uses the vehicle position information and the reference path RR to determine the target position that the vehicle 400 should go to next. The processor 201 determines the target position on the reference path RR ahead of the current location of the vehicle 400.

[0077] In step S3, the processor 201 of the server 200 generates a driving control signal for causing the vehicle 400 to travel toward the determined target position. The processor 201 calculates the traveling speed of the vehicle 400 based on the change in the position of the vehicle 400, and compares the calculated traveling speed with the target speed. Overall, when the traveling speed is lower than the target speed, the processor 201 determines the acceleration in such a way as to accelerate the vehicle 400, and when the traveling speed is higher than the target speed, the processor 201 determines the acceleration in such a way as to decelerate the vehicle 400. In addition, when the vehicle 400 is located on the reference path RR, the processor 201 determines the steering angle and the acceleration in such a way that the vehicle 400 does not deviate from the reference path RR, and when the vehicle 400 is not located on the reference path RR, in other words, when the vehicle 400 has deviated from the reference path RR, the processor 201 determines the steering angle and the acceleration in such a way that the vehicle 400 returns to the reference path RR.

[0078] In step S4, the processor 201 of the server 200 transmits the generated driving control signal to the vehicle 400. The processor 201 repeatedly performs acquisition of the position of the vehicle 400, determination of the target position, generation of the driving control signal, transmission of the driving control signal, etc. at a prescribed cycle.

[0079] In step S5, the processor 411 of the vehicle 400 receives the driving control signal transmitted from the server 200. In step S6, the processor 411 of the vehicle 400 controls the actuator group 420 using the received driving control signal, whereby the vehicle 400 travels at the acceleration and the steering angle indicated by the driving control signal. The processor 411 repeatedly performs reception of the driving control signal and control of the actuator group 420 at a prescribed cycle. According to the system 50 in the present embodiment, the vehicle 400 can be driven by remote control, and the vehicle 400 can be moved without using conveying equipment such as a crane or a conveyor.

[0080] (Description of the system in the second embodiment) Figure 7 FIG. is an explanatory diagram showing a schematic configuration of the system 50v in the second embodiment. In the present embodiment, the system 50v is different from the first embodiment in that the server 200 is not provided. In addition, the vehicle 400v in the present embodiment can travel by autonomous control of the vehicle 400v. Regarding other configurations, unless otherwise specified, they are the same as those in the first embodiment.

[0081] In the present embodiment, the processor 411v of the vehicle control device 410v functions as a vehicle control unit 415v by executing a program PG1 stored in a memory 412v. The vehicle control unit 415v acquires an output result based on a sensor, generates a driving control signal using the output result, and outputs the generated driving control signal to cause an actuator group 420 to operate. Thus, the vehicle 400v can be driven by autonomous control. In the present embodiment, in the memory 412v, in addition to the program PG1, a detection model DM and a reference path RR are also pre-stored.

[0082] Figure 8 is a flowchart showing the processing flow of the driving control of the vehicle 400v in the second embodiment. In Figure 8 the processing flow, the processor 411v of the vehicle 400v functions as a vehicle control unit 415v by executing the program PG1.

[0083] In step S101, the processor 411v of the vehicle control device 410v acquires vehicle position information using a detection result output from a camera as an external sensor 300. In step S102, the processor 411v determines a target position to which the vehicle 400v should go next. In step S103, the processor 411v generates a driving control signal for causing the vehicle 400v to travel toward the determined target position. In step S104, the processor 411v controls the actuator group 420 using the generated driving control signal, so that the vehicle 400v travels according to the parameters indicated by the driving control signal. The processor 411v repeatedly performs acquisition of vehicle position information, determination of a target position, generation of a driving control signal, and control of the actuator at a prescribed cycle. According to the system 50v in the present embodiment, even without remotely controlling the vehicle 400v by the server 200, the vehicle 400v can be driven by autonomous control of the vehicle 400v.

[0084] (YY: Other embodiments) (YY1) In each of the above embodiments, the external sensor 300 is a camera. In contrast, the external sensor 300 may not be a camera. For example, it may be a LiDAR (Light Detection And Ranging). In this case, the detection result output from the external sensor 300 may be three-dimensional dot matrix data representing the vehicle 400. In this case, the server 200 and the vehicle 400 may also acquire vehicle position information by using template matching between the three-dimensional dot matrix data as the detection result and reference dot matrix data prepared in advance.

[0085] (YY2)In the above first embodiment, the server 200 performs the processes from obtaining the vehicle position information to generating the driving control signal. In contrast, at least a part of the processes from obtaining the vehicle position information to generating the driving control signal may be performed by the vehicle 400. For example, the following methods (1) to (3) may be adopted.

[0086] (1) It may be that the server 200 obtains the vehicle position information, determines the target position that the vehicle 400 should go to next, and generates a path from the current position of the vehicle 400 indicated by the obtained vehicle position information to the target position. The server 200 may generate a path to the target position between the current position and the destination, or may generate a path to the destination. It may be that the server 200 sends the generated path to the vehicle 400. It may be that the vehicle 400 generates a driving control signal in such a manner that the vehicle 400 travels on the path received from the server 200, and uses the generated driving control signal to control the actuator group 420.

[0087] (2) It may be that the server 200 obtains the vehicle position information and sends the obtained vehicle position information to the vehicle 400. It may be that the vehicle 400 determines the target position that the vehicle 400 should go to next, generates a path from the current position of the vehicle 400 indicated by the received vehicle position information to the target position, generates a driving control signal in such a manner that the vehicle 400 travels on the generated path, and uses the generated driving control signal to control the actuator group 420.

[0088] (3) In the methods of (1) and (2) above, it may be that an internal sensor is mounted on the vehicle 400, and the detection result output from the internal sensor is used in at least one of the generation of the path and the generation of the driving control signal. The internal sensor is a sensor mounted on the vehicle 400. The internal sensor may include, for example, a sensor for detecting the motion state of the vehicle 400, a sensor for detecting the operation state of each part of the vehicle 400, and a sensor for detecting the surrounding environment of the vehicle 400. Specifically, the internal sensor may include, for example, a camera, LiDAR, millimeter-wave radar, ultrasonic sensor, GPS sensor, acceleration sensor, gyro sensor, etc. For example, in the method of (1) above, it may be that the server 200 obtains the detection result of the internal sensor and reflects the detection result of the internal sensor in the path when generating the path. In the method of (1) above, it may also be that the vehicle 400 obtains the detection result of the internal sensor and reflects the detection result of the internal sensor in the driving control signal when generating the driving control signal. In the method of (2) above, it may be that the vehicle 400 obtains the detection result of the internal sensor and reflects the detection result of the internal sensor in the path when generating the path. In the method of (2) above, it may also be that the vehicle 400 obtains the detection result of the internal sensor and reflects the detection result of the internal sensor in the driving control signal when generating the driving control signal.

[0089] (YY3) In the second embodiment above, it may be that an internal sensor is mounted on the vehicle 400v, and the detection result output from the internal sensor is used in at least one of the generation of the path and the generation of the driving control signal. For example, it may be that the vehicle 400v obtains the detection result of the internal sensor and reflects the detection result of the internal sensor in the path when generating the path. It may be that the vehicle 400v obtains the detection result of the internal sensor and reflects the detection result of the internal sensor in the driving control signal when generating the driving control signal.

[0090] (YY4)In the above second embodiment, the vehicle 400v uses the detection results of the external sensor 300 to obtain vehicle position information. In contrast, it is also possible that the vehicle 400v is equipped with an internal sensor, and the vehicle 400v uses the detection results of the internal sensor to obtain vehicle position information, determines the target position that the vehicle 400v should go to next, generates a path from the current location of the vehicle 400v represented by the obtained vehicle position information to the target position, generates a driving control signal for driving on the generated path, and uses the generated driving control signal to control the actuator group 420. In this case, the vehicle 400v can travel without using the detection results of any external sensor 300. In addition, it is also possible that the vehicle 400v obtains the target arrival time and / or congestion information from outside the vehicle 400v and reflects the target arrival time and / or congestion information in at least one of the path and the driving control signal. Further, it is also possible that all the functional components of the system 50v are provided in the vehicle 400v. That is, the processing implemented by the system 50v in the present disclosure can also be implemented by the vehicle 400v alone.

[0091] (YY5)In the above first embodiment, the server 200 automatically generates a driving control signal sent to the vehicle 400. In contrast, the server 200 can also generate a driving control signal sent to the vehicle 400 according to the operation of an external operator located outside the vehicle 400. For example, it is also possible that the external operator operates a control device having a display for displaying a captured image output from the external sensor 300, a steering wheel for remotely operating the vehicle 400, an accelerator pedal, a brake pedal, and a communication device for communicating with the server 200 by wire communication or wireless communication, and the server 200 generates a driving control signal corresponding to the operation applied to the control device.

[0092] (YY6)In each of the above embodiments, the vehicle 400 only needs to have a configuration that can move autonomously. For example, it can also be in the form of a platform having the following-described configuration. Specifically, in order for the vehicle 400 to perform the three functions of "traveling", "steering", and "stopping" through autonomous driving, it only needs to have at least a vehicle control device 410 and an actuator group 420. When the vehicle 400 obtains information from the outside for autonomous driving, the vehicle 400 only needs to have a communication device 130. That is, the vehicle 400 that can move autonomously may not be equipped with at least a part of the interior components such as the driver's seat and the instrument panel, may not be equipped with at least a part of the exterior components such as the bumper and the fender, and may not be equipped with the body shell. In this case, the remaining components such as the body shell can be assembled to the vehicle 400 during the period until the vehicle 400 is shipped from the factory FC, or the remaining components such as the body shell can be assembled to the vehicle 400 after the vehicle 400 is shipped from the factory FC in a state where the remaining components such as the body shell are not assembled to the vehicle 400. Each component can be assembled from any direction such as the upper side, lower side, front side, rear side, right side, or left side of the vehicle 400, and can be assembled from the same direction or from different directions respectively. In addition, for the form of the platform, the position determination can be performed in the same manner as the vehicle 400 in the first embodiment.

[0093] (YY7) The vehicle 400 can also be manufactured by combining multiple modules. A module means a unit composed of multiple components aggregated according to the parts and functions of the vehicle 400. For example, the platform of the vehicle 400 can be manufactured by combining a front module that constitutes the front part of the platform, a central module that constitutes the central part of the platform, and a rear module that constitutes the rear part of the platform. In addition, the number of modules constituting the platform is not limited to 3, and can also be 2 or less or 4 or more. In addition, in addition to the components constituting the platform, the components constituting the parts of the vehicle 400 different from the platform can be modularized, or the components constituting the parts of the vehicle 400 different from the platform can be modularized instead of the components constituting the platform. In addition, various modules can also include any exterior components such as bumpers and grilles, and any interior components such as seats and consoles. In addition, not limited to the vehicle 400, any type of moving body can be manufactured by combining multiple modules. Such a module can be manufactured, for example, by joining multiple components using welding or fasteners, or by integrally molding at least a part of the components constituting the module into one component using casting. The molding method of integrally molding one component, especially a relatively large component, is also called Giga-casting or Mega-casting. For example, the above-mentioned front module, central module, and rear module can also be manufactured using Giga-casting.

[0094] (YY8) The transportation of the vehicle 400 using the running of the vehicle 400 under unmanned driving is also called "self-propelled transportation". In addition, the configuration for realizing self-propelled transportation is also called "vehicle remote control autonomous driving transportation system". In addition, the production method of manufacturing the vehicle 400 using self-propelled transportation is also called "self-propelled production". In self-propelled production, for example, in the factory FC where the vehicle 400 is manufactured, at least a part of the transportation of the vehicle 400 is realized by self-propelled transportation.

[0095] (YY9) In each of the above embodiments, part or all of the functions and processes implemented by software can also be implemented by hardware. In addition, part or all of the functions and processes implemented by hardware can also be implemented by software. As the hardware for realizing various functions in each of the above embodiments, for example, various circuits such as integrated circuits and discrete circuits can be used.

[0096] In addition, part or all of the processing in the above-mentioned ECU 103 and information processing device can be implemented as a computer program. Such a program can be stored and provided to a computer using various types of non-transitory computer-readable media. Non-transitory computer-readable media include various types of physical recording media. Examples of non-transitory computer-readable media include magnetic recording media (such as floppy disks, magnetic tapes, hard disk drives), magneto-optical recording media (such as magneto-optical disks), CD-ROM (Read Only Memory), CD-R, CD-R / W, semiconductor memories (such as mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)). In addition, the program can be provided to a computer through various types of transitory computer-readable media. Examples of transitory computer-readable media include electrical signals, optical signals, and electromagnetic waves. The transitory computer-readable media can provide the program to the computer through wired communication lines such as wires and optical fibers or wireless communication lines.

[0097] Furthermore, the present invention is not limited to the above embodiments and can be appropriately changed without departing from the gist.

[0098] This application claims priority based on Japanese Patent Application No. 2022-174089 filed on October 31, 2022, and incorporates all of its disclosure herein by reference. Explanation of Reference Numerals

[0099] 100 Vehicle control system, 101 Vehicle, 102 Communication terminal, 103 ECU, 104 Transmission unit, 105 Invalidation request unit, 50 System, 200 Server, 201 Processor, 202 Memory, 203 Input / output interface, 204 Internal bus, 205 Communication device, 210 Remote control unit, 300 External sensor, 400 Vehicle, 410 Vehicle control device, 411 Processor, 412 Memory, 413 Input / output interface, 414 Internal bus, 415 Vehicle control unit, 420 Actuator group, 430 Communication device, 50v System, 400v Vehicle, 410v Vehicle control device, 411v Processor, 412v Memory, 415v Vehicle control unit

Claims

1. A vehicle control system, comprising: A vehicle, which is equipped with a communication terminal having a communication function; An ECU (Electronic Control Unit) mounted on the vehicle, which performs driving control of the vehicle using communication via the communication terminal; A transmission unit, which transmits a control instruction value used for performing driving control of the vehicle from the outside of the vehicle to the ECU via the communication terminal; and An invalidation request unit, which requests the ECU from the outside of the vehicle via the communication terminal to irreversibly invalidate the driving control of the vehicle, After performing the driving control, the driving control is irreversibly invalidated.

2. The vehicle control system according to claim 1, wherein, The control indication value communicates using CAN, i.e., Controller Area Network communication. The invalidation of the driving control communicates using diagnostic communication.

3. The vehicle control system according to claim 1, wherein, After performing the invalidation of the driving control, the invalidation is confirmed using diagnostic communication.

4. The vehicle control system according to claim 1, wherein, The vehicle control system performs driving control during inspection at the vehicle factory and performs invalidation before shipment.

5. The vehicle control system according to claim 1, wherein, The communication terminal is a dongle or a data communication module.

6. The vehicle control system according to claim 1, wherein, The communication terminal is retrieved by an operator after the invalidation of the driving control.

7. The vehicle control system according to claim 1, wherein, The invalidation of the driving control is performed in the following manner: Burn out the circuit of the ECU; or Delete the application program stored in the ECU that performs the communication function; or Rewrite the software stored in the ECU that performs the communication function.

8. The vehicle control system according to claim 1, wherein, The invalidation of the driving control is performed under the following circumstances: It is detected that the vehicle has reached a specified position; or The operator has performed a specified operation; or It is confirmed with reference to production management information that driving control is not required; or An invalidation instruction is received; or The vehicle has completed specified power supply using the power supply device; or The vehicle has been packaged.

9. The vehicle control system according to claim 1, wherein, The vehicle control system performs driving control based on the information of a photographing device installed in the vehicle factory, and performs the invalidation of the driving control based on the information of the actions of the operator photographed by the photographing device.

10. The vehicle control system according to claim 1, wherein, After performing the irreversible invalidation of the driving control, the vehicle performs a specified action.

11. The vehicle control system according to claim 10, wherein, The specified action is: Turn on the emergency flasher; or Sound the horn; or Activate the windshield wiper; or Move the wheels left and right; or Display on a monitor installed outside the vehicle.

12. A vehicle manufacturing method, During inspection in a vehicle factory, perform driving control of the vehicle according to a request made from the outside of the vehicle via a communication terminal, Before shipment, invalidate the driving control of the vehicle that is irreversible according to a request made from the outside of the vehicle via the communication terminal.

13. A program that causes an ECU (Electronic Control Unit) mounted on a vehicle to execute: Driving control of the vehicle according to a request made from the outside of the vehicle via a communication terminal; and Invalidation of the driving control of the vehicle that is irreversible according to a request made from the outside of the vehicle via the communication terminal.

14. An information processing device, comprising: A transmission unit that transmits a control instruction value used for driving control of the vehicle from the outside of the vehicle to the ECU via a communication terminal; and An invalidation request unit that requests the ECU to irreversibly invalidate the driving control of the vehicle from the outside of the vehicle via the communication terminal.

Images