Vehicle

Abstract

The invention relates to a vehicle. The purpose of the present invention is to perform appropriate control when a part of the redundant function of an automatic driving system is restored from an abnormal state. A VCIB executes a process including: outputting a switching command (S102) when a communication abnormality with an ADC1 has occurred (YES in S100); when a PCS stop command is received from the ADC1 (YES in S104), the PCS stop command is invalidated (S108) if the PCS stop command is received from the ADC1 in the same stroke (YES in S106) as the PCS stop command is received from the ADC1 when the PCS stop command is received from the ADC1 when the PCS stop command is received from the ADC1. And outputting a PCS stop command (S110) when the stroke is not the same as the stroke when the abnormality occurs (NO in S106).

Description

Technical Field

[0001] This disclosure pertains to vehicles. Background Technology

[0002] In recent years, there has been a push for the development of autonomous driving systems that enable vehicles to operate without user intervention. Sometimes, these systems are configured separately from the vehicle via an interface in order to be compatible with existing vehicles.

[0003] For example, Japanese Patent Application Publication No. 2018-132015 (Patent Document 1) discloses a technology in which an automatic driving control of a vehicle is performed in a unified manner by a computer constituting an automatic driving system installed in the vehicle.

[0004] Existing technical documents

[0005] Patent documents

[0006] Patent Document 1: Japanese Patent Application Publication No. 2018-132015

[0007] As described above, the autonomous driving system in the vehicle includes two identical devices capable of autonomous driving for redundancy. Therefore, for example, if an anomaly occurs between the autonomous driving system using one device and the vehicle, the other device can continue autonomous driving. However, when the device that experienced the anomaly recovers from the anomaly by restarting, it may sometimes output autonomous driving-related commands based on information acquired after the restart, requiring appropriate handling of such unreliable commands. Summary of the Invention

[0008] This disclosure was made to solve the above-mentioned problems, and its purpose is to provide a vehicle that performs appropriate control when a portion of the redundant functions of an autonomous driving system recovers from an abnormal state.

[0009] A vehicle of a certain aspect of the present disclosure is provided with an automatic driving system that performs automatic driving of the vehicle, and a vehicle platform that can receive an instruction related to the automatic driving from the automatic driving system. The vehicle platform includes a base vehicle and a vehicle control interface that performs interface connection between the vehicle platform and the automatic driving system. The vehicle control interface includes a first control device and a second control device. The automatic driving system includes a first automatic driving device that outputs an instruction to the base vehicle via the first control device, and a second automatic driving device that outputs an instruction to the base vehicle via the second control device when the first automatic driving device is abnormal. In a case where the first automatic driving device has become abnormal, an execution instruction of a retreat driving using the second automatic driving device and the second control device is output to the base vehicle. Even if the first automatic driving device recovers from the abnormality, the first control device does not accept the predetermined instruction from the first automatic driving device.

[0010] In this way, even if the first automatic driving device recovers from the abnormality and outputs the predetermined instruction to the base vehicle in the retreat driving, the first control device does not accept the instruction from the first automatic driving device. Therefore, it is possible to avoid that the vehicle is controlled based on the instruction from the first automatic driving device that has recovered from the abnormality, which is low in reliability.

[0011] In a certain embodiment, the base vehicle includes a vehicle control device that controls a device of the vehicle independently of the instruction from the automatic driving system. In the implementation of the automatic driving, the first automatic driving device outputs a stop instruction to the base vehicle via the first control device, where the stop instruction requests a stop of the instruction to control the vehicle using the vehicle control device.

[0012] In this way, in the automatic driving, the control of the vehicle by the vehicle control device is stopped, and therefore it is possible to suppress the disturbance to the automatic driving.

[0013] In still another embodiment, the vehicle control device controls the vehicle in a manner to avoid a collision of the vehicle in a state where a collision of the vehicle is predicted.

[0014] In this way, in the automatic driving, the control of the vehicle by the vehicle control device to avoid the collision is stopped, and therefore it is possible to suppress the disturbance to the automatic driving.

[0015] In still another embodiment, even if the first automatic driving device recovers from the abnormality, the first control device does not accept the instruction from the first automatic driving device in a case where a trip including a time point where the abnormality has occurred is in progress.

[0016] In this way, it is possible to avoid that the vehicle is controlled based on the instruction from the first automatic driving device that has recovered from the abnormality, which is low in reliability, in the trip including the time point where the abnormality has occurred.

[0017] Inventive Effects

[0018] According to the present disclosure, a vehicle that appropriately controls when a part of a redundant function of an autonomous driving system recovers from an abnormal state can be provided. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 is a diagram that schematically shows a vehicle according to an embodiment of the present disclosure.

[0020] Figure 2 is a diagram for detailing each configuration of the ADS, the VCIB, and the VP.

[0021] Figure 3 is a flowchart showing one example of processing performed by the VCIB.

[0022] Figure 4 is a diagram for explaining one example of the action of the VCIB.

[0023] REFERENCE SIGNS

[0024] 10: vehicle; 100: base vehicle; 111, 111A, 111B: VCIB; 115: integrated control manager; 120: VP; 200: ADK. DETAILED DESCRIPTION

[0025] Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the drawings. Note that the same reference signs are assigned to the same or equivalent portions in the drawings, and the description thereof will not be repeated.

[0026] Figure 1 is a diagram that schematically shows a vehicle 10 according to an embodiment of the present disclosure. Referring to Figure 1 , the vehicle 10 is provided with an autonomous driving kit (hereinafter, referred to as "ADK") 200 and a vehicle platform (hereinafter, referred to as "VP") 120. The ADK 200 and the VP 120 are configured to be able to communicate with each other via a vehicle control interface.

[0027] The vehicle 10 performs autonomous driving in accordance with a control request (command) from the ADK 200 mounted to the VP 120. The ADK 200 is mounted to the roof or the like of a base vehicle 100 described later. The ADK 200 is configured to be able to be attached to and detached from the VP 120. In a case where the ADK 200 is detached, the VP 120 is able to perform manual driving based on a user operation. In this case, the VP 120 performs travel control based on a manual mode.

[0028] The ADK 200 includes an autonomous driving system (hereinafter, referred to as "ADS") 202 for performing autonomous driving of the vehicle 10. The ADS 202 makes a travel plan of the vehicle 10, and outputs various commands (control requests) for causing the vehicle 10 to travel in accordance with the made travel plan to the VP 120 in accordance with an API (Application Program Interface) defined for each command. The ADS 202 receives various signals indicating a state (vehicle state) of the VP 120 from the VP 120 in accordance with an API defined for each signal, and reflects the received vehicle state to making of the travel plan.

[0029] The VP 120 includes the base vehicle 100 and a VCIB (Vehicle Control Interface Box) 111 provided in the base vehicle 100, which realizes a vehicle control interface.

[0030] The VCIB 111 can communicate with the ADK 200 through a CAN (Controller Area Network) or the like. The VCIB 111 receives various commands from the ADK 200 by executing a prescribed API defined for each transmitted signal, and further outputs a state of the VP 120 to the ADK 200. That is, when a control request is received from the ADK 200, the VCIB 111 outputs a control command corresponding to the control request to a system corresponding to the control command via the integrated control manager 115. Further, the VCIB 111 acquires various information of the base vehicle 100 from various systems via the integrated control manager 115, and outputs a state of the base vehicle 100 as a vehicle state to the ADK 200.

[0031] The VP 120 includes various systems for controlling the base vehicle 100 and various sensors. The VP 120 performs various vehicle controls in accordance with control requests from the ADK 200 (specifically, the ADS 202), thereby performing autonomous driving of the vehicle 10. The VP 120 includes, for example, a brake system 121, a steering system 122, a powertrain system 123, an active safety system 125, and a body system 126.

[0032] The brake system 121 is configured to be able to control a plurality of brake devices provided to wheels of the base vehicle 100. The brake device includes, for example, a disc brake system that acts using hydraulic pressure adjusted by an actuator.

[0033] The brake system 121 is connected with, for example, a wheel speed sensor 127A and a wheel speed sensor 127B. The wheel speed sensor 127A is provided at, for example, a front wheel of the base vehicle 100, and detects a rotational speed of the front wheel. The wheel speed sensor 127A outputs the rotational speed of the front wheel to the brake system 121. The wheel speed sensor 127B is provided at, for example, a rear wheel of the base vehicle 100, and detects a rotational speed of the rear wheel. The wheel speed sensor 127B outputs the rotational speed of the rear wheel to the brake system 121. The brake system 121 outputs the rotational speed of each wheel as one of the information included in the vehicle state to the VCI B 111.

[0034] The brake system 121 generates a brake command for the brake device in accordance with a prescribed control request output from the ADK 200 via the VCI B 111 and the integrated control manager 115, and controls the brake device using the generated brake command.

[0035] The steering system 122 is configured to be able to control a steering angle of a steering wheel of the vehicle 10 using a steering device. The steering device includes, for example, an EPS (Electric Power Steering) of a rack-and-pinion type that adjusts the steering angle by an actuator.

[0036] The steering system 122 is connected with a pinion angle sensor 128 that detects a rotational angle (pinion angle) of a pinion gear that is linked to a rotational shaft of an actuator that constitutes the steering device. The steering system 122 outputs the detected pinion angle as one of the information included in the vehicle state to the VCI B 111.

[0037] The steering system 122 generates a steering command for the steering device in accordance with a prescribed control request (steering request) output from the ADK 200 via the VCI B 111 and the integrated control manager 115, and controls the steering device using the generated steering command.

[0038] The powertrain system 123 controls an EPB (Electric Parking Brake) provided at at least any one of a plurality of wheels provided in the vehicle 10, a P-Lock device provided at a transmission of the vehicle 10, a shift device configured to be able to select any one of a plurality of gears, and a drive source of the vehicle 10.

[0039] The active safety system 125 detects an obstacle or the like (obstacle, person) in front or behind using the camera 129A, the radar sensor 129B, and the radar sensor 129C, and outputs a brake command to the brake system 121 in such a manner that the brake force is increased via the integrated control manager 115 in a case where it is determined that there is a possibility of collision in accordance with the distance to the obstacle or the like and the moving direction of the vehicle 10.

[0040] The body system 126 is configured to be able to control a component such as a direction indicator, a horn, or a wiper, for example, in accordance with the running state or the running environment or the like of the vehicle 10. The body system 126 controls the above-mentioned component in accordance with a prescribed control request that is output from the ADK 200 via the VCI B 111 and the integrated control manager 115.

[0041] Note that the vehicle 10 can be adopted as one of the constituents of a MaaS (Mobility as a Service) system. The MaaS system has, in addition to the vehicle 10, for example, a data server, an MSPF (Mobility Service Platform), and a mobility service associated with automated driving (none of which is shown).

[0042] The vehicle 10 also has a DCM (Data Communication Module) (not shown) as a communication I / F (Interface) for wireless communication with the above-mentioned data server. The DCM outputs, to the data server, various vehicle information such as the speed, the position, and the automated driving state, for example. In addition, the DCM receives, from the mobility service via the MSPF and the data server, various data for managing the running of an automated driving vehicle including the vehicle 10 in the mobility service associated with automated driving.

[0043] Figure 2 is a diagram for describing each constituent of the ADS 202, the VCI B 111, and the VP 120 in detail. As shown in Figure 2 The ADS 202 includes a computer assembly (hereinafter, referred to as "CA") 210, an HMI (Human Machine Interface) 230, an identification sensor 260, a posture sensor 270, and a sensor cleaner 290, for example.

[0044] The CA 210 acquires the environment around the vehicle, the posture, the behavior, and the position of the vehicle at the time of autonomous driving of the vehicle 10 using various sensors described later, and acquires the vehicle state from the VP 120 described later via the VCI B 111, and thereby sets the next action (acceleration, deceleration, or turning, or the like) of the vehicle 10. The CA 210 outputs various instructions for realizing the set next action of the vehicle 10 to the VCI B 111. The CA 210 includes a computer module (hereinafter, referred to as "ADC") 210A, 210B for autonomous driving. In the present embodiment, the "ADC 210A" and the "ADC 210B" correspond to the "first autonomous driving device" and the "second autonomous driving device", respectively. The ADC 210A, 210B are each configured to be able to communicate with the VCI B 111.

[0045] The HMI 230 performs presentation of information to the user, acceptance of operation at the time of autonomous driving, at the time of driving requiring operation of the user, or at the time of transition between autonomous driving and driving requiring operation of the user, or the like. The HMI 230 is configured to be able to connect to input and output devices such as a touch panel display, a display device, and an operation device provided in the base vehicle 100, for example.

[0046] The recognition sensor 260 includes a sensor for recognizing the environment around the vehicle 10, and is constituted by at least any one of a LIDAR (Laser Imaging Detection and Ranging), a millimeter wave radar, and a camera, for example.

[0047] The LIDAR is a distance measuring device for measuring a distance in a pulsed manner by irradiating laser (infrared rays) and measuring the time until the laser is reflected by an object. The millimeter wave radar is a distance measuring device for measuring a distance and a direction to an object by irradiating an object with an electric wave having a short wavelength and detecting an electric wave returned from the object. The camera is disposed, for example, on the back side of an indoor mirror in the cabin, and is used to capture an image of the front of the vehicle. Information acquired by the recognition sensor 260 is output to the CA 210. By image processing using an artificial intelligence (AI) and an image processing processor on an image captured by the camera, it is possible to recognize another vehicle, an obstacle, or a person located in front of the vehicle 10.

[0048] The posture sensor 270 includes a sensor for detecting the posture, the behavior, or the position of the vehicle 10, and is constituted by an IMU (Inertial Measurement Unit), a GPS (Global Positioning System), or the like, for example.

[0049] The IMU, for example, detects acceleration in the front-rear direction, the left-right direction, and the up-down direction of the vehicle 10, angular velocity in the roll direction, the pitch direction, and the yaw direction of the vehicle 10. The GPS detects the position of the vehicle 10 using information received from a plurality of GPS satellites that orbit the earth. The information acquired by the posture sensor 270 is output to the CA 210.

[0050] The sensor cleaner 290 is configured to remove dirt attached in the running of the vehicle at various sensors. The sensor cleaner 290, for example, removes dirt of the lens of the camera, the irradiation portion of the laser or the electric wave, and the like using a cleaning liquid, a wiper, or the like.

[0051] The VCIB 111 includes a VCIB 111A and a VCIB 111B. The "VCIB 111A" and the "VCIB 111B" correspond to the "first control device" and the "second control device", respectively. The VCIB 111A and the VCIB 111B are built-in with a CPU (Central Processing Unit) and a memory (for example, including a ROM (Read Only Memory), a RAM (Random Access Memory), and the like) that are not illustrated. The VCIB 111A has the same functions as the VCIB 111B, but differs in a part of the connection target with respect to a plurality of systems that constitute the VP 120.

[0052] The VCIB 111A and the VCIB 111B are communicably connected to the ADC 210A and the ADC 210B of the CA 210, respectively. Also, the VCIB 111A and the VCIB 111B are connected in a manner that enables communication with each other.

[0053] Each of the VCIB 111A and the VCIB 111B relays various instructions corresponding to the control request from the ADS 202 and outputs it as a control command to the corresponding system of the VP 120. More specifically, each of the VCIB 111A and the VCIB 111B generates a control command for the control of the corresponding system of the VP 120 using a program or the like information (for example, an API) stored in the memory and using various command instructions output from the ADS 202, and outputs it to the corresponding system. Further, each of the VCIB 111A and the VCIB 111B relays vehicle information output from each system of the VP 120 and outputs it as a vehicle state to the ADS 202. Note that the information indicating the vehicle state can be the same information as the vehicle information, or can be information obtained by extracting information for processing performed by the ADS 202 from the vehicle information.

[0054] The control system between the ADS 202 and the VP 120 is made redundant by the VCIB 111A and the VCIB 111B having equivalent functions with respect to the operation of a part of the system (e.g., braking, steering). Thus, when a certain failure occurs in a part of the system, the function of the VP 120 (turning, stopping, etc.) can be maintained by appropriately switching the control system or blocking the control system in which the failure has occurred.

[0055] The braking system 121 includes the braking system 121A and the braking system 121B. The steering system 122 includes the steering system 122A and the steering system 122B. The power transmission system 123 includes the EPB system 123A, the P-Lock system 123B, and the propulsion system 124. The braking system 121A, the steering system 122A, the EPB system 123A, the P-Lock system 123B, the propulsion system 124, and the body system 126 among the plurality of systems of the VCIB 111A and the VP 120 are connected in a communicable manner via a communication bus. Further, the braking system 121B, the steering system 122B, and the P-Lock system 123B among the plurality of systems of the VCIB 111B and the VP 120 are connected in a communicable manner via a communication bus.

[0056] The braking system 121A and the braking system 121B are each configured to be able to control a plurality of brake devices provided to wheels of the vehicle. Either the braking system 121A and the braking system 121B can have equivalent functions, or, for example, one of them can be configured to be able to independently control the braking force of each wheel when the vehicle is running, and the other can be configured to be able to control in a manner in which the same braking force is generated at each wheel when the vehicle is running.

[0057] The braking system 121A and the braking system 121B generate a brake command for the brake device in accordance with a control request output from the ADS 202 via the VCIB 111A and the VCIB 111B, respectively. With respect to the braking system 121A and the braking system 121B, either one controls the brake device, and in the case where an abnormality occurs in one, the other controls the brake device.

[0058] The steering system 122A and the steering system 122B are each configured to be able to control the steering angle of the steering wheel of the vehicle 10 using a steering device. The steering system 122A and the steering system 122B have equivalent functions.

[0059] The steering system 122A, the steering system 122B generates a steering command for a steering device in accordance with a control request output from the ADS 202 via the VCIB 111A and the VCIB 111B, respectively. With regard to the steering system 122A, the steering system 122B, either party is used to control the steering device, and in the event of an abnormality in one party, the other party is used to control the steering device.

[0060] The EPB system 123A is configured to be able to control an EPB. The EPB fixes a wheel by the action of an actuator. The EPB system 123A controls the EPB in accordance with a control request output from the ADS 202 via the VCIB 111A.

[0061] The P-Lock system 123B is configured to be able to control a P-Lock device. The P-Lock system 123B controls the P-Lock device in accordance with a control request output from the ADS 202 via the VCIB 111A or the VCIB 111B. For example, in a case where the control request output from the ADS 202 via the VCIB 111A or the VCIB 111B includes a control request to set a gear position to a parking range (hereinafter, set to a P range), the P-Lock system 123B causes the P-Lock device to operate, and in a case where the control request includes a control request to set the gear position to a range other than the P range, the P-Lock system 123B releases the operation of the P-Lock device.

[0062] The propulsion system 124 is configured to be able to perform switching of a gear position using a gear device, and to be able to control a driving force of the vehicle 10 with respect to a moving direction of the vehicle 10 using a driving source. As the gear position that can be switched, for example, a P range, a neutral range (hereinafter, set to an N range), a forward travel range (hereinafter, set to a D range), and a reverse travel range (hereinafter, set to an R range) are included. The driving source includes, for example, a motor generator, an engine, and the like.

[0063] The propulsion system 124 controls the gear device and the driving source in accordance with a control request output from the ADS 202 via the VCIB 111A. For example, in a case where the control request output from the ADS 202 via the VCIB 111A includes a control request to set the gear position to the P range, the propulsion system 124 controls the gear device so that the gear position becomes the P range.

[0064] The active safety system 125 is communicably connected with the brake system 121A. The active safety system 125 includes a pre-crash safety system (PCS) 125A and a front camera module (FCM) 125B constituted by a camera 129A and a radar sensor 129B. As described above, the PCS 125A uses the camera 129A and the radar sensor 129B to detect an obstacle or the like (obstacle, person) ahead, and in a case where it is predicted that there is a possibility of collision with the obstacle or the like in accordance with the distance to the obstacle or the like, the PCS 125A outputs a brake command to the brake system 121A in a manner that the brake force is increased to avoid the collision. The PCS 125A corresponds to the "vehicle control device". Note that the active safety system 125 (PCS 125A) can be communicably connected with the VCI B 111A via the brake system 121A, for example, or can be communicably connected directly with the VCI B 111A.

[0065] The body system 126 controls components such as a direction indicator, a horn, or a wiper, in accordance with a control request output from the ADS 202 via the VCI B 111A.

[0066] Note that, regarding the above-described brake device, steering device, EPB, P-Lock device, shift device, and drive source, an operation device that can be manually operated by a user can be provided separately. Further, the VSC (Vehicle Stability Control) 100A is constituted by the brake system 121, the steering system 122, and the propulsion system 124.

[0067] As various commands corresponding to the control request output from the ADS 202 to the VCI B 111, there are included a propulsion direction command that requests switching of a gear position, a stationary command that requests operation or operation release of the EPB, P-Lock device, an acceleration command that requests acceleration or deceleration of the vehicle 10, a tire turning angle command that requests a tire turning angle of the steering wheel, a vehicle mode command that requests switching of a vehicle mode state between an automatic driving mode and a manual mode, and a stop command that requests parking hold or release of the vehicle.

[0068] In the vehicle 10 as above, when the automatic driving mode is selected as the vehicle mode state by the user's operation of the HMI 230 or the like, automatic driving is implemented. As described above, in the automatic driving, the ADS 202 first makes a travel plan. As the travel plan, for example, a plan to continue straight ahead, a plan to make a left turn or a right turn at a prescribed intersection located in the middle of a predetermined travel route, or a plan to change a travel lane to a lane different from the lane in which the vehicle 10 travels, and the like, are included as a plurality of plans related to the movement of the vehicle 10.

[0069] The ADS 202 extracts a control physical quantity (for example, an acceleration or a deceleration, a tire turning angle, or the like) required for the vehicle 10 to move in accordance with the made travel plan. The ADS 202 divides the physical quantity for each execution cycle of the API. The ADS 202 uses the divided physical quantity to execute the API, and outputs various commands to the VCI B 111. Also, the ADS 202 acquires a vehicle state (for example, an actual moving direction of the vehicle 10, a state of immobilization of the vehicle, or the like) from the VP 120, and re-makes a travel plan that reflects the acquired vehicle state. In this way, the ADS 202 can implement automatic driving of the vehicle 10. Note that, in a case where a predetermined condition is satisfied, the ADS 202 outputs, to the base vehicle 100 via the VCI B 111, a stop instruction (hereinafter, referred to as a PCS stop instruction) that stops the movement of the PCS 125A that moves independently of the automatic driving. The predetermined condition can be set to include, for example, a condition that the automatic driving is being executed.

[0070] In the ADS 202 mounted on such a vehicle 10, as described above, the ADC 210A and the ADC 210B that can implement automatic driving are provided for redundancy. Therefore, for example, in a case where a communication abnormality occurs between the vehicle side VCI B 111A and in the implementation of automatic driving using the ADC 210A, the automatic driving can be continued using the ADC 210B. In a case where a communication abnormality occurs with the ADC 210A, the VCI B 111A outputs, to the base vehicle 100 and the VCI B 111B, an execution instruction of a retreat travel using the ADC 210B and the VCI B 111B.

[0071] However, when the abnormal ADC 210A recovers from the abnormal state by a restart, a command related to the automatic driving can be output from the ADC 210A depending on information acquired after the restart. If the information acquired after the restart is not sufficient to meet the needs in continuing the automatic driving, a command with low reliability is output, and appropriate processing is required for such a command with low reliability.

[0072] Thus, in the present embodiment, it is provided that even if the ADC 210A recovers from the abnormality, the VCB 111A does not accept the predetermined instruction (for example, the PCS stop instruction) from the ADC 210A.

[0073] In this way, it is possible to make the VCB 111A not accept the predetermined instruction from the ADC 210A even if the ADC 210A recovers from the abnormality and outputs the predetermined instruction to the VP 120 in the evasive travel. Thus, it is possible to avoid the vehicle being controlled based on the instruction from the ADC 210A that has recovered from the abnormality and has low reliability.

[0074] Hereinafter, the processing performed by the VCB 111A will be described with reference to Figure 3 The processing performed by the VCB 111A will be described. Figure 3 is a flowchart showing one example of the processing performed by the VCB 111A. The VCB 111A repeatedly performs the following processing, for example, at each execution cycle of the API.

[0075] In step (hereinafter, the step will be referred to as S) 100, the VCB 111A determines whether or not a communication abnormality has occurred between the VCB 111A and the ADC 210A. For example, in a case where a state in which various signals are not received from the ADC 210A has continued for a predetermined time, the VCB 111A determines that a communication abnormality has occurred with the ADC 210A. In a case where it is determined that a communication abnormality has occurred between the VCB 111A and the ADC 210A (Yes in S100), the processing moves to S102.

[0076] In S102, the VCB 111A outputs a switching instruction. The VCB 111A outputs, for example, an instruction to switch the control subject from the VCB 111A to the VCB 111B to each of the VSC 100A and the VCB 111B as the switching instruction. At this time, when the VCB 111B receives an instruction to execute evasive travel from the ADC 210B due to a communication abnormality between the ADC 210A and the VCB 111A, the VCB 111B controls the VSC 100 in a manner to implement evasive travel. The evasive travel can be provided, for example, as control including adjustment of the brake force and the acceleration in a manner to stop the vehicle 10, or as control including steering in a manner to make the vehicle 10 approach the shoulder of the road and adjustment of the brake force and the acceleration in a manner to stop the vehicle 10, or as control including causing the EPB system 123A or the P-Lock system 123B to operate to restrict movement of the vehicle 10 after stopping. Thereafter, the processing moves to S104.

[0077] In S104, the VCIB 111A determines whether there is a PCS stop instruction from the ADC 210A. For example, in a case where it is determined that the communication with the VCIB 111A is abnormal, the ADC 210A implements a restart process. After the restart, the communication of the ADC 210A with the VCIB 111A is restored, and in a case where it is determined that a predetermined condition (for example, a condition that automatic driving is being performed) is satisfied, the ADC 210A outputs a PCS stop instruction to the VCIB 111A. In a case where the PCS stop instruction is received from the ADC 210A and it is thus determined that there is the PCS stop instruction (Yes in S104), the process moves to S106.

[0078] In S106, the VCIB 111A determines whether the current trip is the same trip as at the time of the abnormality occurrence. For example, in the startup of the system, in a case where the IG (Ignition) has not been in the off state during a period from the abnormality occurrence to the current time point, the VCIB 111A determines that the current trip is the same trip as at the time of the abnormality occurrence. In a case where it is determined that the current trip is the same trip as at the time of the abnormality occurrence (Yes in S106), the process moves to S108.

[0079] In S108, the VCIB 111A invalidates the PCS stop instruction received from the ADC 210A. The VCIB 111A, for example, is set not to accept the PCS stop instruction received from the ADC 210A and not to output the PCS stop instruction to the PCS 125A. Thereafter, the process ends. Note that in a case where it is determined that the current trip is not the same trip as at the time of the abnormality occurrence (No in S106), the process moves to S110.

[0080] In S110, the VCIB 111A outputs the PCS stop instruction to the PCS 125A. Upon receiving the PCS stop instruction, the PCS 125A stops the travel control of the vehicle implemented by the PCS 125A. Thereafter, the process ends. Note that in a case where it is determined that the communication with the ADC 210A is not abnormal (No in S100), the process moves to S104. Also, in a case where the PCS stop instruction is not received from the ADC 210A (No in S104), the process ends.

[0081] Reference Signs List Figure 4 The operation of the VCIB 111A based on the above-described structure and flowchart will be described. Figure 4 is a diagram for describing one example of the operation of the VCIB 111A.

[0082] Hereinafter, in automatic driving, as shown in (A) of FIG. 18, a case where the communication between the ADC 210A and the VCIB 111A has become abnormal is assumed. Figure 4 is a diagram for describing one example of the operation of the VCIB 111A.

[0082] Hereinafter, in automatic driving, as shown in (A) of FIG. 18, a case where the communication between the ADC 210A and the VCIB 111A has become abnormal is assumed.

[0083] In a case where it is determined that the communication between the ADC 210A and the VCIB 111A has become abnormal (Yes in S100), as shown in (B) and (C) of FIG. 10, a switching instruction to switch the control subject from the VCIB 111A to the VCIB 111B is output to the VSC 100A and the VCIB 111B (S102). In the ADC 210B, when the information about the abnormality in the communication between the ADC 210A and the VCIB 111A is acquired from the ADC 210A, as shown in (D) of FIG. 10, an execution instruction of the retreat travel (retreat instruction) is output from the ADC 210B to the VCIB 111B. When the retreat instruction is received in the VCIB 111B, as shown in (E) of FIG. 10, the VCIB 111B performs the retreat control on the VSC 100A, and thus the retreat travel of the vehicle 10 is performed. In a case where it is determined that the communication with the VCIB 111A has become abnormal, the ADC 210A performs a restart process. After the restart, in a case where it is determined in the ADC 210A that a predetermined condition is satisfied, as shown in (G) of FIG. 10, a PCS stop instruction is output to the VCIB 111A. In a case where the PCS stop instruction is received from the ADC 210A (Yes in S104) and is the same trip as when the abnormality occurred (Yes in S106), as shown in (H) of FIG. 10, the PCS stop instruction is invalidated. That is, the PCS stop instruction is not accepted (S108), and the control of the vehicle 10 by the PCS 125A is suppressed. Figure 4 Figure 4 Figure 4 Figure 4 ​

[0084] As described above, according to the vehicle 10 of the present embodiment, in normal times, in automatic driving, the control of the vehicle by the PCS 125A is stopped by the PCS stop instruction generated by the ADC 210A, and thus it is possible to suppress the disturbance to the automatic driving. Also, it is possible to make the VCIB 111A not accept the instruction from the ADC 210A in a case where the abnormality in the communication between the ADC 210A and the VCIB 111A occurs and thus the retreat travel is performed, and in a case where the ADC 210A recovers from the abnormality in the retreat travel and outputs the PCS stop instruction to the VP 120. Thus, it is possible to avoid the vehicle being controlled based on the instruction from the ADC 210A that has recovered from the abnormality, which is low in reliability. Therefore, it is possible to provide a vehicle that performs appropriate control when the communication with the automatic driving system recovers from the abnormal state.

[0085] Hereinafter, a modification will be described.

[0086] ​​​​​In the above-described embodiment, as the control of the vehicle 10 implemented independently of the automatic driving, the control of the vehicle 10 implemented by the PCS 125A is described as an example, but is not particularly limited to the control of the vehicle 10 implemented by the PCS 125A, and can be other vehicle control that can be executed independently of the automatic driving and stopped in the automatic driving.

[0087] Also, in the above-described embodiment, the case where the PCS stop instruction is invalidated in the same trip as when the abnormality occurs is described as an example, but the PCS stop instruction can also be invalidated even in a different trip after the abnormality occurs.

[0088] Note that, as for the above-described modifications, all or a part thereof can be appropriately combined and implemented.

[0089] It should be understood that the embodiments disclosed herein are shown by way of example, and not as limitations. The scope of the application should be determined by the following claims, and not by the description of the embodiments.

Claims

1. A vehicle comprising: an automatic driving system that performs automatic driving of the vehicle; and a vehicle platform that is capable of receiving an instruction related to the automatic driving from the automatic driving system, the vehicle platform including a base vehicle and a vehicle control interface that performs interfacing between the vehicle platform and the automatic driving system, the vehicle control interface including a first control device and a second control device, a first automatic driving device that outputs an instruction to the base vehicle via the first control device, and a second automatic driving device that outputs an instruction to the base vehicle via the second control device when the first automatic driving device is abnormal, an execution instruction for fallback driving using the second automatic driving device and the second control device is output to the base vehicle when the first automatic driving device is abnormal, and the first control device does not accept a predetermined instruction from the first automatic driving device even if the first automatic driving device recovers from abnormality.

2. The vehicle according to claim 1, wherein the base vehicle includes a vehicle control device that controls equipment of the vehicle independently of an instruction from the automatic driving system, and the first automatic driving device outputs a stop instruction to the base vehicle via the first control device in implementation of the automatic driving, the stop instruction being an instruction that requests a stop of control of the vehicle using the vehicle control device.

3. The vehicle according to claim 2, wherein the vehicle control device controls the vehicle in a manner that avoids collision of the vehicle in a state in which collision of the vehicle is predicted.

4. The vehicle according to any one of claims 1 to 3, wherein the first control device does not accept an instruction from the first automatic driving device even if the first automatic driving device recovers from abnormality in a case in which a trip including a time point at which abnormality has occurred is in progress. ​ The autonomous driving system comprises: ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​

Images