Vehicle platform and method for controlling a vehicle platform

Abstract

The invention relates to a vehicle platform and a method for controlling the vehicle platform. The VP includes: a base vehicle including first / second functional units that perform specific functions for automatic / manual driving; a master / sub VCIB that relays control communications between the ADK and the first / second functional unit via the first / second path, respectively; and a power switch. The driving mode of the VP set in each of the main / sub VCIBs can be switched to an automatic or manual driving mode. When a dual-system failure occurs in a case where a driving mode set in the master / sub VCIB is an automatic driving mode, the first / second functional unit performs emergency stop control, the dual-system failure being a failure that makes communication or control impossible via the first / second path. When an operation of turning off the base vehicle by the power switch is accepted after execution of the emergency stop control, the main / sub VCIB switches the driving mode set in the main / sub VCIB to a manual driving mode.

Description

[0001] Cross-reference to related applications

[0002] This non-provisional application is based on Japanese Patent Application No. 2024-175184, filed with the Japan Patent Office on October 4, 2024, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure relates to a vehicle platform and a method for controlling the vehicle platform, and more particularly to a vehicle platform to which an autonomous driving kit, which is capable of being attached to and detached from, is given instructions for autonomous driving, and a method for controlling the vehicle platform, which is configured to be capable of autonomous driving. Background Technology

[0004] Traditionally, there exists a vehicle platform (hereinafter referred to as "VP") on which an autonomous driving kit (hereinafter referred to as "ADK") can be installed. The VP includes a base vehicle and a vehicle control interface box (hereinafter referred to as "VCIB"), which connects the base vehicle and the autonomous driving system via a communication bus (e.g., see Japanese Patent Publication No. 2024-106017). In the VP, two systems exist as paths for exchanging signals between the ADK and the VP: a path via the main bus and the main VCIB, and a path via the sub-bus and the sub-VCIB. Summary of the Invention

[0005] In the VP disclosed in Japanese Patent Publication No. 2024-106017, when both paths for exchanging signals between ADK and VP fail, ADK cannot instruct VP to switch to manual driving, which may make it impossible to move the base vehicle by manual driving.

[0006] This disclosure is made to solve the above-mentioned problems, and its purpose is to provide a vehicle platform and a method for controlling the vehicle platform, in which manual driving can be switched even when it is not possible to switch to manual driving according to instructions from an autonomous driving suite.

[0007] The vehicle platform disclosed herein is a vehicle platform to which an autonomous driving kit, providing instructions for autonomous driving, can be attached and detached, the vehicle platform being configured to drive autonomously. The vehicle platform includes: a base vehicle comprising a first functional unit and a second functional unit performing specific functions for autonomous and manual driving; a first vehicle control interface box relaying control communication between the autonomous driving kit and the first functional unit via a first path; a second vehicle control interface box relaying control communication between the autonomous driving kit and the second functional unit via a second path; and a power switch accepting operations to turn the base vehicle on or off. A driving mode of the vehicle platform set in each of the first and second vehicle control interface boxes is switchable to either an autonomous driving mode or a manual driving mode. When a dual-system failure occurs while the driving mode set in the first vehicle control interface box is the autonomous driving mode, the first functional unit performs an emergency stop control, the dual-system failure being a failure that makes communication or control via the first and second paths impossible, and when the dual-system failure occurs while the driving mode set in the second vehicle control interface box is the autonomous driving mode, the second functional unit performs the emergency stop control. When the operation of shutting down the base vehicle via the power switch is accepted after the emergency stop control is executed, the first vehicle control interface box will switch the driving mode set in the first vehicle control interface box to the manual driving mode; or when the operation of shutting down the base vehicle via the power switch is accepted after the emergency stop control is executed, the second vehicle control interface box will switch the driving mode set in the second vehicle control interface box to the manual driving mode.

[0008] With this configuration, emergency stop control is performed even if instructions from the autonomous driving suite are not sent to the base vehicle due to a dual-system failure. When the base vehicle is shut down following the emergency stop control, the driving mode is switched to manual driving mode. Therefore, a vehicle platform can be provided that allows switching to manual driving even when instructions from the autonomous driving suite cannot be received.

[0009] When a single system failure occurs when the driving mode set in the first vehicle control interface box is the autonomous driving mode, the first vehicle control interface box switches the driving mode according to the instruction from the autonomous driving kit. The single system failure is a failure that makes communication or control impossible via the first path or the second path. And when the single system failure occurs when the driving mode set in the second vehicle control interface box is the autonomous driving mode, the second vehicle control interface box switches the driving mode according to the instruction from the autonomous driving kit.

[0010] With this configuration, even in the event of a single system failure, autonomous driving can still be achieved through the redundant system. Therefore, the decisions of the autonomous driving suite can be followed. Consequently, control can be executed according to the intentions of the autonomous driving suite.

[0011] When a dual-system failure occurs and an instruction to switch the driving mode to the manual driving mode is received from the autonomous driving suite, the first vehicle control interface box will switch the driving mode set in the first vehicle control interface box to the manual driving mode; or when a dual-system failure occurs and an instruction to switch the driving mode to the manual driving mode is received from the autonomous driving suite, the second vehicle control interface box will switch the driving mode set in the second vehicle control interface box to the manual driving mode.

[0012] With this configuration, even in the event of a dual-system failure, instructions from the autonomous driving suite to switch driving modes can be followed when possible. As a result, control can be executed according to the intentions of the autonomous driving suite.

[0013] When the driving mode set in the first vehicle control interface box is switched to the manual driving mode after the occurrence of the single system failure or the dual system failure, the first vehicle control interface box is prohibited from switching back to the automatic driving mode. Alternatively, when the driving mode set in the second vehicle control interface box is switched to the manual driving mode after the occurrence of the single system failure or the dual system failure, the second vehicle control interface box is prohibited from switching back to the automatic driving mode.

[0014] With this configuration, if the driving mode is switched to manual driving mode after a single-system or dual-system failure, it may be difficult to continue automatic driving. Therefore, preventing switching back to automatic driving mode can improve control reliability.

[0015] According to another aspect of this disclosure, a method for controlling a vehicle platform is a method for controlling an autonomous driving kit that can be attached to and detached from the vehicle platform, which is configured to be capable of autonomous driving, and which is given instructions for autonomous driving. The vehicle platform includes: a base vehicle that performs specific functions for autonomous and manual driving; a first vehicle control interface box that relays control communication between the autonomous driving kit and the base vehicle via a first path; a second vehicle control interface box that relays control communication between the autonomous driving kit and the base vehicle via a second path; and a power switch that accepts operations to turn the base vehicle on or off. A driving mode of the vehicle platform set in each of the first and second vehicle control interface boxes can be switched between an autonomous driving mode and a manual driving mode. The method includes: when a dual-system failure occurs where the driving mode set in the first vehicle control interface box is the automatic driving mode, the first vehicle control interface box controls the base vehicle to perform an emergency stop control, the dual-system failure being a failure that makes communication or control via the first path and the second path impossible; and when the dual-system failure occurs where the driving mode set in the second vehicle control interface box is the automatic driving mode, the second vehicle control interface box controls the base vehicle to perform the emergency stop control; and when, after performing the emergency stop control, an operation to shut down the base vehicle via the power switch is received, the first vehicle control interface box switches the driving mode set in the first vehicle control interface box to the manual driving mode; or when, after performing the emergency stop control, an operation to shut down the base vehicle via the power switch is received, the second vehicle control interface box switches the driving mode set in the second vehicle control interface box to the manual driving mode.

[0016] Based on this configuration, a method for controlling the vehicle platform can be provided, which allows switching to manual driving even when it is not possible to switch to manual driving according to instructions from the autonomous driving suite.

[0017] The foregoing and other objects, features, aspects and advantages of this disclosure will become more apparent when taken in conjunction with the accompanying drawings and the following detailed description of this disclosure. Attached Figure Description

[0018] Figure 1 This is a diagram illustrating a summary of a vehicle according to an embodiment of the present disclosure.

[0019] Figure 2 This is a diagram showing in detail the configuration of ADK, VCIB, and VP according to this embodiment.

[0020] Figure 3 This is a flowchart illustrating the processes performed by each control system and the first process performed by the VCIB in this embodiment.

[0021] Figure 4 This is a flowchart illustrating the process of the second process performed by VCIB in this embodiment. Detailed Implementation

[0022] Embodiments of this disclosure will now be described in detail with reference to the accompanying drawings. Identical or corresponding elements in the drawings are labeled with the same reference numerals and will not be described again.

[0023] Figure 1 This is a diagram illustrating a general outline of a vehicle 1 according to an embodiment of the present disclosure. Figure 2 This is a diagram showing in detail the configuration of ADK 10, VCIB 40, and VP 20 according to this embodiment. (See reference...) Figure 1 and Figure 2 Vehicle 1 includes ADK 10 and VP 20. ADK 10 is configured to attach to VP 20 (which can be mounted on vehicle 1). ADK 10 and VP 20 are configured to communicate with each other via VCIB 40.

[0024] VP 20 can perform autonomous driving based on control requests from ADK 10. Although Figure 1 The ADK 10 is shown positioned away from the VP 20, and is actually attached to the roof of the VP 20, etc. The ADK 10 can also be removed from the VP 20. When the ADK 10 is not attached, the VP 20 performs driving control in manual mode (manual driving mode) (driving control based on user operation).

[0025] ADK 10 includes an Automated Driving System (ADS) 11 for automated driving of vehicle 1. For example, ADS 11 creates a driving plan for vehicle 1. ADS 11 outputs various control requests to VP 20 to drive vehicle 1 according to the driving plan, based on an Application Programming Interface (API) defined for each control request. ADS 11 receives various signals from VP 20 indicating the vehicle state (the state of VP 20) based on an API defined for each signal. ADS 11 then reflects the vehicle state in the driving plan.

[0026] VP 20 includes a base vehicle 30 and VCIB 40. The base vehicle 30 performs various types of vehicle control based on control requests from ADK 10 (ADS 11). The base vehicle 30 includes various onboard systems and various sensors for controlling the base vehicle 30. More specifically, the base vehicle 30 includes an integrated control manager 31, a braking system 32, a steering system 33, a powertrain system 34, an active safety system 35, a body system 36, wheel speed sensors 51 and 52, a pinion angle sensor 53, a camera 54, radar sensors 55 and 56, and a power switch 39.

[0027] The integrated control manager 31 includes a processor such as a central processing unit (CPU) and memories such as read-only memory (ROM) and random access memory (RAM), and integrates control of systems involved in the operation of vehicle 1 (braking system 32, steering system 33, powertrain system 34, active safety system 35, and body system 36).

[0028] The braking system 32 is configured to control braking devices located in each wheel of the base vehicle 30. The braking devices include, for example, disc brake systems that are operated using hydraulic pressure regulated by actuators.

[0029] Wheel speed sensors 51 and 52 are connected to the braking system 32. Wheel speed sensors 51 and 52 detect the rotational speeds of the front and rear wheels of the base vehicle 30 and output the detected rotational speeds to the braking system 32 respectively. The braking system 32 outputs the rotational speed of each wheel as one of multiple pieces of information included in the vehicle status to the VCIB 40. The braking system 32 generates braking commands for the braking devices based on a specified control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31. The braking system 32 controls the braking devices based on the generated braking commands. The integrated control manager 31 can calculate the speed of the vehicle 1 (vehicle speed) based on the rotational speed of each wheel.

[0030] The steering system 33 is configured to control the steering angle (wheel steering angle) of the steering wheel of the vehicle 1 using a steering device. The steering device includes, for example, rack and pinion electric power steering (EPS), which allows the steering angle to be adjusted via an actuator.

[0031] The pinion angle sensor 53 is connected to the steering system 33. The pinion angle sensor 53 detects the rotation angle (pinion angle) of the pinion gear connected to the rotating shaft of the actuator and outputs the detected pinion angle to the steering system 33. The steering system 33 outputs the pinion angle as one of several pieces of information included in the vehicle status to the VCIB 40. The steering system 33 generates steering commands for the steering equipment based on the specified control requests output from the ADS 11 via the VCIB 40 and the integrated control manager 31. The steering system 33 controls the steering equipment based on the generated steering commands.

[0032] The powertrain 34 controls an electric parking brake (EPB) system 341 located in at least one of the plurality of wheels, a parking lock (P lock) system 342 located in the transmission of the vehicle 1, and a propulsion system 343 including a shifting device configured to allow selection of shift gears.

[0033] The active safety system 35 uses camera 54 and radar sensors 55 and 56 to detect obstacles (pedestrians, bicycles, parked vehicles, utility poles, etc.) in front of or behind the vehicle. The active safety system 35 determines whether a collision is likely between the vehicle 1 and the obstacle based on the distance between the vehicle 1 and the obstacle and the direction of the vehicle 1's movement. When the active safety system 35 determines that a collision is possible, it outputs a braking command to the braking system 32 via the integrated control manager 31 to increase braking force.

[0034] The body system 36 is configured to control components such as turn signals (or hazard lights), horn, wipers, headlights, and brake lights based on driving conditions or the environment surrounding the vehicle 1. The body system 36 controls each component according to specified control requests output from the ADS 11 via the VCIB 40 and the integrated control manager 31.

[0035] The power switch 39 is implemented by a push-button switch, and the vehicle 1 is turned on or off each time the user presses the power switch 39.

[0036] VCIB 40 is configured to communicate with ADS11 via a Controller Area Network (CAN). VCIB 40 receives various control requests from ADS11 or outputs vehicle status to ADS11 by executing the defined API for each signal. When VCIB 40 receives a control request from ADK 10, it outputs a control command corresponding to the control request to the system corresponding to the control command via the integrated control manager 31. VCIB 40 obtains various types of information about the base vehicle 30 from various systems via the integrated control manager 31 and outputs the status of the base vehicle 30 as vehicle status to ADS11.

[0037] Vehicle 1 can be used as one of the components of a Mobility as a Service (MaaS) system. In addition to Vehicle 1, the MaaS system also includes, for example, a data server and a Mobility Service Platform (MSPF).

[0038] MSPF is an integrated platform to which various mobility services connect. Autonomous driving-related mobility services connect to MSPF. In addition to autonomous driving-related mobility services, mobility services provided by ride-sharing companies, car-sharing companies, car rental companies, taxi companies, and insurance companies can connect to MSPF.

[0039] Vehicle 1 also includes a data communication module (DCM) capable of wirelessly communicating with a data server. The DCM outputs vehicle information such as speed, location, or autonomous driving status to the data server. The DCM receives various types of data from autonomous driving-related mobility services via MSPF and the data server to manage the operation of autonomous vehicles, including Vehicle 1, within the mobility services.

[0040] MSPF publishes APIs for using various types of data regarding vehicle status and vehicle control required for the development of ADS11. Various mobility services can utilize the various functionalities provided by MSPF based on their service content by using these APIs. For example, autonomous driving-related mobility services can obtain operational control data for vehicle 1 or information stored in a data server from MSPF using these APIs. Autonomous driving-related mobility services can also use the APIs to send data used to manage autonomous vehicles, including vehicle 1, to MSPF.

[0041] ADS11 includes a computing component 111, a human-machine interface (HMI) 112, a sensor for sensing 113, a sensor for posture 114, and a sensor cleaner 115.

[0042] The computing component 111 includes a processor 101, such as a CPU, and a memory 102, such as ROM and RAM. Programs executable by the processor 101 are stored in the memory 102. During autonomous driving of the vehicle 1, the computing component 111 obtains information from various sensors (described later) indicating the environment surrounding the vehicle 1 and information indicating the vehicle 1's posture, actions, and position, and obtains the vehicle state from the VP 20 via the VCIB 40 and sets the next operation (acceleration, deceleration, or turning) for the vehicle 1. The computing component 111 outputs various commands to the VCIB 40 to implement the next operation. The computing component 111 also includes communication modules (each communication module is also referred to below as a "Vehicle Interface Module (VIM)") 111A and 111B. Communication modules 111A and 111B are each configured to communicate with the VCIB 40.

[0043] HMI 112 presents information to the user and accepts user input during autonomous driving, during manual driving requiring user intervention, or during transitions between autonomous driving and manual driving requiring user intervention. HMI 112 includes, for example, input and output devices, such as a touch panel display disposed in the base vehicle 30.

[0044] The sensing sensor 113 is a sensor that senses the environment surrounding the vehicle 1. The sensing sensor 113 includes at least one of, for example, laser imaging detection and ranging (LIDAR), millimeter-wave radar, and a camera. The LIDAR, for example, measures the distance and direction to an object by emitting a laser beam of infrared pulses and detecting the laser beam reflected by the object. The millimeter-wave radar measures the distance and direction to an object by emitting millimeter waves and detecting the millimeter waves reflected by the object. The camera, for example, is arranged on the rear side of the rearview mirror and captures images of the front of the vehicle 1.

[0045] The attitude sensor 114 is a sensor that detects the attitude, movement, or position of vehicle 1. The attitude sensor 114 includes, for example, an inertial measurement unit (IMU) and a global positioning system (GPS). The IMU detects, for example, accelerations in the forward, lateral, and vertical directions of vehicle 1, and angular velocities in the roll, pitch, and yaw directions of vehicle 1. The GPS detects the position of vehicle 1 based on information received from multiple GPS satellites orbiting the Earth.

[0046] Sensor cleaner 115 is configured to remove dirt adhering to various sensors (camera lenses or laser beam emitting parts) with a cleaning solution or wipe during vehicle 1 operation.

[0047] VCIB 40 includes a main VCIB 41 and a sub-VCIB 42. VCIBs 41 and 42 respectively include processors 411 and 421, such as a CPU, and memories 412 and 422, such as ROM and RAM. Programs executable by processors 411 and 421, and data processed by the programs, are stored in memories 412 and 422 respectively. The main VCIB 41 and communication module 111A are communicatively connected to each other via communication bus 43 (main bus). The sub-VCIB 42 and communication module 111B are communicatively connected to each other via communication bus 44 (sub-bus). Furthermore, the main VCIB 41 and sub-VCIB 42 are communicatively connected to each other.

[0048] VCIBs 41 and 42 relay control requests and vehicle information between ADS11 and VP 20, respectively. VCIBs 41 and 42 are connected between the base vehicle 30 and ADS11 via communication buses 43 and 44, respectively. VCIBs 41 and 42 each use an API to generate control commands from control requests received from ADS11.

[0049] For example, control commands corresponding to control requests provided from ADS11 to VCIB 40 include a forward direction command requesting to switch gears, a stationary command requesting to activate / deactivate EPB system 341 and P lock system 342, an acceleration command requesting to accelerate or decelerate vehicle 1, a wheel steering angle command requesting to adjust the wheel steering angle, an automation command requesting to switch between automatic mode (automatic driving mode) and manual mode (manual driving mode), and a stationary command requesting to keep the vehicle stationary or release the vehicle from stationary.

[0050] Then, VCIBs 41 and 42 each output the generated control commands to the corresponding systems among the multiple systems included in VP 20. VCIBs 41 and 42 each use the API to generate information indicating the vehicle status based on vehicle information from each system in VP 20. This information indicating the vehicle status can be the same as the vehicle information, or it can be information extracted from the vehicle information for processing performed by ADS11. VCIBs 41 and 42 each output the generated information indicating the vehicle status to ADS11.

[0051] Braking system 32 includes braking systems 321 and 322. Steering system 33 includes steering systems 331 and 332. Powertrain system 34 includes wheel lock control system 340 and propulsion system 343.

[0052] Although VCIB 41 and VCIB 42 are essentially equivalent in function, they differ in some aspects regarding the systems connected to them within VP 20. Specifically, the main VCIB 41, braking system 321, steering system 331, EPB system 341, P lock system 342, propulsion system 343, and body system 36 are communicatively connected to each other via a communication bus. The sub-VCIB 42, braking system 322, steering system 332, and P lock system 342 are communicatively connected to each other via a communication bus.

[0053] Since functionally equivalent VCIBs 41 and 42, which are associated with the operation of at least one (e.g., braking or steering) system, are included in VCIB 40, the control system between ADS11 and VP 20 is redundant. Therefore, in the event of a fault in the system, the function of VP20 can be maintained by appropriately switching or disconnecting the faulty control system between the control systems.

[0054] Braking systems 321 and 322 respectively include processors 3211 and 3221 such as a CPU, and memories 3212 and 3222 such as ROM and RAM. Braking systems 321 and 322 are each configured to control braking devices. Braking systems 321 and 322 generate braking commands to the braking devices based on control requests output from ADS11 via VCIB 41 and 42, respectively. Braking systems 321 and 322 may be functionally equivalent to each other. Alternatively, one of braking systems 321 and 322 may be configured to independently control the braking force of each wheel, and the other may be configured to control the braking force such that equal braking forces are generated in the wheels. For example, braking systems 321 and 322 may control the braking devices based on braking commands generated by either of them, and in the event of a malfunction in the braking system, they may control the braking devices based on braking commands generated by the other of them.

[0055] Steering systems 331 and 332 respectively include processors 3311 and 3321 such as a CPU, and memories 3312 and 3322 such as ROM and RAM. Steering systems 331 and 332 are each configured to control the steering angle of the steering wheel of vehicle 1 using a steering device. Steering systems 331 and 332 generate steering commands to the steering device based on control requests output from ADS11 via VCIB 41 and 42, respectively. Steering systems 331 and 332 may be functionally equivalent to each other. Alternatively, steering systems 331 and 332 may control the steering device based on steering commands generated by either of them, and in the event of a malfunction in the steering system, they may control the steering device based on steering commands generated by the other one.

[0056] The wheel lock control system 340 is connected to the VCIB 40 and includes the EPB system 341 and the P lock system 342.

[0057] The EPB system 341 includes a processor 3411 such as a CPU and a memory 3412 such as ROM and RAM. The EPB system 341 controls the EPB according to control requests output from the ADS11 via the VCIB 41. The EPB is separate from the braking equipment (disc brake system, etc.) and secures the wheels by the operation of actuators. For example, the EPB uses an actuator to activate a drum brake (used as a parking brake) in at least one of a plurality of wheels to secure the wheel, or uses an actuator capable of adjusting the hydraulic pressure supplied to the braking equipment separately from the braking systems 321 and 322 to activate the braking equipment to secure the wheel. The EPB system 341 has a brake holding function and is configured to switch between activation and deactivation of brake holding.

[0058] The P-lock system 342 includes a processor 3421 such as a CPU and a memory 3422 such as ROM and RAM. The P-lock system 342 is connected to the VCIB 42. The P-lock system 342 controls the P-lock device according to control requests output from the ADS 11 via the VCIB 41. For example, when the control request includes a request to set the shift gear to the parking gear (P gear), the P-lock system 342 activates the P-lock device, and when the control request includes a request to set the shift gear to a shift gear other than P gear, it deactivates the P-lock device. The P-lock device mates a protrusion (the position of which is adjusted by an actuator) located at the tip of the parking lock pawl into the teeth of a gear (locking gear) configured to connect with a rotating element in the transmission of vehicle 1. Therefore, the rotation of the transmission output shaft is fixed, and the wheels are fixed.

[0059] The propulsion system 343 includes a processor 3431 such as a CPU and a memory 3432 such as ROM and RAM. The propulsion system 343 includes a steering control system and a propulsion system. The steering control system is connected to the VCIB 40. The steering control system controls the driving direction (forward or backward) of the VP 20 by switching the shift gears of the shifting device according to a control request output from the ADS 11 via the VCIB 41. In addition to P and neutral (N), the shift gears include a forward driving gear (D) and a reverse driving gear (R). The propulsion system is connected to the VCIB 40. The propulsion system controls the propulsion force (e.g., acceleration and deceleration) of the VP 20 by controlling the driving force from the drive source (electric generator and engine).

[0060] The active safety system 35 includes a processor 351 such as a CPU and a memory 352 such as ROM and RAM. The active safety system 35 is communicatively connected to the braking system 321. As previously described, the active safety system 35 detects obstacles ahead using a camera 54 and / or a radar sensor 55, and when it determines that there is a possibility of collision, it outputs a braking command to the braking system 321 to increase braking force.

[0061] The body system 36 includes a processor 361 such as a CPU and a memory 362 such as ROM and RAM. The body system 36 controls components such as the turn indicator, horn and wipers according to control requests output from the ADS11 via VCIB 41.

[0062] For example, when a user selects the automatic mode (autopilot mode) via operation on the HMI 112 in vehicle 1, autonomous driving is executed. During autonomous driving, ADS 11 initially creates a driving plan as described above. Examples of driving plans include a plan to continue driving in a straight line, a plan to turn left / right at a predetermined intersection on a predetermined driving path, and a plan to change driving lanes. ADS 11 calculates the controllable physical quantities (acceleration, deceleration, and wheel steering angle) required for the operation of vehicle 1 based on the created driving plan. ADS 11 segments the physical quantities for each execution cycle of the API. ADS 11 outputs a control request representing the segmented physical quantities to VCIB 40 via the API. Furthermore, ADS 11 obtains the vehicle state (the actual direction of movement of vehicle 1 and the stationary state of the vehicle) from VP 20 and recreates a driving plan reflecting the obtained vehicle state. Therefore, ADS 11 enables autonomous driving of vehicle 1.

[0063] As described above, in vehicle 1, there are two systems serving as the path for exchanging signals between ADK 10 and VP 20: a first path via communication bus 43, which serves as the main bus, and main VCIB 41; and a second path via communication bus 44, which serves as the sub-bus, and sub-VCIB 42. When both paths fail, ADK 10 cannot instruct VP 20 to switch to manual driving, which may make it impossible to move the base vehicle 30 by manual driving.

[0064] Therefore, when a dual-system failure occurs that makes communication or control via the first and second paths impossible when the driving mode set in VCIB 41 is automatic driving mode, the first functional unit of the base vehicle 30 (e.g., braking systems 321 and 322 or steering systems 331 and 332) performs emergency stop control. And when a dual-system failure occurs when the driving mode set in VCIB 42 is automatic driving mode, the second functional unit of the base vehicle 30 (e.g., braking systems 321 and 322 or steering systems 331 and 332) performs emergency stop control. When the base vehicle 30 is turned off via power switch 39 after the emergency stop control is performed, VCIB 41 will switch the driving mode set in VCIB 41 to manual driving mode; or when the base vehicle 30 is turned off via power switch 39 after the emergency stop control is performed, VCIB 42 will switch the driving mode set in VCIB 42 to manual driving mode.

[0065] Therefore, emergency stop control is performed even if no command is sent from ADK 10 to the base vehicle 30 due to a dual-system failure. When the base vehicle 30 is shut down after emergency stop control, the driving mode switches to manual driving mode. Therefore, manual driving can be switched even if a switch to manual driving is not possible based on a command from ADK 10.

[0066] Figure 3 This is a flowchart illustrating the processes performed by each control system and the first process performed by each of VCIBs 41 and 42 in this embodiment. (See reference) Figure 3 The processing of each control system is invoked by a higher-level processing unit and is executed at a predetermined cycle by each of the processors 3211 and 3221 of braking systems 321 and 322 and the processors 3311 and 3321 of steering systems 331 and 332 (hereinafter referred to as "processors of the control systems"). The processing of each VCIB is invoked by a higher-level processing unit and is executed at a predetermined cycle by each of the processors 411 and 421 of VCIBs 41 and 42.

[0067] The processor of the control system determines whether a single-system fault has been detected that makes communication or control via the first path or the second path impossible (step S311). When the processor of the control system determines that a single-system fault has been detected (yes in step S311), the processor of the control system notifies each of VCIBs 41 and 42 that a single-system fault has been detected (step S312).

[0068] Each of the processors 411 and 421 of VCIB 41 and 42 determines whether it has received a notification from the control system regarding the detection of a single system fault (step S411). When each of the processors 411 and 421 of VCIB 41 and 42 determines that it has received a notification from any control system regarding the detection of a single system fault (yes in step S411), each of the processors 411 and 421 of VCIB 41 and 42 switches the single system fault flag indicating whether a single system fault has occurred to an on state indicating that a single system fault has occurred (step S412).

[0069] Each processor 411 and 421 of VCIB 41 and 42 determines whether the driving mode of each of VCIB 41 and 42 is the automatic driving mode (step S413). When each processor 411 and 421 of VCIB 41 and 42 determines that the driving mode of each of VCIB 41 and 42 is the automatic driving mode (yes in step S413), each processor 411 and 421 of VCIB 41 and 42 continues to control the automatic driving of the base vehicle 30 (step S414).

[0070] The processor of the control system determines whether a dual-system fault has been detected that makes communication or control via the first and second paths impossible (step S313). When the processor of the control system determines that a dual-system fault has been detected (yes in step S313), the processor of the control system notifies each of VCIBs 41 and 42 that a dual-system fault has been detected (step S314). In addition, the processor of the control system notifies the other control systems that a dual-system fault has been detected (step S315).

[0071] When each of the processors 411 and 421 of VCIB 41 and 42 determines that it has not received any notification from any control system regarding the detection of a single system failure (No in step S411), when each of the processors 411 and 421 of VCIB 41 and 42 determines that the driving mode of each of VCIB 41 and 42 is not the automatic driving mode (No in step S413), or after step S414, when each of the processors 411 and 421 of VCIB 41 and 42 determines whether it has received any notification from the control system regarding the detection of a dual system failure (Step S415). When each of the processors 411 and 421 of VCIB 41 and 42 determines that it has received notification from any control system regarding the detection of a dual-system fault (Yes in step S415), each of the processors 411 and 421 of VCIB 41 and 42 switches the dual-system fault flag indicating whether a dual-system fault has occurred to an on state indicating that a dual-system fault has occurred (step S416), and instructs each control system to perform emergency stop control (step S417). Thereafter, each of the processors 411 and 421 of VCIB 41 and 42 causes the processing to be performed to proceed as described below. Figure 4 The processing of numbers starting with the circled number "1".

[0072] When the processor of the control system determines that a dual-system fault has not yet been detected (No in step S313), the processor of the control system determines whether it has received notification from other control systems that a dual-system fault has been detected (step S316). When the processor of the control system determines that it has not received notification from other control systems that a dual-system fault has been detected (No in step S316), the processor of the control system determines whether it has received an emergency stop instruction from each of VCIBs 41 and 42 (step S317).

[0073] When the processor of the control system determines that it has received an emergency stop instruction from each of VCIBs 41 and 42 (Yes in step S317), when the processor of the control system determines that it has received notification from other control systems regarding the detection of a dual-system failure (Yes in step S316), or after step S315, the processor of the control system executes emergency stop control of the base vehicle 30 (step S318). When the processor of the control system determines that it has not received an emergency stop instruction from each of VCIBs 41 and 42 (No in step S317), or after step S318, the processor of the control system returns the process to be executed to the higher-level process from which each control system invokes the process.

[0074] Figure 4This is a flowchart illustrating the flow of the second process performed by each of VCIBs 41 and 42 in this embodiment. (See reference...) Figure 4 This processing is performed by each of processors 411 and 421 of VCIB 41 and 42. Figure 3 The first process shown is executed at a predetermined cycle.

[0075] When each of the processors 411 and 421 of VCIB 41 and 42 determines that it has not received notification from any control system regarding the detection of a dual-system failure ( Figure 3 In step S415, if no, or after step S417, each of the processors 411 and 421 of VCIB 41 and 42 determines whether the single-system fault flag or the dual-system fault flag is in the on state (step S421).

[0076] When each of the processors 411 and 421 of VCIB 41 and 42 determines that the single-system fault flag or the dual-system fault flag is in the on state (Yes in step S421), each of the processors 411 and 421 of VCIB 41 and 42 determines whether it has received an instruction from ADK 10 for switching to manual driving (step S422). When each of the processors 411 and 421 of VCIB 41 and 42 determines that it has received an instruction from ADK 10 for switching to manual driving (Yes in step S422), each of the processors 411 and 421 of VCIB 41 and 42 switches the driving mode to manual driving mode (step S423).

[0077] When each of the processors 411 and 421 of VCIB 41 and 42 determines that it has not yet received an instruction from ADK 10 to switch to manual driving (No in step S422), each of the processors 411 and 421 of VCIB 41 and 42 determines whether it has received an instruction from ADK 10 to switch to automatic driving (step S424). When each of the processors 411 and 421 of VCIB 41 and 42 determines that it has received an instruction from ADK 10 to switch to automatic driving (Yes in step S424), each of the processors 411 and 421 of VCIB 41 and 42 determines whether the currently set driving mode is manual driving mode (step S425). When each of the processors 411 and 421 of VCIB 41 and 42 determines that the currently set driving mode is manual driving mode (Yes in step S425), each of the processors 411 and 421 of VCIB 41 and 42 maintains the currently set driving mode (step S426).

[0078] When each of the processors 411 and 421 of VCIB 41 and 42 determines that it has not yet received an instruction from ADK 10 to switch to automatic driving (No in step S424), when each of the processors 411 and 421 of VCIB 41 and 42 determines that the currently set driving mode is not manual driving mode (No in step S425), after step S423 or after step S426, each of the processors 411 and 421 of VCIB 41 and 42 determines whether the single system fault flag is in the on state (step S431).

[0079] When each of the processors 411 and 421 of VCIB 41 and 42 determines that the single-system fault flag is on (Yes in step S431), each of the processors 411 and 421 of VCIB 41 and 42 determines whether the user has accepted the operation of turning off the base vehicle 30 via the power switch 39 (step S432). When each of the processors 411 and 421 of VCIB 41 and 42 determines that the operation of turning off the base vehicle 30 via the power switch 39 has been accepted (Yes in step S432), each of the processors 411 and 421 of VCIB 41 and 42 maintains the currently set driving mode (step S433).

[0080] When each of the processors 411 and 421 of VCIB 41 and 42 determines whether the single system fault flag is not in the open state (No in step S431), when each of the processors 411 and 421 of VCIB 41 and 42 has not yet accepted the operation of shutting down the base vehicle 30 by the power switch 39 (No in step S432), or after step S433, when each of the processors 411 and 421 of VCIB 41 and 42 determines whether the dual system fault flag is in the open state (step S441).

[0081] When each of the processors 411 and 421 of VCIB 41 and 42 determines that the dual-system fault flag is on (Yes in step S441), each of the processors 411 and 421 of VCIB 41 and 42 determines whether it has occurred after an emergency stop (step S442). When each of the processors 411 and 421 of VCIB 41 and 42 determines that it has occurred after an emergency stop (Yes in step S442), each of the processors 411 and 421 of VCIB 41 and 42 determines whether the user has accepted the operation to shut down the base vehicle 30 via the power switch 39 (step S442).

[0082] When each of the processors 411 and 421 of VCIB 41 and 42 determines that the operation of turning off the base vehicle 30 via the power switch 39 has been accepted (Yes in step S442), if the driving mode is automatic driving mode, then each of the processors 411 and 421 of VCIB 41 and 42 switches the driving mode to manual driving mode (if the driving mode is manual driving mode, then the driving mode is maintained) (step S444).

[0083] When each of the processors 411 and 421 of VCIB 41 and 42 has not yet accepted the operation of turning off the base vehicle 30 by power switch 39 (No in step S442), each of the processors 411 and 421 of VCIB 41 and 42 determines whether the user has accepted the operation of turning on the base vehicle 30 by power switch 39 (step S445).

[0084] When each of the processors 411 and 421 of VCIB 41 and 42 determines that the operation of turning on the base vehicle 30 via the power switch 39 has been accepted (Yes in step S445), each of the processors 411 and 421 of VCIB 41 and 42 determines whether the currently set driving mode is manual driving mode (step S446). When each of the processors 411 and 421 of VCIB 41 and 42 determines that the currently set driving mode is not manual driving mode (No in step S446), each of the processors 411 and 421 of VCIB 41 and 42 switches the driving mode to manual driving mode (step S447).

[0085] When each of the processors 411 and 421 of VCIB 41 and 42 determines that the single-system fault flag and the dual-system fault flag are not in the open state (No in step S421 or step S441), when each of the processors 411 and 421 of VCIB 41 and 42 determines that it is not after an emergency stop (No in step S442), when each of the processors 411 and 421 of VCIB 41 and 42 determines that the base vehicle 30 has not yet been turned on by the power switch 39 (No in step S445), when each of the processors 411 and 421 of VCIB 41 and 42 determines that the currently set driving mode is manual driving mode (Yes in step S446), after step S444 or after step S447, the process to be executed by each of the processors 411 and 421 of VCIB 41 and 42 returns to the higher-level process from which the respective VCIB invoked the process.

[0086] [Variation Example]

[0087] (1) In the above embodiments, the first and second functional units (such as braking systems 321 and 322 or steering systems 331 and 332) that perform specific functions for autonomous and manual driving can communicate directly with other functional units (e.g., braking systems 321 and 322, steering systems 331 and 332, EPB system 341, P lock system 342, propulsion system 343, active safety system 35, and body system 36). However, this disclosure is not limited thereto, and these functional units may communicate indirectly with other functional units only through VCIB 41 and 42.

[0088] (2) In the above embodiments, each of the first and second functional units (such as braking systems 321 and 322 or steering systems 331 and 332) that perform specific functions for autonomous and manual driving has a processor and a memory. The first and second functional units cooperate with VCIBs 41 and 42 to perform specific functions of the base vehicle 30. However, the functions of VCIBs 41 and 42, as well as the processors and memories of the respective functional units, can be allocated in any way. For example, a portion of the functions performed by the processors and memories of the respective functional units may be performed by VCIBs 41 and 42.

[0089] (3) In the above embodiments, power switches 39 and VCIBs 41 and 42 exchange signals indirectly through the vehicle body system 36. However, this disclosure is not limited thereto, and power switches 39 and VCIBs 41 and 42 can exchange signals directly.

[0090] (4) The above embodiments may be considered as disclosures of devices such as vehicle 1, ADK 10, ADS11, VP 20, base vehicle 30 or VCIB 41 and 42, or as disclosures of control methods or control programs in the devices.

[0091] [Summarize]

[0092] (1) As Figure 1 and Figure 2 As shown, VP 20 is a VP that can attach to and detach from ADK 10 to provide instructions for autonomous driving, and this VP is configured to be capable of autonomous driving. Figure 1 and Figure 2As shown, VP 20 includes: a base vehicle 30 that performs specific functions for autonomous and manual driving (e.g., braking or steering functions), the base vehicle 30 including a first functional unit and a second functional unit (e.g., a first braking system 321 and a second braking system 322 or a first steering system 331 and a second steering system 332); a VCIB 41 that relays control communication between ADK 10 and the first functional unit (e.g., braking system 321 or steering system 331) via a first path (e.g., a path including communication bus 43); a VCIB 42 that relays control communication between ADK 10 and the second functional unit (e.g., braking system 322 or steering system 332) via a second path (e.g., a path including communication bus 44); and a power switch 39 that accepts operations to turn the base vehicle 30 on or off.

[0093] like Figures 1 to 4 As shown, the driving mode of VP 20 set in each of VCIBs 41 and 42 can be switched between automatic driving mode and manual driving mode. For example... Figure 3 As shown, when a dual-system failure occurs while the driving mode set in VCIB 41 is automatic driving mode, the first functional unit executes emergency stop control (e.g., step S318). A dual-system failure is a failure that makes communication or control via the first and second paths impossible. When a dual-system failure occurs while the driving mode set in VCIB 42 is automatic driving mode, the second functional unit executes emergency stop control. When the base vehicle 30 is shut down via power switch 39 after the emergency stop control is executed, VCIB 41 switches the driving mode set in VCIB 41 to manual driving mode (e.g., steps S441 to S444). Alternatively, when the base vehicle 30 is shut down via power switch 39 after the emergency stop control is executed, VCIB 42 switches the driving mode set in VCIB 42 to manual driving mode.

[0094] Therefore, even if an instruction from ADK 10 is not sent to the base vehicle 30 due to a dual-system failure, emergency stop control is still performed. When the base vehicle 30 is shut down after emergency stop control, the driving mode is switched to manual driving mode. Therefore, even if manual driving cannot be switched to according to the instruction from ADK 10, manual driving can still be switched to. Therefore, when a repairman or others move vehicle 1 using a trailer or the like, the repairman can move vehicle 1 by manual driving.

[0095] (2) Figure 4As shown, when a single system failure occurs while the driving mode set in VCIB 41 is the automatic driving mode, VCIB 41 can switch the driving mode according to the instructions from ADK 10 (e.g., steps S421 to S423). A single system failure is a failure that makes communication or control via the first path or the second path impossible. And when a single system failure occurs while the driving mode set in VCIB 42 is the automatic driving mode, VCIB 42 can switch the driving mode according to the instructions from ADK 10.

[0096] Therefore, even in the event of a single system failure, automatic driving can still be achieved through redundant systems. Thus, the decisions made in ADK 10 can be followed. Consequently, control can be executed according to the intent of ADK 10.

[0097] (3) Figure 4 As shown, when a dual-system failure occurs and an instruction to switch the driving mode to manual driving mode is received from ADK 10, VCIB 41 can switch the driving mode set in VCIB 41 to manual driving mode (e.g., steps S421 to S423). Alternatively, when a dual-system failure occurs and an instruction to switch the driving mode to manual driving mode is received from ADK 10, VCIB 42 can switch the driving mode set in VCIB 42 to manual driving mode.

[0098] Therefore, even in the event of a dual-system failure, the driving mode switching command from ADK 10 can be followed when it is possible. As a result, control can be executed according to the intent of ADK 10.

[0099] (4) Figure 4 As shown, when the driving mode set in VCIB 41 is switched to manual driving mode after a single system failure or a dual system failure, VCIB 41 can prevent switching back to automatic driving mode (e.g., steps S421 and S424 to S426), or when the driving mode set in VCIB 42 is switched to manual driving mode after a single system failure or a dual system failure, VCIB 42 can prevent switching back to automatic driving mode.

[0100] Therefore, when the driving mode is switched to manual driving mode after a single-system or dual-system failure, it may be difficult to continue automatic driving. Therefore, preventing switching back to automatic driving mode can improve control reliability.

[0101] Although embodiments of this disclosure have been described, it should be understood that the embodiments disclosed herein are illustrative and not restrictive in all respects. The scope of this disclosure is defined by the terminology of the claims and is intended to include any modifications within the scope and meaning equivalent to the terminology of the claims.

Claims

1. A vehicle platform, wherein an autonomous driving kit, which provides instructions for autonomous driving, can be attached to and detached from the vehicle platform, the vehicle platform being configured to drive autonomously, the vehicle platform comprising: The base vehicle includes a first functional unit and a second functional unit that perform specific functions for autonomous driving and manual driving. The first vehicle control interface box relays the control communication between the autonomous driving kit and the first functional unit via a first path; The second vehicle control interface box relays control communication between the autonomous driving kit and the second functional unit via the second path; as well as A power switch, which accepts the operation of turning the base vehicle on or off, wherein The driving mode of the vehicle platform set in each of the first vehicle control interface box and the second vehicle control interface box can be switched to either automatic driving mode or manual driving mode. When a dual-system failure occurs when the driving mode set in the first vehicle control interface box is the automatic driving mode, the first functional unit executes emergency stop control. The dual-system failure is one that makes communication or control via the first path and the second path impossible. When the dual-system failure occurs when the driving mode set in the second vehicle control interface box is the automatic driving mode, the second functional unit executes the emergency stop control, and When the operation of shutting down the base vehicle via the power switch is accepted after the emergency stop control is executed, the first vehicle control interface box will switch the driving mode set in the first vehicle control interface box to the manual driving mode, or When the operation of shutting down the base vehicle via the power switch is accepted after the emergency stop control is executed, the second vehicle control interface box will switch the driving mode set in the second vehicle control interface box to the manual driving mode.

2. The vehicle platform according to claim 1, wherein When a single-system failure occurs when the driving mode set in the first vehicle control interface box is the autonomous driving mode, the first vehicle control interface box switches the driving mode according to instructions from the autonomous driving suite. The single-system failure is one that makes communication or control via the first path or the second path impossible. When the single system failure occurs when the driving mode set in the second vehicle control interface box is the autonomous driving mode, the second vehicle control interface box switches the driving mode according to the instructions from the autonomous driving kit.

3. The vehicle platform according to claim 2, wherein When a dual-system failure occurs and an instruction to switch the driving mode to the manual driving mode is received from the autonomous driving suite, the first vehicle control interface box will switch the driving mode set in the first vehicle control interface box to the manual driving mode, or When the dual-system failure occurs and an instruction to switch the driving mode to the manual driving mode is received from the autonomous driving kit, the second vehicle control interface box will switch the driving mode set in the second vehicle control interface box to the manual driving mode.

4. The vehicle platform according to claim 3, wherein When the driving mode set in the first vehicle control interface box is switched to the manual driving mode after the occurrence of the single system failure or the dual system failure, the first vehicle control interface box is prohibited from switching back to the automatic driving mode, or When the driving mode set in the second vehicle control interface box is switched to the manual driving mode after the occurrence of the single system failure or the dual system failure, the second vehicle control interface box is prohibited from switching back to the automatic driving mode.

5. A method for controlling a vehicle platform, wherein an autonomous driving kit, which provides instructions for autonomous driving, is capable of being attached to and detached from the vehicle platform, the vehicle platform being configured to drive autonomously. The vehicle platform includes: The base vehicle performs specific functions for both autonomous and manual driving; A first vehicle control interface box relays control communication between the autonomous driving kit and the base vehicle via a first path; The second vehicle control interface box relays control communication between the autonomous driving kit and the base vehicle via a second path; as well as A power switch that accepts the operation of turning the base vehicle on or off. The driving mode of the vehicle platform set in each of the first vehicle control interface box and the second vehicle control interface box can be switched to an automatic driving mode or a manual driving mode, and the method includes: When a dual-system failure occurs when the driving mode set in the first vehicle control interface box is the automatic driving mode, the first vehicle control interface box controls the base vehicle to perform an emergency stop control. The dual-system failure is a failure that makes communication or control via the first path and the second path impossible. When a dual-system failure occurs while the driving mode set in the second vehicle control interface box is the automatic driving mode, the second vehicle control interface box controls the base vehicle to perform the emergency stop control; and When the base vehicle is shut down via the power switch after the emergency stop control is executed, the first vehicle control interface box will switch the driving mode set in the first vehicle control interface box to the manual driving mode; or When the operation of shutting down the base vehicle via the power switch is accepted after the emergency stop control is performed, the second vehicle control interface box will switch the driving mode set in the second vehicle control interface box to the manual driving mode.

Images