VEHICLE CONTROL SYSTEM

Abstract

Vehicle control system (100, 200) mounted in a vehicle, comprising a controller (30, 40) configured to perform automatic driving control of the vehicle, wherein the control (30, 40) is further configured: to select a first or second automatic driving mode as an operating mode for executing automatic driving control, wherein the first automatic driving mode is selected when a first execution condition, comprising a first vehicle condition and a first driver condition, is met, and the second automatic driving mode is selected when the first and a second execution condition, comprising a second vehicle condition and a second driver condition, are met, the second vehicle condition being stricter than the first vehicle condition; and During the execution of the automatic driving control, an override coordination process is performed to coordinate an override request from a driver of the vehicle. where the control (30, 40) is configured in the override coordination process: to determine which of the first and second automatic driving modes is selected; and, If it is determined that the second automatic driving mode is selected, the acceptance of the override request is made more difficult than if it is determined that the first automatic driving mode is selected.

Description

Technical area

[0001] The present disclosure relates to a vehicle control system mounted in a vehicle. background

[0002] JP 2006-318446 A discloses a driving assistance device. This conventional device switches between automatic and manual driving by operating a switch. Automatic driving includes fully automatic driving and semi-automatic driving. In other words, according to the conventional device, an operating mode is switched between fully automatic driving, semi-automatic driving, and manual driving by operating the switch.

[0003] DE 11 2010 002 279 T5 describes a driving assistance device having a first control section that controls a vehicle to perform automated driving, and a second control section that controls a vehicle to switch to manual driving in which the vehicle travels based on a driving operation by a driver when the automated driving is canceled, and changes a manner of canceling the automated driving according to a time elapsed since a start of the automated driving.

[0004] US 2019 / 0 092 341 A1 describes vehicle systems that include one or more control computing devices configured to send commands to one or more actuators of the vehicle to control deceleration, acceleration and steering.

[0005] US 2017 / 0 240 186 A1 describes a vehicle control device with a control unit for executing a first driving mode in which at least one of acceleration / deceleration and steering of the vehicle is automatically controlled based on an action plan. A handover control unit commands switching to a second driving mode in which the degree of automated driving is lower than in the first driving mode when the occupant operates the actuating device to command acceleration / deceleration and / or steering in the first driving mode. Summary

[0006] Automatic driving is realized by executing automatic driving control. One operating mode for executing this automatic driving control is a case where two selectable automatic driving modes are provided. In this case, it is expected that one of the two automatic driving modes has a relatively higher reliability for automatic driving control than the other automatic driving mode.

[0007] Consider a case where a driver performs an override of the automatic driving control in a vehicle using two automatic driving modes. If the override is equally easy to perform in the two automatic driving modes, the following problem arises. That is, if the override is too easy to perform in the highly reliable automatic driving mode, the driver may experience a strange feeling. This problem also occurs when override cannot be performed in the less reliable automatic driving mode.

[0008] It is an object of the present disclosure to provide a technique for suppressing the driver's strange feeling regarding the ease of oversteering during execution of the automatic driving control in the vehicle in which the two automatic driving modes are applied.

[0009] A first aspect of the present disclosure includes a vehicle control system mounted in a vehicle. The vehicle control system includes a controller configured to perform automatic driving control of the vehicle.The controller is further configured to select a first or second automatic driving mode as an operation mode for executing the automatic driving control, wherein the first automatic driving mode is selected when a first execution condition including a first vehicle condition and a first driver condition is satisfied, and the second automatic driving mode is selected when the first and a second execution condition including a second vehicle condition and a second driver condition are satisfied, wherein the second vehicle condition is stricter than the first vehicle condition, and to execute an oversteer tuning process during the execution of the automatic driving control to tune an oversteer request from a driver of the vehicle.In the override tuning process, the controller is configured to determine which of the first and second automatic driving modes is selected and, if it is determined that the second automatic driving mode is selected, to make acceptance of the override request more difficult than if it is determined that the first automatic driving mode is selected.

[0010] A second aspect of the present disclosure further includes, in addition to the first aspect, the following: When it is determined in the override tuning process that the second automatic driving mode is selected, the controller is further configured to execute an invalidation process to invalidate the override request.

[0011] A third aspect of the present disclosure, in addition to the second aspect, further includes the following. The control system further includes a detection device configured to detect the override request. In the invalidation process, the controller is further configured to substantially prohibit the override request from being input to the detection device.

[0012] A fourth aspect of the present disclosure further includes, in addition to the second aspect, the following. In the invalidation process, the controller is further configured to block the transmission of the override request to a vehicle device as a target of the override request.

[0013] A fifth aspect of the present disclosure further includes, in addition to the second aspect, the following: In the invalidation process, the controller is further configured to prevent the processing of the override request in the controller.

[0014] A sixth aspect of the present disclosure further includes, in addition to the second aspect, the following. In the invalidation process, the controller is further configured to prevent a change to a current driving plan of the vehicle based on the override request.

[0015] A seventh aspect of the present disclosure further includes, in addition to the second aspect, the following. In the invalidation process, the controller is further configured to prevent switching of the operating modes based on the override request.

[0016] An eighth aspect of the present disclosure, in addition to any one of the first to seventh aspects, further includes the following: When it is determined in the oversteer tuning process that the first driving mode is selected, the controller is further configured to unconditionally accept the oversteer request.

[0017] A ninth aspect of the present disclosure further includes, in addition to any one of the first to eighth aspects, the following. The controller is further configured to perform alarm control for an occupant of the vehicle during execution of the automatic driving control. In the alarm control, the controller is further configured to determine which of the first and second automatic driving modes is selected, and, when it is determined that the second automatic driving mode is selected, lower an alarm level for the occupant compared to when it is determined that the first automatic driving mode is selected.

[0018] A tenth aspect of the present disclosure further includes, in addition to any one of the first to ninth aspects, the following: The controller is further configured to determine, during execution of the automatic driving control, whether a termination condition for terminating the execution of the invalidation process to invalidate the override request is met, and, if it is determined that the termination condition is met, to terminate the execution of the invalidation process on a vehicle device belonging to a set of device types for which the termination condition is met.

[0019] An eleventh aspect of the present disclosure further includes the following, in addition to the tenth aspect. The controller is further configured to determine, during execution of the automatic driving control, whether an exception condition for rejecting termination of the execution of an invalidation process is met, and, if it is determined that the exception condition is met, reject termination of the execution of the invalidation process on a vehicle device belonging to a set of device types for which the exception condition is met.

[0020] According to the first aspect, the oversteer adjustment process is performed. According to the oversteer adjustment process, when it is determined that the second automatic driving mode is selected, the oversteer request is made less acceptable than when it is determined that the first automatic driving mode is selected. Therefore, in the vehicle in which the first and second automatic driving modes are adopted, it is possible to suppress the driver's strange feeling regarding the ease of oversteer during the execution of the automatic driving control.

[0021] According to the second to seventh aspects, when it is determined that the second automatic driving mode is selected, the invalidation process is executed to invalidate the override request. According to the invalidation process, driver intervention that could interfere with the automatic driving control is invalidated. This makes it possible to improve the controllability of the automatic driving control.

[0022] According to the eighth aspect, when it is determined that the first automatic driving mode is selected, the override request is accepted without reservation. This makes it possible to provide the driver with an opportunity to intervene in the automatic driving control.

[0023] According to the ninth aspect, alarm control is performed. According to the alarm control, when it is determined that the second automatic driving mode is selected, the alarm level is lowered compared to the case where it is determined that the first automatic driving mode is selected. When the alarm level is lowered, the frequency of driver intervention in the automatic driving control is expected to decrease. Therefore, it is possible to improve the controllability of the automatic driving control.

[0024] According to the tenth aspect, when it is determined that the termination condition is met, the execution of the invalidation process is terminated in the in-vehicle device belonging to the series of device types for which the termination condition is met. Therefore, even during the selection of the second automatic driving mode, it is possible to allow the driver to operate the in-vehicle device belonging to the series of device types for which the termination condition is met.

[0025] According to the eleventh aspect, if it is determined that the exception condition is met, the termination of the execution of the invalidation process on the vehicle device belonging to the set of device types for which the exception condition is met is prohibited. Therefore, even if the termination condition is met during the selection of the second automatic driving mode, it is possible to execute the invalidation process. Short description of the drawings Fig. 1 is a block diagram showing a configuration example of a vehicle control system according to a first embodiment; Fig. 2 is a block diagram showing a functional configuration example of a controller related to automatic driving control; Fig. 3 is a flowchart for explaining a flow of the switching process executed by a mode switching section in the first embodiment; Fig. 4 is a flowchart for explaining the flow of an overdrive tuning process executed by an overdrive tuning section in the first embodiment; Fig. 5 is a block diagram illustrating an invalidation process; Fig. 6 is a flowchart for explaining the flow of a first alarm control process executed by an alarm control section in the first embodiment; Fig. 7 is a flowchart for explaining the flow of a second alarm control process executed by the alarm control section in the first embodiment; Fig. 8 is a flowchart for explaining the flow of a first abort process executed by an override tuning section in a second embodiment; Fig. 9 is a flowchart for explaining the flow of a second abort process executed by the override tuning section in the second embodiment; Fig. 10 is a flowchart for explaining the flow of a third cancellation process executed by the override tuning section in the second embodiment; Fig. 11 is a block diagram showing a configuration example of a vehicle control system according to a third embodiment; Fig. 12 is a block diagram showing a functional configuration example of the controller related to the automatic driving control; and Fig. 13 is a flowchart for explaining the flow of a first abort process executed by an override adjusting section in the third embodiment. Description of the embodiments

[0026] Embodiments of the present disclosure will be described below with reference to the accompanying drawings. However, it should be understood that even if the number, amount, amount, range, or other numerical attribute of an element is mentioned in the following description of the embodiments, the present disclosure is not limited to the mentioned numerical attribute unless expressly stated or theoretically defined. Furthermore, structures or steps or the like described in connection with the following embodiments are not necessarily essential to the embodiments of the present disclosure unless expressly stated or theoretically defined. 1. First embodiment

[0027] First, with reference to the Fig. 1 to 6 a first embodiment is described. 1.1 Overall configuration of a vehicle control system

[0028] Fig. 1 is a block diagram showing a configuration example of a vehicle control system according to the first embodiment. A vehicle control system 100 shown in Fig. 1 is mounted in a vehicle. Examples of the vehicle include a vehicle using an internal combustion engine as a power source, an electric vehicle using an electric motor as a power source, and a hybrid vehicle with an internal combustion engine and an electric motor. The electric motor is powered by a battery such as a secondary cell, a hydrogen cell, a metallic fuel cell, or an alcohol fuel cell.

[0029] As in Fig. As shown in Figure 1, the vehicle control system 100 is a system for executing automatic driving control of the vehicle. The vehicle control system 100 includes a GNSS (Global Navigation Satellite System) receiver 10, an external sensor 11, an internal sensor 12, a map database 13, a driver operation detection section 14, a driver monitoring camera 15, and an HMI (Human Machine Interface) unit 16.

[0030] A GNSS receiver 10 is a device that receives signals from three or more satellites. The GNSS receiver 10 calculates the position and orientation of the vehicle based on the received signals. The GNSS receiver 10 transmits the calculated data to an ECU (electrical control unit) 30.

[0031] The external sensor 11 is a device that detects conditions around the vehicle. Examples of the external sensor 11 are a radar sensor and a camera. The radar sensor uses radio waves (for example, a millimeter wave) or light to detect an obstacle around the vehicle. The obstacle includes a fixed obstacle and a moving obstacle. Examples of fixed obstacles are guardrails and buildings. Examples of moving obstacles are pedestrians, bicycles, and other vehicles. The camera detects an external condition of the vehicle. The camera is mounted, for example, on the back of a windshield. The external sensor transmits the detected data to the ECU 30.

[0032] The internal sensor 12 is a device that detects a driving state of the vehicle. Examples of the internal sensor 12 are a vehicle speed sensor, an acceleration sensor, and a yaw rate sensor. The vehicle speed sensor detects a driving speed or a vehicle speed. The acceleration sensor detects an acceleration of the vehicle. The yaw rate sensor detects a yaw rate of a center of gravity of the vehicle around a vertical axis. The internal sensor 12 transmits the detected data to the ECU 30.

[0033] The map database 13 is a database for storing map information. Examples of the map information include road position data, road shape information (e.g., road type, such as straight or curved, and road curvature), and the position data of intersections, exits, and structures. The map information also includes information on traffic regulations. Examples of traffic regulation information include legal speed limits associated with the road position data. The map information may include information on regions where automatic driving control can be executed. The map database 13 is implemented in a storage device (e.g., a hard disk or flash memory) mounted in the vehicle.The map database 13 may be implemented in a computer of a device (e.g., an administrative center) capable of communicating with the vehicle.

[0034] The driver operation detection section 14 is a device that detects vehicle handling by a driver. Examples of the driver operation detection section 14 are a steering sensor, an accelerator pedal sensor, and a brake pedal sensor. The steering sensor includes a steering torque sensor and a steering touch sensor. The steering torque sensor detects the driver's steering torque on a steering wheel. The steering touch sensor detects the driver's touch against the steering wheel and the pressure with which the driver grips the steering wheel. The accelerator pedal sensor detects the driver's depression of an accelerator pedal. The brake pedal sensor detects the driver's operation of a brake pedal. The driver operation detection section 14 transmits the detected data to the ECU 30.

[0035] The driver operation detecting section 14 also detects a signal output based on the driver's operation and transmits the detected signals to the ECU 30. Examples of the devices for outputting the signal based on the driver's manipulation are a shift lever, an EPB (electric parking brake) switch, a turn signal switch, a door lock switch, an air conditioner switch, a light switch, a power window switch, a wiper switch, a differential lock switch, a four-wheel drive switch, and an ignition switch.

[0036] The gearshift lever selects combinations of gears in a transmission. The EPB switch switches an operating state (for example, ON and OFF) of an EPB. The turn signal switch switches the operating state (for example, ON and OFF) of a direction indicator. The door lock switch switches a locking state (for example, locking and unlocking) of vehicle doors. The air conditioning switch switches an operating state (for example, running and stopping) of the air conditioning. The light switch switches the operating state (for example, ON and OFF) of lights (for example, headlights and fog lights). The power window switch switches the operating state (for example, opening and closing) of the windows provided in the doors. The windshield wiper switch switches the operating state (for example, ON and OFF) of the windshield wiper.The differential lock switch switches the operating state (e.g., ON and OFF) of a differential locking mechanism. The four-wheel drive switch switches a vehicle's drive system (e.g., two-wheel drive and four-wheel drive). The ignition switch switches the operating state (e.g., ON and OFF) of a vehicle's power supply circuit.

[0037] Examples of devices for outputting the signal based on the driver's manipulation also include an automatic driving mode cancel switch. The cancel switch switches the operating state (for example, ON and OFF) of the automatic driving mode. In this embodiment, the automatic driving mode is set as the default operating mode. When the cancel switch is pressed by the driver, the operating state is switched from ON to OFF. When the cancel switch is pulled back by the driver, the operating state is switched from OFF to ON (that is, the operating state is switched to the default state). An HMI unit 16 can be used as a device for switching the operating state.

[0038] An emergency button can be used to switch the operating state.

[0039] The driver monitoring camera 15 captures an occupant (i.e., a driver) sitting in a driver's seat. The driver monitoring camera 15 is mounted, for example, on a steering column cover. One or more driver monitoring cameras 15 can be provided to capture the driver from multiple directions. The driver monitoring camera 15 transmits the captured data to the ECU 30.

[0040] The HMI unit 16 is an interface for providing information to the driver and receiving information from the driver. The HMI unit 16 includes, for example, an input device, a display device, a speaker, and a microphone. Examples of input devices include a touchscreen, a keyboard, a switch, and a button. The information provided to the driver includes a driving status of the vehicle, a predetermined instruction for attracting attention, and a recommendation to switch from automatic driving to manual driving (i.e., a takeover recommendation). The driver is informed via the display device and the speaker. The reception of data from the driver is performed using the input device and the microphone. The HMI unit 16 transmits the received data from the driver to the ECU 30.

[0041] The vehicle control system 100 also has a steering actuator 20, a brake actuator 21, a drive actuator 22, and a peripheral device 23. The steering actuator 20, the brake actuator 21, the drive actuator 22, and the peripheral device 23 are collectively referred to as a “vehicle device.”

[0042] The steering actuator 20 forms part of a rack-, column-, or gear-assisted EPS (electric power steering) device. The steering actuator 20 controls the drive of a motor of the EPS device in response to control signals from the ECU 30, thereby controlling the steering torque of the vehicle.

[0043] The brake actuator 21 controls a braking device in response to control signals from the ECU 30, thereby controlling a braking force applied to the steering wheel of the vehicle. Examples of the braking device include a hydraulic braking device.

[0044] The drive actuator 22 controls the intake air quantity (valve opening degree) supplied to the engine in response to the control signals from the ECU 30, and controls the driving force of the vehicle. In the case of an electric vehicle, the control signals from the ECU 30 are input to the electric motor as a power source, and the driving force of the vehicle is controlled by the control signals. In the case of a hybrid vehicle, the intake air quantity and the electric drive are controlled, thus controlling the driving force of the vehicle.

[0045] Peripheral device 23 is a collective term for various devices particularly relevant to automatic driving control. Peripheral device 23 forms an electrical system, with each of the switches represented as the driver operation detection section 14. Examples of peripheral device 23 include a shift actuator, an EPB actuator, a turn signal, a door lock actuator, an air conditioning actuator, lights, a window lever actuator, a windshield wiper actuator, a differential lock mechanism, and an all-wheel drive actuator.

[0046] The vehicle control system 100 further includes the ECU 30 as a controller. The ECU 30 is a microcomputer that includes a processor, a memory, an input interface, and an output interface. The ECU 30 receives various types of data through the input and output interfaces. The ECU 30 executes automatic driving control based on the received data. Specifically, the ECU 30 plans a driving schedule of the vehicle and outputs data to the vehicle device so that the vehicle travels according to the schedule. A configuration of the ECU 30 is described below. 1.2 Configuration of the control

[0047] Fig. 2 is a block diagram showing a functional configuration example of the ECU 30 related to automatic driving control. As shown in Fig. 2, the ECU 30 has a vehicle condition detection section 31, a driver condition detection section 32, a travel plan generation section 33, a driver operation detection section 34, a mode switching section 35, an override adjustment section 36, a vehicle control section 37, and an alarm control section 38. These functional blocks are realized when the processor of the ECU 30 executes various types of control programs stored in the memory.

[0048] The vehicle state detection section 31 detects a vehicle state. The vehicle state includes a position of the vehicle, a driving environment of the vehicle, a driving state of the vehicle, and a status of the vehicle device.

[0049] The vehicle state detection section 31 detects the position of the vehicle on a map based on, for example, the position data from the GNSS receiver 10 and the map information from the map database 13. The vehicle state detection section 31 detects the driving environment of the vehicle based on the data from the external sensor 11. The driving environment includes the position, speed, and moving direction of the obstacle relative to the vehicle. The vehicle state detection section 31 detects the driving state of the vehicle based on the data from the internal sensor 12. The driving state includes the vehicle speed, acceleration, and yaw rate. The vehicle state detection section 31 detects whether the vehicle device state is normal or abnormal based on the data from the vehicle device.The vehicle state detecting section 31 detects the operating state of the vehicle device based on the data from the driver operation detecting section 14.

[0050] The driver state detection section 32 detects a driver state. The driver state includes a driver's gripping status of the steering wheel, a driver's attention level, and a driver's driving concentration level.

[0051] The driver state detection section 32 detects the gripping status of the steering wheel based on the data from the driver operation detection section 14 (specifically, the steering torque sensor). The driver state detection section 32 detects the level of attention and the level of driving concentration based on the data from the driver monitoring camera 15. The level of attention and the level of driving concentration can be detected based on the data from the driver operation detection section 14 (specifically, the steering touch sensor).

[0052] The travel plan generation section 33 sets a target route of the vehicle based on a preset destination, the position of the vehicle on the map detected by the vehicle state detection section 31, and the map information from the map database 13. The preset destination can be set by the driver or can be automatically set by the vehicle control system 100 according to known methods. The target route is a route along which the vehicle travels by executing automatic driving control when the operating state of the automatic driving mode is selected as ON.

[0053] The travel plan generation section 33 generates a travel plan of the vehicle based on the vehicle's driving environment, the vehicle's target route, and the vehicle's driving state. The travel plan includes control target values ​​of the vehicle corresponding to positions on the target route. The positions on the target route are positions along the target route. The target route positions mean vertical positions set at every predetermined interval, for example, 1 m, along the target route. The control target values ​​are control targets of the vehicle in the travel plan. The control target values ​​are set in association with each of the vertical positions on the target route. The control target value includes a target location and a target vehicle speed.

[0054] The driver operation detection section 34 detects driver involvement. Examples of driver involvement include the operation of the steering wheel, accelerator pedal, and brake pedal. Other examples of driver involvement include the operation of the gearshift lever, EPB switch, turn signal switch, door lock switch, air conditioning switch, light switch, power window switch, windshield wiper switch, differential lock switch, all-wheel drive switch, and ignition switch. Other examples of driver involvement include the operation of the abort switch.

[0055] The mode switching section 35 executes processing for switching the operation mode (hereinafter also referred to as a "switching process"). A specific example of the switching process is described in detail in section "1.3." Here, the operation mode is described. The operation mode includes a manual driving mode and an automatic driving mode. The manual driving mode is a mode in which the driver operates the vehicle. The automatic driving mode is a mode in which the vehicle control system 100 operates the vehicle. That is, the automatic driving mode is a mode in which automatic driving control is executed. The automatic driving mode includes a first automatic driving mode and a second automatic driving mode. In the following description, reference to "automatic driving mode" refers to the "first or second automatic driving mode."

[0056] Next, consider a case where the automatic driving mode is selected (i.e., in the case of the default state). In this case, the mode switching section 35 determines whether an execution condition of the automatic driving mode is satisfied. The execution condition is preset for each of the first and second automatic driving modes.

[0057] The execution condition of the first automatic driving mode (hereinafter also referred to as a “first execution condition”) includes a first vehicle condition which is satisfied depending on the vehicle state and a first driver condition which is satisfied depending on the driver state.

[0058] The following conditions V11 to V17 are listed as examples as the first vehicle condition. V11: The vehicle is in a region where automatic driving control can be executed. V12: The vehicle speed is less than a threshold. V13: The steering angle is smaller than a threshold value. V14: A change in a vehicle movement (for example, acceleration, deceleration, roll rate, pitch rate and yaw rate) is less than a threshold value. V15: Cognitive status of external sensor 11 is normal. V16: A status of peripheral device 23 is normal. V17: The vehicle doors and windows are closed.

[0059] The following conditions D11 to D13 are listed as examples as the first driver condition. D11: The driver holds the steering wheel firmly. D12: The level of attention is greater than or equal to a threshold. D13: The driving concentration level is greater than or equal to a threshold value.

[0060] Like the first execution condition, the execution condition of the second automatic driving mode (hereinafter also referred to as a “second execution condition”) includes a second vehicle condition which is satisfied depending on the vehicle state and a second driver condition which is satisfied depending on the driver state.

[0061] A condition that is stricter than the first vehicle condition is set as the second vehicle condition. A condition that is stricter than the first vehicle condition means that the threshold values ​​of conditions V11 to V17 (i.e., the determination values) are set to more stringent values ​​and / or additional conditions are specified. Therefore, when the second vehicle condition is met, the first vehicle condition is also met, but not vice versa. Therefore, in a case where the second vehicle condition is met, the "reliability" for the automatic driving control is relatively higher than in a case where the first vehicle condition is met.

[0062] The second driver condition can be set to be more stringent than the first driver condition, or it can be set to be equivalent to the first driver condition. A more stringent condition than the first driver condition means that the threshold values ​​of conditions D11 to D13 are set to more stringent values ​​and / or additional conditions are specified.

[0063] In this way, at least one condition is set for the second execution condition that is stricter than the first execution condition.

[0064] Thus, it can be said that when the second execution condition is satisfied (that is, when the second automatic driving mode is selected as the operation mode), the “reliability” is relatively higher than when only the first execution condition is satisfied (that is, when the first automatic driving mode is selected as the operation mode).

[0065] The oversteer adjustment section 36 executes a process to judge an oversteer request while the automatic driving control is being executed (hereinafter also referred to as the "oversteer adjustment process"). A specific example of the oversteer adjustment process is described in detail in section "1.4." The oversteer request is described here. The oversteer request is a driver's involvement requesting a switch from automatic driving to manual driving (i.e., an oversteer).

[0066] The override request contains the driver's involvement regarding the desire for direct or indirect intervention in the automatic driving control. A direct intervention is, for example, an intervention in the steering, braking, or drive. An indirect intervention is, for example, an intervention that affects the driving plan, that affects the detection status of the external sensor 11, or that affects the safety of the vehicle's occupants, including the driver. Examples of interventions that affect the driving plan include operations of the gearshift lever, the EPB switch, and the turn signal switch. Examples of interventions that affect the detection status include operations of the light switch, the windshield wiper switch, and the air conditioning switch.Examples of intervention that affects safety include operations of the door lock switch and the power window switch.

[0067] The vehicle control section 37 executes control of the vehicle in accordance with the currently selected driving mode. The vehicle control section 37 controls the vehicle by transmitting control signals to the in-vehicle device. When the automatic driving mode is selected as the operating mode, the vehicle control section 37 executes automatic driving control based on the driving plan generated by the driving plan generation section 33. The vehicle control section 37 can execute driving support control when the manual driving mode is selected as the operating mode. Examples of driving support control include LDA (Lane Departure Warning) control, LDP (Lane Keeping) control, and PCS (Emergency Brake Assist) control.

[0068] The alarm control section 38 executes the alarm control designed for the occupants, including the driver. In the alarm control, an alarm is provided to the occupant via the HMI unit 16 when a preset alarm condition is met in accordance with the alarm. A specific example of the alarm control process is described in detail in section "1.5." The alarm and the alarm condition are described here. The alarm includes the vehicle's driving status, the attention-attention instruction, and the takeover recommendation. The alarm also includes the type of driving mode currently selected (i.e., manual or automatic driving mode).

[0069] The alarm condition includes that at least one of the conditions constituting the first and second execution conditions is not met. For example, if condition V11 is not met, the alarm condition is met. In this case, the alarm control section 38 transmits an alarm with the content "Please perform manual driving because the vehicle is traveling in an area where automatic driving cannot be performed" (i.e., a takeover recommendation) to the HMI unit 16. The alarm condition is also met, for example, if condition D11 is not met. In this case, the alarm control section 38 transmits an alarm with the content "Please grip the steering wheel to perform manual driving" (i.e., an attention-attracting instruction) to the HMI unit 16. 1.3 Switching process

[0070] Fig. 3 is a flowchart for explaining a flow of the switching process performed by a mode switching section 35 in the first embodiment. In the Fig. In the process shown in Figure 3, it is first determined whether the cancel switch is turned off (switched to "OFF") (step S10). If the cancel switch is turned off, it means that the cancel switch is not pressed. The process of step S10 is executed based on the signal from the driver operation detecting section 34. If the determination result of step S10 is negative, the manual drive mode is selected as the operation mode (step S11).

[0071] If the determination result of step S10 is affirmative, it is determined whether the first execution condition is satisfied (step S12). The first execution condition is as described above. The process of step S12 is executed based on the data from the vehicle state detection section 31 and the driver state detection section 32. If the determination result of step S12 is negative, the manual drive mode is selected as the operation mode (step S11).

[0072] If the determination result of step S12 is affirmative, it is determined whether the second execution condition is satisfied (step S13). The second execution condition is as described above. The process of step S13 is basically the same as that of step S12. If the determination result of step S13 is negative, the first automatic driving mode is selected as the operation mode (step S14). For example, if the second automatic driving mode is currently selected as the operation mode, the operation mode is switched from the second automatic driving mode to the first automatic driving mode.

[0073] If the determination result of step S13 is affirmative, the second automatic driving mode is selected as the operation mode in step S15. For example, if the first automatic driving mode is currently selected as the operation mode, the operation mode is switched from the first automatic driving mode to the second automatic driving mode. 1.4 Override tuning process1.4.1 Process flow

[0074] Fig. Fig. 4 is a flowchart for explaining the flow of the override adjustment process executed by an override adjustment section 36 in the first embodiment. In the Fig. In the flow shown in Figure 4, it is first determined whether an oversteer request exists (step S20). The process of step S20 is executed based on the signals input from the driver operation detection section 34 to the oversteer adjustment section 36. If the determination result of step S20 is negative, the oversteer adjustment process is terminated.

[0075] If the determination result of step S20 is affirmative, it is determined whether the second automatic driving mode is selected as the operation mode (step S21). The process of step S21 is executed based on the signals input from the mode switching section 35 to the override setting section 36. If the determination result of step S21 is negative (that is, if the first automatic driving mode is selected as the operation mode), an override request acceptance process is executed (step S22). The acceptance process is a process for unconditionally accepting the override request. According to the acceptance process, the automatic driving control is partially and temporarily stopped according to the content of the override request.

[0076] If the determination result of step S21 is affirmative, the invalidation process of the override request is executed (step S23). The invalidation process is described below. 1.4.2 Invalidation process

[0077] Fig. Figure 5 is a block diagram illustrating the invalidation process. Fig. Figure 5 shows functional blocks that are particularly related to the invalidation process. As in Fig. As shown in Figure 5, the invalidation process is divided into a (i) first type to a (v) fifth type, depending on a stage at which the process is executed. (i) First type

[0078] A first type of process is a process for reducing operability of an operation interface of the vehicle device to be subjected to the override request (hereinafter also referred to as a "request target device") when the determination result of step S21 is affirmative. "Operability reduction" means that the operation of the operation interface is made difficult. Therefore, after the process in the driver operation detecting section 14, substantially no driver participation is detected to reduce operability. Therefore, it is recognized that there is no override request. According to the operability reduction process, it is possible for the driver to understand that the driving mode currently selected is the second automatic driving mode.

[0079] For example, the process for reducing operability is as follows. That is, when the operation interface is the steering wheel, the process is executed to generate a steering reaction force moment equal to the steering torque input by the driver. Alternatively, the process is executed to reduce the steering assist torque. This makes it difficult for the driver to operate the steering wheel. When the operation interface is the brake pedal, the process is executed to close a main valve or a holding valve. This makes it difficult for the driver to depress the brake pedal. When the operation interface is the accelerator pedal, the process is executed to increase a spring force. This makes it difficult for the driver to depress the accelerator pedal. (ii) Second type

[0080] A second-type process is a process for blocking transmission of the override request to the request target device when the determination result of step S21 is affirmative. If the transmission is blocked, the override request is not reflected in the operation of the request target device. While the first-type process makes it difficult to detect the override request, the second-type process enables this detection. Therefore, according to the second-type process, it is possible to extract a driver's intention and use it for setting the next target route or generating the driving schedule.

[0081] When the request target device is the steering actuator 20, the process is performed to disengage a clutch between the steering wheel and the rack. When the request target device is the brake actuator 21, the process is performed to open the main valve or the holding valve. When the request target device is the drive actuator 22, the process is performed to disengage a clutch between an output shaft of the internal combustion engine or the electric motor and the drive force distribution mechanism. However, in these cases, it is necessary to drive a device to ensure the continuation of automatic driving control.

[0082] If the request target device is the transmission, EPB, turn signal, doors, air conditioning, lights, windows, differential, or power circuit, the process is executed to block the input of the signal from the operation interface to the corresponding request target device. For example, the ON signal output from the turn signal switch is not input to the turn signal. The OFF signal output from the wiper switch when it rains is not input to the wipers. However, the input of necessary signals is permitted from the perspective of continuing the execution of automatic driving control. The necessary signals include the signal input to the light when the light switch position is switched from AUTO to ON. (iii) Third type

[0083] A third-type process is a process for prohibiting driver participation in the request target device being processed in the ECU 30 when the determination result of step S21 is affirmative. The fact that the driver participation process in the request target device is prohibited means that the driver participation determined as an override request before the prohibition is not processed at all after the prohibition. Therefore, according to the third-type process, it is very easy to invalidate the override request. (iv) Fourth type

[0084] A fourth type of process is a process for preventing the current schedule from being changed in the schedule generation section 33 when the determination result of step S21 is affirmative. If the change of the current schedule is prohibited, automatic driving control continues based on the current schedule. (v) Fifth type

[0085] Before describing a fifth type process, a relationship between the operation mode switching and the override request will be described. If the driver operation detecting section 34 does not detect the override request, the operation mode switching is performed in accordance with the switching process. However, after the driver operation detecting section 34 detects the override request, the operation mode is switched in accordance with the override matching process (more precisely, the acceptance process).

[0086] The fifth type process is a process for preventing the operation mode from switching to the manual driving mode based on the override request when the determination result of step S21 is affirmative. If the switching of the operation mode is prohibited, the operation mode is maintained in the second automatic driving mode.

[0087] The prevention of switching of the operation mode can be achieved by setting the threshold (i.e., the determination value) for the driver operation detection section 34 to detect that the override request is set to a stricter value. When such a stricter threshold is set, the driver operation determined as an override request before the setting will no longer be detected after the setting. The operation mode will then not switch to the override adjustment process after the setting. 1.5 Alarm control

[0088] An example of alarm control specifically related to automatic driving control includes a first alarm control and a second alarm control. These alarm controls are described below. 1.5.1 First alarm control

[0089] Fig. Fig. 6 is a flowchart for explaining the flow of the first alarm control process executed by the alarm control section 38 in the first embodiment. In the Fig. In the flow shown in Figure 6, it is first determined whether the alarm condition is met (step S30). The alarm condition is as described above. The process of step S30 is executed based on the data from the vehicle condition detection section 31 and the driver condition detection section 32. If the determination result of step S30 is negative, the first alarm control process is terminated.

[0090] If the determination result of step S30 is positive, the process of step S31 is executed. The process of step S31 is the same as the process of step S21 described in Fig. 4. If the determination result of step S31 is negative, a normal alarm procedure is applied (step S32). The normal alarm procedure is a procedure for providing the entire preset alarm content to the occupant.

[0091] If the determination result of step S31 is affirmative, a simple alarm method is applied (step S33). The simple alarm method is a method in which some or all of the alarm contents to the occupant are omitted, or some or all of the alarm devices are omitted from the alarm to the occupant. The alarm device includes a display device and a speaker of the HMI unit 16. Omitting some alarm devices means that some of the alarm devices (for example, the speakers) used in the normal alarm method are excluded from use. 1.5.1 Second alarm control

[0092] Fig. 7 is a flowchart for explaining the second alarm control process executed by the alarm control section 38 in the first embodiment. In the Fig. 7, the process of step S40 is first executed. The process of step S40 is the same as that of step S20, as shown in Fig. 4. If the determination result of step S40 is negative, the second alarm control process is terminated.

[0093] If the determination result of step S40 is positive, the process of step S41 is executed. The process of step S41 is the same as that of Fig. 4. If the determination result of step S41 is negative, the second alarm control process is terminated.

[0094] If the determination result of step S41 is affirmative, the currently selected driving mode is notified (step S42). Thus, the driver understands via the alarm device that the currently selected driving mode is the second automatic driving mode. 1.6 Beneficial effects

[0095] According to the vehicle control system according to the first embodiment, as described above, the oversteer tuning process is executed. According to the oversteer tuning process, it is possible to facilitate the acceptance of the oversteer request when the first automatic driving mode with the "reliability" low is selected. Likewise, it is possible to make the acceptance difficult when the second automatic driving mode with the "reliability" high is selected. Therefore, in the vehicle in which two types of automatic driving modes different in "reliability" are adopted, it becomes possible to prevent the driver from feeling strange about the ease of oversteer.

[0096] According to the vehicle control system of the first embodiment, the invalidation process or the acceptance process is executed in the override tuning process. According to the invalidation process, driver intervention that may interfere with the automatic driving control while the second automatic driving mode with "reliability" is high is rendered ineffective. Therefore, it is possible to improve the controllability of the automatic driving control. According to the acceptance process, it is possible to provide the driver with an opportunity to intervene in the automatic driving control while the first automatic driving mode with "reliability" is low.

[0097] According to the vehicle control system of the first embodiment, alarm control is performed. According to the alarm control, the normal alarm method is applied when the first automatic driving mode with the "reliability" low is selected. Similarly, the simple alarm method is applied when the second automatic driving mode with the "reliability" high is selected. Regarding the alarm level, the level of the simple alarm method is lower than that of the normal alarm method. However, as the alarm level is lower, the frequency of driver intervention in the automatic driving control is expected to decrease. Therefore, it is possible to improve the controllability of the automatic driving control when the second automatic driving mode with the "reliability" high is selected. 2. Second embodiment

[0098] Next, a second embodiment will be described with reference to the Fig. 8 to 10. Hereinafter, descriptions overlapping with those of the first embodiment described above will be omitted where appropriate. 2.1 Configuration of the control system

[0099] In the first embodiment described above, the override adjustment section 36 underwent an override adjustment process. In the second embodiment, the override adjustment section 36, in addition to the override adjustment process, executes a process to cancel the invalidation process (hereinafter referred to as the "cancellation process"). The cancellation process includes a first cancellation process, a second cancellation process, and a third cancellation process. These cancellation processes are described below. 2.1.1 First termination process

[0100] Fig. Fig. 8 is a flowchart for explaining the flow of the first abort process executed by the override tuning section 36 in the second embodiment. In the Fig. 8, the process of step S50 is first executed. The process of step S50 is the same as that of the Fig. 4. If the determination result of step S50 is negative, the first termination process is terminated.

[0101] If the determination result of step S50 is affirmative, it is determined whether the first termination condition is met (step S51). An example of the first termination condition is the condition "the invalidation process termination switch is pressed." The termination switch is a device for outputting a signal based on driver operation. This termination switch is different from the one for switching the running state to the automatic driving mode. For convenience, the termination switch for the running state is referred to as a "first switch" and the termination switch for the invalidation process is referred to as a "second switch."

[0102] The second switch also serves as the cancellation switch for switching an execution status (e.g., ON and OFF) of the invalidation process. The second switch is provided, for example, next to the first switch. To reliably detect driver intervention, the second switch may consist of two buttons. When the first switch is pressed, the automatic driving mode operating state is disabled (switched to "OFF"). Therefore, in this case, the process of step S50 is repeated, and the process of step S51 is not executed.

[0103] If the determination result of step S51 is negative, the first termination process is terminated. If the determination result is positive, the execution of the invalidation process is terminated (step S52). The termination of the invalidation process means that the acceptance process executed in step S22 of the Fig. 4. By executing the acceptance process, the override request is accepted without restriction, even if the second automatic driving mode is selected. 2.1.2 Second termination process

[0104] Fig. Fig. 9 is a flowchart for explaining the flow of the second abort process executed by the override tuning section 36 in the second embodiment. In the Fig. 9, the process of step S60 is first executed. The process of step S60 is the same as that of the Fig. 4. If the determination result of step S60 is negative, the second termination process is terminated.

[0105] If the determination result of step S60 is affirmative, it is determined whether the second termination condition is met (step S61). An example of the second termination condition is the condition "All conditions constituting the first execution condition are met, but some of the conditions constituting the second execution condition are not met." As described above, at least one stricter condition is set for the second execution condition than for the first execution condition. Therefore, there is a case where the second termination condition is met.

[0106] If the determination result of step S61 is negative, the second cancellation process is terminated. If the determination result of step S61 is positive, the execution of a part of the invalidation process is canceled (step S62). The scope to be canceled is set for the vehicle device included in a row of devices in which the second cancellation condition is satisfied. For example, if the second execution condition is satisfied except for condition V12, the scope of the devices to be canceled includes the row of devices up to the brake pedal. If the second execution condition is satisfied except for condition V13, the scope of the devices to be canceled includes the row of devices up to the steering wheel. 2.1.3 Third demolition process

[0107] In contrast to the first and second abort processes, the third abort process is executed when the override request is present. Fig. Fig. 10 is a flowchart for explaining the flow of the third abort process executed by the override tuning section 36 in the second embodiment. In the Fig. 10, the process of steps S70 and S71 is first executed. The process of steps S70 and S71 is the same as that of the Fig. 4 shown steps S20 and S21.

[0108] If the determination result of steps S70 or S71 is negative, the third termination process is terminated. If these determination results are positive, it is determined whether the third termination condition is met (step S72).

[0109] The following conditions C31 to C36 are listed as examples of the third termination condition. C31: Driver involvement as the basis for the override request is consistently detected. C32: Driver involvement as the basis for the override request coincides with the operation of the vehicle based on automatic driving control. C33: The driver's involvement as the basis for the override request coincides with the operation of the vehicle based on the automatic driving control and is detected earlier than a time at which the same operation of the vehicle is started. C34: The driver involvement as the basis for the oversteer request is due to the moving obstacle (for example, a pedestrian or a bicycle) emerging from the vehicle's blind spot. C35: A collision with the obstacle is unavoidable. C36: A collision with the obstacle is inevitable, and the driver's participation as the basis for the oversteer request is also the most appropriate from the point of view of suppressing damage in the collision.

[0110] The determination process of condition C31 is executed based on the signal input from the driver operation detection section 34 to the override adjustment section 36. The determination process of the operation of the vehicle based on the automatic driving control under conditions C32 and C33 is executed based on the current driving schedule.

[0111] The process of determining the time at which vehicle operation is started in condition C33 is also performed based on the current schedule. The process of determining the jump in condition C34 is performed based on the data from the external sensor 11. The process of determining the condition C35 is performed based on the current schedule and the data from the external sensor 11. The process of determining the validity of the driver's participation in condition C36 is performed based on a preset evaluation model.

[0112] If the determination result of step S72 is negative, the third cancellation process is terminated. If the determination result is positive, the execution of a part of the invalidation process is canceled (step S73). The scope to be canceled is set for the vehicle device included in a series of devices in which the third cancellation condition is met. For example, if the steering wheel is operated, the scope to be canceled is the series of devices up to the steering wheel. If both the steering wheel and the brake pedal are operated, the scope to be canceled is the series of devices up to these vehicle devices.

[0113] In the process of step S73, the rate at which the invalidation process is aborted can be changed in accordance with the content of the third abort condition. For example, when any of the conditions C34 to C36 is met, an override emergency is expected to be higher than that in a case where any of the conditions C31 to C33 is met. Therefore, in such an emergency, the invalidation process can be aborted in a shorter time than usual. 2.2 Beneficial effect

[0114] In the vehicle control system according to the first embodiment, as described above, the second automatic driving mode is selected as the operation mode when all the conditions constituting the second execution condition have been met. Therefore, when some of the conditions constituting the second execution condition are not met, the first automatic driving mode (or the manual driving mode) is selected as the operation mode.

[0115] On the other hand, according to the vehicle control system of the second embodiment, the cancellation process is executed. According to the cancellation process, it is possible to cancel the execution of the invalidation process with respect to the vehicle device in which the cancellation condition is met. Therefore, while the second automatic driving mode with high reliability is selected, it is possible to allow the driver to operate the vehicle device belonging to the series of devices in which the cancellation condition is met. 3. Third embodiment

[0116] Next, a third embodiment will be described with reference to the Fig. 11 to 13. In the following, descriptions overlapping with those of the first and second embodiments will be omitted where appropriate. 3.1 Overall configuration of the vehicle control system

[0117] Fig. 11 is a block diagram showing a configuration example of the vehicle control system according to the third embodiment. A vehicle control system 200 as shown in Fig. 11, has an occupant detection section 17, a communication device 18, and an ECU 40. Other configurations of the vehicle control system 200 are the same as those of the Fig. 1 shown vehicle control system 100.

[0118] The occupant detection section 17 is a device that detects the occupant. Examples of the occupant detection section 17 include a seat sensor, an interior monitoring camera, and a breath detection sensor. The seat sensor detects whether the occupant is seated. The seat sensor is provided for each seat. The interior monitoring camera is a camera that detects the vehicle interior. The interior monitoring camera can be provided for any seat except the driver's seat or can be provided at a location overlooking the vehicle interior. The breath detection sensor detects the driver's exhalation. The breath detection sensor is mounted on the steering column cover. The occupant detection section 17 transmits the detected data to the ECU 40.

[0119] The communication device 18 is a device that performs wireless communication with a nearby base station and connects to the network via the base station. The wireless communication standard used by the communication device 18 is, for example, one of the mobile communication standards such as 4G, LTE, and 5G.

[0120] A connection point of the communication device 18 to the network is, for example, an external management server. The management server is a computer with at least one processor and at least one memory. The management server has a storage device (for example, an SSD and an HDD). The storage device stores ID data of the vehicle user. The identification information includes data of a facial image of the user and information about a driver's license. The driver's license information includes the presence or absence of a driver's license, an expiration date of the driver's license, and a vehicle type that can be driven by the user (for example, a regular vehicle and a commercial vehicle).

[0121] Now consider a case where the vehicle control system 200 is mounted in a vehicle intended for a ride-sharing service. In this case, the ID data includes a facial image of the ride-sharing service user and information about the use of the vehicle's luggage compartment (for example, a trunk) by the corresponding user.

[0122] Now consider a case where the vehicle control system 200 is mounted in a remote-controlled vehicle. In this case, another connection point of the communication device 18 to the network is, for example, an external management center. The management center monitors the execution status of the automatic driving control. The management center performs remote control of the vehicle as needed.

[0123] The ECU 40 is a microcomputer that has a processor, a memory, and an input and output interface. The basic function of the ECU 40 is the same as that of the Fig. 1. A configuration of the ECU 40 is described below. 3.2 Configuration of the control system

[0124] Fig. 12 is a block diagram showing a functional configuration example of the ECU 40 related to automatic driving control. As shown in Fig. 12, the ECU 40 has an occupant detection section 41 and an external information detection section 42. The other functional blocks of the ECU 40 are the same as those of the Fig. 2. These functional blocks are realized when the processor of the ECU 40 executes various types of control programs in the memory.

[0125] The occupant detection section 41 detects the occupant in a cabin based on the data from the occupant detection section 17. The occupant detection section 41 detects the presence or absence of the occupant on the seat based on the data from the seat sensor. The occupant detection section 41 verifies the occupant of the respective seat based on the image information from the interior monitoring camera and the ID data from the external information detection section 42. The driver can be verified based on the image data from the driver monitoring camera 15.

[0126] The external information recognition section 42 recognizes external information obtained through the communication device 18. The external information includes the ID data of the vehicle user. If the vehicle is intended for a ride-sharing or car-sharing service, the external information includes the ID data of the user of the ride-sharing / car-sharing service. If the vehicle is remotely controlled, the external information includes the remote control data. 3.3 Configuration of the override tuning section

[0127] Just like the second embodiment described above, the control switching section 36 executes the abort process. The abort process includes the first, second, and third abort processes described above. The basic flow of these abort processes is the same as that in the second embodiment described above. The first abort process will be described below as a representative of these abort processes.

[0128] Fig. Fig. 13 is a flowchart for explaining the flow of the first abort process executed by the override tuning section 36 in the third embodiment. In the Fig. 13, the process of steps S80 and S81 is first executed. The process of steps S80 and S81 is the same as that of the Fig. 8 shown steps S50 and S51.

[0129] If the determination result of step S80 or step S81 is negative, the first termination process is terminated. If these determination results are positive, it is determined whether the exception condition is met (step S82). The following conditions E11 to E14 are listed as examples of exceptional conditions. E11: There is a restriction on a road along which the vehicle is traveling (for example, the road is a road for automated driving). E12: There is a restriction of the driving environment (for example, a distance between the vehicle and the obstacle is smaller than a threshold in the lateral or longitudinal direction). E13: There is no person with the ability or qualification to drive manually in the cab (for example, the driver is not on board, the driver is not in the driver's seat, or the driver is drunk). E14: There is no passenger in the cabin whose ID and facial recognition match the registered data.

[0130] The determination process of condition E11 is executed based on the map information. The determination process of condition E12 is executed based on the data from the external sensor 11. The determination process of conditions E13 and E14 is executed based on the data from the driver detection section 32, the passenger detection section 41, and the external information detection section 42.

[0131] If the vehicle is provided for ride-sharing or car-sharing services, the following conditions E21 and E22 are listed as an exception. E21: The luggage compartment is in use. E22: The occupant sitting in the driver's seat does not match the occupant using the luggage compartment.

[0132] If the vehicle is remotely controlled, the following conditions E31 and E32 are listed as the exception condition by way of example. E31: No person other than a carer and a care recipient is present in the cabin. E32: No person other than the care recipient is present in the cabin.

[0133] The determination process of the conditions E21, E22, E31 and E32 is carried out based on the data from the driver condition detecting section 32, the occupant detecting section 41 and the external information detecting section 42.

[0134] If the determination result of step S82 is negative, the invalidation process is aborted (step S83). That is, the acceptance process described in step S22, which is Fig.4 is executed. If the determination result of step S82 is affirmative, the first termination process is terminated. In other words, the termination of the execution of the invalidation process is rejected. 3.4 Beneficial effects

[0135] According to the vehicle control system of the third embodiment, if it is determined that the exception condition is met, the termination of the execution of the invalidation process is rejected. Therefore, even if the termination condition is met, the invalidation process can be executed as originally scheduled if the handover request should not be accepted.

Claims

[1] A vehicle control system (100, 200) mounted in a vehicle, comprising a controller (30, 40) configured to perform automatic driving control of the vehicle, wherein the controller (30, 40) is further configured: to select a first or second automatic driving mode as an operation mode for executing the automatic driving control, wherein the first automatic driving mode is selected when a first execution condition including a first vehicle condition and a first driver condition is satisfied, and the second automatic driving mode is selected when the first and a second execution condition including a second vehicle condition and a second driver condition are satisfied, wherein the second vehicle condition is stricter than the first vehicle condition; and to execute an oversteer tuning process during the execution of the automatic driving control to tune an oversteer request from a driver of the vehicle, wherein in the override tuning process the controller (30, 40) is configured: to determine which of the first and second automatic driving modes is selected; and, when it is determined that the second automatic driving mode is selected, to make acceptance of the override request more difficult than when it is determined that the first automatic driving mode is selected. [2] The vehicle control system (100, 200) according to claim 1, wherein the first vehicle condition is at least one of the following vehicle conditions: - the vehicle is located in a region in which automatic driving control can be carried out; - a vehicle speed is less than a threshold; - a steering angle is smaller than a threshold value; - a change in a vehicle movement, such as acceleration, deceleration, roll rate, pitch rate and yaw rate, is less than a threshold value; - a cognitive status of the external sensor that detects conditions around the vehicle is normal; - a status of a peripheral device including at least a shift actuator, an EPB actuator, a turn signal, a door lock actuator, an air conditioning actuator, lights, a power window actuator, a wiper actuator, a differential lock mechanism, and a four-wheel drive actuator is normal; and - Vehicle doors and windows are closed. [3] The vehicle control system (100, 200) according to claim 1 or 2, wherein the first driver condition is at least one of the following driver conditions: - the driver holds the steering wheel firmly; - a driver's level of attention is greater than or equal to a threshold; and - the driver's concentration level is greater than or equal to a threshold value. [4] The vehicle control system (100, 200) according to claim 2 or 3, wherein the threshold values ​​of the second vehicle condition and the second driver condition are set to be more stringent than the threshold values ​​of the first vehicle condition and the first driver condition and / or additional vehicle conditions and driver conditions are set. [5] The vehicle control system (100, 200) according to any one of claims 1 to 4, wherein the controller (30, 40) is further configured to execute an invalidation process to invalidate the override request when it is determined in the override tuning process that the second automatic driving mode is selected. [6] The vehicle control system (100, 200) of claim 5, further comprising a detection device configured to detect the override request, wherein in the invalidation process, the controller (30, 40) is further configured to substantially prevent the input of the override request to the detection device. [7] The vehicle control system (100, 200) according to claim 5, wherein the controller (30, 40) is further configured to block, in the invalidation process, the transmission of the override request to a vehicle device as a target of the override request. [8] The vehicle control system (100, 200) according to claim 5, wherein the controller (30, 40) is further configured to prevent processing of the override request in the controller (30, 40) in the invalidation process. [9] The vehicle control system (100, 200) of claim 5, wherein the controller (30, 40) is further configured to prevent, in the invalidation process, a change to a current driving plan of the vehicle based on the override request. [10] The vehicle control system (100, 200) of claim 5, wherein the controller (30, 40) is further configured to prevent switching of the operating modes based on the override request in the invalidation process. [11] The vehicle control system (100, 200) according to any one of claims 1 to 10, wherein the controller is further configured to unconditionally accept the oversteer request in the oversteer tuning process when it is determined in the oversteer tuning process that the first automatic driving mode is selected. [12] Vehicle control system (100, 200) according to one of claims 1 to 11, wherein the controller (30, 40) is further configured to perform an alarm control for an occupant of the vehicle during the execution of the automatic driving control, and in the alarm control the control (30, 40) is further configured: to determine which of the first and second automatic driving modes is selected; and, when it is determined that the second automatic driving mode is selected, to lower an alarm level for the occupant compared to when it is determined that the first automatic driving mode is selected. [13] Vehicle control system (100, 200) according to one of claims 1 to 12, wherein the controller (30, 40) is further configured: during the execution of the automatic driving control, determine whether a termination condition for terminating the execution of the invalidation process is met in order to invalidate the override request; and if it is determined that the termination condition is met, to terminate the execution of the invalidation process in a vehicle device belonging to a set of device types in which the termination condition is met. [14] The vehicle control system (100, 200) of claim 11, wherein the controller (30, 40) is further configured: to determine, during the execution of the automatic driving control, whether an exception condition for refusing to abort the execution of the invalidation process is met; and if it is determined that the exception condition is met, to refuse to abort the execution of the invalidation process in a vehicle device belonging to the set of device types in which the exception condition is met.

Images