DEVICE AND METHOD FOR AUTONOMOUS DRIVING

Abstract

Device for autonomous driving with: a sensor unit (500) configured to detect a surrounding vehicle in the vicinity of an autonomously driving ego vehicle and to detect a state of an occupant who has entered the ego vehicle; an output unit (300); a memory (620) configured to store map information; and a processor (610) configured to control the autonomous driving of the ego vehicle based on the map information stored in the memory, wherein the processor (610) is configured to: Generating an actual travel trajectory and an expected travel trajectory of the surrounding vehicle based on travel information of the surrounding vehicle detected by the sensor unit (500) and the map information stored in the memory (620), and Controlling one or more of driving the ego vehicle and communicating with an external organization based on a state of the occupant detected by the sensor unit (500) when an autonomous driving mode of the ego vehicle is turned off, based on an autonomous driving risk of the ego vehicle determined based on a trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle.

Description

CROSS REFERENCE TO RELATED APPLICATIONThe present application claims priority to and the benefit of Korean Patent Application Nos. 10-2019-0058611 filed on May 20, 2019, which is hereby incorporated by reference into the present application for any purposes as if set forth herein.BACKGROUNDTECHNICAL FIELDEmbodiments of the present disclosure relate to an autonomous driving apparatus and method applied to an autonomous vehicle.DISCUSSION OF THE PRIOR ARTThe present automotive industry is moving towards an implementation of autonomous driving to minimize driver intervention in vehicle guidance. An autonomous vehicle refers to a vehicle that autonomously detects a travel path by recognizing an environment while traveling using an external information acquisition and processing function and autonomously travels by its own driving force.The autonomous vehicle may autonomously travel to a destination while preventing collision with an obstacle on a travel path and control a vehicle speed and travel direction based on a road shape even though a driver operates neither steering wheel nor accelerator pedal or brake. The autonomous vehicle can, for example, accelerate on a straight roadway and brake it according to the curvature of a curved roadway on the curved roadway when changing the direction of travel.In order to ensure safe driving of an autonomous vehicle, the driving of the autonomous vehicle needs to be controlled based on a measured driving environment by accurately measuring the driving environment using sensors mounted on the vehicle and continuing to monitor the driving state of the vehicle. For this purpose, various sensors are used in the autonomous vehicle, such as a LIDAR sensor, a radar sensor, an ultrasonic sensor, and a camera sensor, that is, sensors for detecting surrounding objects, such as surrounding vehicles, pedestrians, and stationary devices. The data output from such a sensor is used to acquire information on a traveling environment, for example, state information such as the location, shape, moving direction, and moving speed of a surrounding object.Moreover, the autonomous vehicle also has a function of optimally determining a travel path and a travel lane by determining and correcting the location of the vehicle from previously stored map data, controlling the travel of the vehicle so that the vehicle does not deviate from the determined path and the determined travel lane, and performing detensive and avoidance travel for a risk factor on a travel path or a vehicle suddenly appearing in the vicinity.The prior art of the disclosure is disclosed in Korean Patent Application Laid-Open KR 10 1998 0 068 399 A (October 15, 1998). DE 10 2018 132 868 A1 discloses a warning system having a sensor unit for detecting a state of an occupant who has entered the ego vehicle and an output unit for outputting a warning. DE 11 2017 007 197 B4 discloses a driving mode switching control device for switching a driving mode of a vehicle. DE 11 2018 008 107 B4 discloses an information presentation control device. DE 10 2017 117 240 A1 discloses an information announcement device for a vehicle. DE 10 2017 122 797 A1 discloses a method and a device for a wake-up alarm for vehicles with an autonomous mode. DE 10 2017 123 444 A1 discloses methods and systems for controlling an autonomous vehicle. DE 11 2016 005 314 T5 discloses an automated driving assistance device which supports automated driving control or regulation of a passenger car.OVERVIEWAn embodiment relates to providing an autonomous driving apparatus and method that can improve driving stability and driving accuracy of an autonomous vehicle by outputting a proper warning to an occupant based on an autonomous driving risk of the autonomous vehicle, and can effectively avoid an emergency situation occurring in the occupant by controlling driving of an ego vehicle and communication with an external organization based on the state of the occupant.In the embodiment, an autonomous driving apparatus includes a sensor unit configured to detect a surrounding vehicle near an autonomous driving ego vehicle and a state of an occupant who has entered the ego vehicle, an output unit, a memory configured to store map information, and a processor configured to control autonomous driving of the ego vehicle based on the map information stored in the memory. The processor is configured to generate an actual driving trajectory and an expected driving trajectory based on surrounding vehicle driving information detected by the sensor unit and the map information stored in the memory, and to control one or more of driving of the ego vehicle and communication with an external organization based on a state of the occupant detected by the sensor unit when an autonomous driving mode of the ego vehicle is turned off, based on an autonomous driving risk of the ego vehicle determined based on a trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle.In one embodiment, the processor is configured to determine an autonomous driving risk of the ego vehicle based on whether a driving mode of the surrounding vehicle is an autonomous driving mode and on the trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle, and to output a warning to the occupant via the output unit at a level corresponding to the determined autonomous driving risk. The processor outputs the warnings to the occupant via the output unit as first to third levels based on an ascending order of the autonomous driving risk of the ego vehicle.In an embodiment, the processor is configured to output a warning corresponding to the first level to the occupant via the output unit when the driving mode of the surrounding vehicle is the autonomous driving mode, and to output a warning corresponding to the second level to the occupant via the output unit when the driving mode of the surrounding vehicle is a manual driving mode.In one embodiment, the processor is configured to perform a reliability diagnosis of the autonomous driving control over the ego vehicle based on a magnitude of the trajectory error between the actual driving trajectory and the expected driving trajectory or on a cumulative addition of the trajectory errors, and to output a warning corresponding to the third stage to the occupant via the output unit when it is determined as a result of the execution of the diagnosis that the autonomous driving control over the ego vehicle is unreliable.In an embodiment, the processor is configured to determine that the autonomous driving control over the ego vehicle is unreliable when the state in which the magnitude of the trajectory error is a predetermined first critical value or more occurs within a predetermined first critical time.In an embodiment, the processor is configured to additionally perform the reliability diagnosis by the cumulative addition of the trajectory errors in the state where the magnitude of the trajectory error is less than the first critical value for the first critical time, and determine that the autonomous driving control over the ego vehicle is unreliable when the state where the cumulative addition obtained by accumulating and adding the trajectory errors is a predetermined second critical value or more occurs within a second critical time predetermined as a value greater than the first critical time in the state where the magnitude of the trajectory error is less than the first critical value for the first critical time.In one embodiment, the processor is configured to cancel the warning output via the output unit when the magnitude of the trajectory error becomes less than the first critical value, when the cumulative addition of the trajectory errors becomes less than the second critical value, or when it is determined that the state of the occupant detected by the sensor unit is a looking-forward state, after the warning is output to the occupant via the output unit.In an embodiment, the processor is configured to turn off the autonomous driving mode of the ego vehicle when it is determined that the state of the occupant detected by the sensor unit does not match the looking-forward state in a state in which the magnitude of the trajectory error becomes the first critical value or more or the cumulative addition of the trajectory errors becomes the second critical value or more.In an embodiment, the processor is configured to allow the driving mode of the ego vehicle to enter an emergency autonomous driving mode so that the ego vehicle can move to a specific location required for the occupant when no manual driving manipulation is performed by the occupant after the autonomous driving mode of the ego vehicle is turned off.In an embodiment, the processor is configured to send a rescue signal to the external organization when a behavior of the occupant is not detected via the sensor unit or a biosignal of the occupant detected by the sensor unit has a different pattern than a normal biosignal previously stored in the memory as a biosignal during normal physical sensing of the occupant.In an embodiment, a method for autonomous driving includes controlling, by a processor, autonomous driving of an ego vehicle based on map information stored in a memory, generating, by the processor, an actual driving trajectory and an expected driving trajectory of a surrounding vehicle in the vicinity of the ego vehicle based on surrounding vehicle driving information detected by a sensor unit and the map information stored in the memory, and controlling, by the processor, one or more of driving of the ego vehicle and communication with an external organization based on a state of the occupant detected by the sensor unit when an autonomous driving mode of the ego vehicle is turned off based on an autonomous driving risk of the ego vehicle, which is ascertained on the basis of a trajectory error between the actual travel trajectory and the expected travel trajectory of the surrounding vehicle.BRIEF DESCRIPTION OF THE DRAWINGSFIG. 1 is a general block diagram of an autonomous driving control system to which an autonomous driving apparatus according to an embodiment of the present disclosure may be applied. FIG. 2 is a block diagram illustrating a detailed configuration of an autonomous driving integrated controller in the autonomous driving apparatus according to an embodiment of the present disclosure. FIG. 3 is an exemplary diagram illustrating an example in which the autonomous driving apparatus according to an embodiment of the present disclosure is applied to a vehicle. FIG. 4 is an exemplary diagram illustrating an example of an internal structure of a vehicle to which the autonomous driving apparatus according to an embodiment of the present disclosure is applied. FIG. 5 is an exemplary diagram illustrating an example of a predetermined distance and a horizontal field of view within which a LIDAR sensor, a radar sensor, and a camera sensor in the autonomous driving device according to an embodiment of the present disclosure may detect a surrounding object. FIG. 6 is an exemplary diagram illustrating an example in which a sensor unit detects a surrounding vehicle in the autonomous driving apparatus according to an embodiment of the present disclosure. FIG. 7 is a flowchart for describing an autonomous driving method according to an embodiment of the present disclosure. FIG. 8 is a flowchart for describing a step of outputting a warning in the autonomous driving method according to the embodiment of the present disclosure in concrete terms.DETAILED DESCRIPTION OF THE ILLUSTRATED EMBODIMENTSIn the following, an apparatus and a method for autonomous driving are described with reference to the associated drawings on the basis of different exemplary embodiments. The thickness of lines or the size of elements shown in the drawings in this process may have been exaggerated for clarity of description and for simplicity. The terms described below have been defined in consideration of their functions in the disclosure, and may be changed depending on the intention or practice of a user or operator. Accordingly, such terms are to be interpreted based on the entire contents of this specification.FIG. 1 is a general block diagram of an autonomous driving control system to which an autonomous driving apparatus according to an embodiment of the present disclosure may be applied. FIG. 2 is a block diagram illustrating a detailed configuration of an autonomous driving integrated controller in the autonomous driving apparatus according to an embodiment of the present disclosure. FIG. 3 is an exemplary diagram illustrating an example in which the autonomous driving apparatus according to an embodiment of the present disclosure is applied to a vehicle. FIG. 4 is an exemplary diagram illustrating an example of an internal structure of a vehicle to which the autonomous driving apparatus according to an embodiment of the present disclosure is applied. FIG. 5 is an exemplary diagram illustrating an example of a predetermined distance and a horizontal field of view within which a LIDAR sensor, a radar sensor, and a camera sensor in the autonomous driving device according to an embodiment of the present disclosure may detect a surrounding object. FIG. 6 is an exemplary diagram illustrating an example in which a sensor unit detects a surrounding vehicle in the autonomous driving apparatus according to an embodiment of the present disclosure.First, the structure and functions of an autonomous driving control system to which an autonomous driving apparatus according to the present embodiment can be applied will be described with reference to FIGS. 1 and 3. As illustrated in FIG. 1, the autonomous driving control system may be implemented based on an autonomous driving integrated controller 600 configured to transmit and receive data required for autonomous driving control of a vehicle via a driving information input interface 101, a movement information input interface 201, an occupant output interface 301, and a vehicle control output interface 401.The autonomous driving integrated controller 600 may obtain driving information based on manipulation of an occupant for a user input unit 100 in an autonomous driving mode or manual driving mode of a vehicle via the driving information input interface 101. As illustrated in FIG. 1, the user input unit 100 may include, for example, a driving mode switch 110 and a user terminal 120 (e.g., a navigation terminal mounted on a vehicle or a smartphone or tablet PC of an occupant). Accordingly, driving information may include driving mode information and navigation information of a vehicle. For example, a driving mode (i.e., an autonomous driving mode / manual driving mode or a sport mode / eco mode / safety mode / normal mode) of a vehicle determined by a manipulation of an occupant for the driving mode switch 110 may be transmitted to the autonomous driving integrated controller 600 via the driving information input interface 101 as driving information. In addition, navigation information such as the destination of an occupant and a route to the destination (e.g., the shortest route or the preferred route selected from the occupant among candidate routes to the destination) input from an occupant via the user terminal 120 may be transmitted to the autonomous driving integrated controller 600 via the driving information input interface 101 as driving information. The user terminal 120 may be implemented as a control panel (e.g., touch screen panel) that provides a user interface (UI) through which a driver inputs or modifies information for autonomous driving control of a vehicle. In this case, the driving mode switch 110 may be implemented as a touch button on the user terminal 120.In addition, the autonomous driving integrated controller 600 may obtain motion information indicating a traveling state of a vehicle via the motion information input interface 201. The motion information may include a steering angle formed when an occupant manipulates a steering wheel, an accelerator stroke or a brake stroke formed when an accelerator pedal or a brake pedal is operated, and various kinds of information indicating driving states and vehicle behavior such as a vehicle speed, an acceleration, a yaw, a pitch, and a roll, i.e., behavior formed in the vehicle. The individual motion information may be detected by a motion information detection unit 200 including a steering angle sensor 210, an acceleration position sensor (APS) / pedal stroke sensor (PTS) 220, a vehicle speed sensor 230, an acceleration sensor 240, and a yaw / pitch / roll sensor 250, as illustrated in FIG. 1. The movement information of a vehicle may further include location information of the vehicle. The location information of the vehicle may be obtained via a global positioning system (GPS) receiver 260 deployed on the vehicle. Such movement information may be sent to the autonomous driving integrated controller 600 via a movement information input interface 201 and used to control driving of a vehicle in the autonomous driving mode or manual driving mode of the vehicle.The autonomous driving integrated controller 600 may further transmit driving state information provided to an occupant to the output unit 300 via the occupant output interface 301 in the autonomous driving mode or manual driving mode of a vehicle. That is, the autonomous driving integrated controller 600 transmits driving state information of a vehicle to the output unit 300 so that an occupant can check the autonomous driving state or manual driving state of the vehicle based on the driving state information output via the output unit 300. The driving state information may include various kinds of information indicating driving states of a vehicle, such as a current driving mode, a transmission range, and a vehicle speed of the vehicle. When it is determined that it is necessary to warn a driver in an autonomous driving mode or manual driving mode of a vehicle according to the driving state information, the autonomous driving integrated controller 600 further sends warning information to the output unit 300 via the occupant output interface 301, so that the output unit 300 can output a warning to the driver. For acoustically and visually outputting such driving state information and warning information, the output unit 300 may include a speaker 310 and a display 320, as illustrated in FIG. 1. In this case, the display 320 may be implemented as the same device as the user terminal 120, or may be implemented as an independent device separate from the user terminal 120.The autonomous driving integrated controller 600 may further transmit control information for driving control of a vehicle to a low-level control system 400 applied to a vehicle via the vehicle control output interface 401 in the autonomous driving mode or manual driving mode of the vehicle. As illustrated in FIG. 1, the low-level control system 400 for driving control of a vehicle may include an engine control system 410, a brake control system 420, and a steering control system 430. The autonomous driving integrated controller 600 may transmit engine control information, brake control information, and steering control information as control information to the respective low-order control system 410, 420, and 430 via the vehicle control output unit 401. Accordingly, the engine control system 410 may control the vehicle speed and acceleration of a vehicle by increasing or decreasing fuel supplied to an engine. The brake control system 420 may control the braking of the vehicle by controlling the braking performance of the vehicle. The steering control system 430 may control steering of the vehicle via a controller (e.g., a motor driven power steering system, MDPS system) deployed on the vehicle.As described above, the autonomous driving integrated controller 600 according to the present embodiment may obtain driving information based on a manipulation of a driver and motion information indicating a driving state of a vehicle via the driving information input interface 101 and the motion information input interface 201, respectively, may transmit driving state information and warning information generated based on an autonomous driving algorithm processed by a processor 610 to the output unit 300 via the occupant output interface 301, and may transmit control information generated based on the autonomous driving algorithm processed by the processor 610 to the low-level control system 400 via the vehicle control output interface 401, so that driving control of the vehicle is performed.In order to ensure stable autonomous driving of a vehicle, it is necessary to continuously monitor a driving state of the vehicle by precisely measuring a driving environment and control the driving based on the measured driving environment. To this end, as illustrated in FIG. 1, the autonomous driving apparatus according to the present embodiment may include a sensor unit 500 for detecting a surrounding object of a vehicle, such as a surrounding vehicle, a pedestrian, a roadway, or a stationary device (e.g., a traffic light, a signboard, a traffic signboard, or a construction fence). The sensor unit 500 may include one or more of a LIDAR sensor 510, a radar sensor 520, and a camera sensor 530 to detect an object surrounding outside a vehicle, as shown in FIG. 1.The LIDAR sensor 510 may emit a laser signal to the periphery of a vehicle and may detect an surrounding object outside the vehicle by receiving a signal reflected and returned from a corresponding object. The LIDAR sensor 510 may detect a surrounding object within a predetermined distance, a predetermined vertical field of view, and a predetermined horizontal field of view, which are predefined depending on the specifications of the sensor. The LIDAR sensor 510 may include a front LIDAR sensor 511, an upper LIDAR sensor 512, and a rear LIDAR sensor 513 installed in the front, upper, and rear areas of the vehicle, respectively, but the installation location of each sensor and the number of sensors are not limited to a specific embodiment. A threshold for determining validity of a laser signal reflected and returned from a corresponding object may be previously stored in a memory 620 of the autonomous driving integrated controller 600. The processor 610 of the autonomous driving integrated controller 600 may determine a location (including a distance to a corresponding object), a speed, and a direction of movement of the corresponding object using a method of measuring the time required for a laser signal emitted by the LIDAR sensor 510 to be reflected and returned by the corresponding object.The LIDAR sensor 520 may emit electromagnetic waves around a vehicle, and may detect an surrounding object outside the vehicle by receiving a signal reflected and returned from a corresponding object. The radar sensor 520 may detect a surrounding object within a predetermined distance, a predetermined vertical field of view, and a predetermined horizontal field of view, which are predefined depending on the specifications of the sensor. The radar sensor 520 may include a front radar sensor 521, a left radar sensor 522, a right radar sensor 523, and a rear radar sensor 524 installed in the front, left, right, and rear regions of the vehicle, respectively, but the installation location of each sensor and the number of sensors are not limited to a specific embodiment. The processor 610 of the autonomous driving integrated controller 600 may determine a location (including a distance to a corresponding object), a speed, and a direction of movement of the corresponding object using a method of analyzing the force of electromagnetic waves transmitted and received by the radar sensor 520.The camera sensor 530 may detect a surrounding object outside a vehicle by photographing the periphery of the vehicle, and may detect a surrounding object within a predetermined distance, a predetermined vertical field of view, and a predetermined horizontal field of view, which are predefined depending on the specifications of the sensor. The camera sensor 530 may include a front camera sensor 531, a left camera sensor 532, a right camera sensor 533, and a rear camera sensor 534, which are installed in front, left, right, and rear regions of a vehicle, respectively, but the installation location of each sensor and the number of sensors are not limited to a specific embodiment. The processor 610 of the autonomous driving integrated controller 600 may determine a location (including a distance to a corresponding object), a speed, and a moving direction of the corresponding object by applying predefined image processing to an image captured by the camera sensor 530. Moreover, an internal camera sensor 535 for photographing the interior of a vehicle may be mounted at a given location (e.g., rear view mirror) within the vehicle. The processor 610 of the autonomous driving integrated controller 600 may monitor a behavior and a state of an occupant based on an image captured by the internal camera sensor 535 and may output a notice or warning to the occupant via the output unit 300.As illustrated in FIG. 1, the sensor unit 500 may further include an ultrasonic sensor 540 besides the LIDAR sensor 510, the radar sensor 520, and the camera sensor 530, and may further employ various types of sensors for detecting a surrounding object of a vehicle together with the sensors. FIG. 3 shows an example in which, to understand the present embodiment, the front LIDAR sensor 511 or the front radar sensor 521 has been installed in the front region of a vehicle, the rear LIDAR sensor 513 and the rear radar sensor 524 have been installed in the rear region of the vehicle, and the front camera sensor 531, the left camera sensor 532, the right camera sensor 533 and the rear camera sensor 534 have been installed in the front, left, right and rear regions of the vehicle, respectively. However, as described above, the installation location of each sensor and the number of sensors installed are not limited to a specific embodiment. FIG. 5 shows an example of a predetermined distance and a horizontal field of view within which the LIDAR sensor 510, the radar sensor 520, and the camera sensor 530 may detect a surrounding object in front of the vehicle. FIG. 6 shows an example in which each sensor detects a surrounding object. FIG. 6 is only an example of detecting a surrounding object. A method for detecting a surrounding object is determined from the installation location of each sensor and the number of installed sensors. A surrounding vehicle and a surrounding object in the omnidirectional direction of an autonomously driving ego vehicle may be detected depending on a configuration of the sensor unit 500.To determine a state of an occupant within a vehicle, the sensor unit 500 may further include a microphone and a biosensor for detecting a voice and a biosignal (e.g., heart rate, electrocardiogram, respiration, blood pressure, body temperature, electroencephalogram, photoplethysmography (or pulse wave), and blood sugar) of the occupant. The biosensor may include a heart rate sensor, an electrocardiogram sensor, a respiration sensor, a blood pressure sensor, a body temperature sensor, an electroencephalogram sensor, a photoplethysmography sensor, and a blood sugar sensor.FIG. 4 shows an example of an internal structure of a vehicle. An internal device, the state of which is controlled by manipulation of an occupant, such as a driver or passenger of a vehicle, and which assists in driving or comfort (e.g., resting or entertainment activities) of the occupant may be installed within the vehicle. Such an internal device may include a vehicle seat S on which an occupant sits, a lighting device L such as an interior lighting and a mood lamp, the user terminal 120, the display 320, and an interior table. The state of the internal device may be controlled by the processor 610.The angle of the vehicle seat S may be adjusted by the processor 610 (or by manual manipulation of the occupant). When the vehicle seat S is formed with a front row seat S 1 and a rear row seat S 2, only the angle of the front row seat S 1 can be adjusted. When there is no rear row seat S 2 and the front row seat S 1 is divided into a seat structure and a foot bench structure, the front row seat S 1 may be implemented such that the seat structure of the front row seat S 1 is physically separated from the foot bench structure and the angle of the front row seat S 1 is adjusted. Further, an actuator (e.g., a motor) may be provided for adjusting the angle of the vehicle seat S. The turning on and off of the lighting device may be controlled by the processor 610 (or by manual manipulation of an occupant). When the lighting device L includes a plurality of lighting units such as an interior lighting and a mood lamp, the turning on and off of the lighting units can be independently controlled. The angle of the user terminal 120 or the display 320 may be adjusted by the processor 610 (or by manual manipulation of an occupant) based on a field angle of an occupant. The angle of the user terminal 120 or the display 320 may be set, for example, such that a screen thereof is placed in a viewing direction of an occupant. In this case, an actuator (e.g., motor) may be provided for adjusting the angle of the user terminal 120 and the display 320.As illustrated in FIG. 1, the autonomous driving integrated controller 600 may communicate with a server 700 via a network. Various communication methods such as a wide area network (WAN), a local area network (LAN), or a person area network (PAN) can be adopted as a network method between the autonomous driving integrated control device 600 and the server 700. To ensure wide network coverage, a low power wide area network (LPWAN) communication method, including commercialized technologies such as LoRa, Sigfox, Ingenu, LTE-M, and NB-IoT, i.e., very long range networks under which IoT), may be employed. For example, an LoRa communication method (capable of operating low-power communication and also having a long range of about 20 km at maximum) or a Sigfox communication method (having a range of 10 km (in the city) to 30 km (in the city margin outside the city margin) depending on the environment) may be employed. Moreover, LTE networking technologies based on 3 rd Generation Partnership Project (3GPP) Release 12, 13, such as machine-type communication (LTE-MTC) (or LTE-M), narrow band (NB)LTE, and NB-oT, may be deployed with a power saving mode (PSM). The server 700 may provide the latest map information (may correspond to various kinds of map information, such as two-dimensional (2-D) navigation map data, three-dimensional (3-D) various map data, or 3-D high-precision electronic type data). The server 700 may further provide various types of information, such as accident information, road control information, traffic volume information, and weather information for a road. The autonomous driving integrated controller 600 may update map information stored in the memory 620 by receiving latest map information from the server 700, may receive accident information, road control information, traffic volume information, and weather information, and may use the autonomous driving control information of a vehicle.The structure and functions of the autonomous driving integrated controller 600 according to the present embodiment will be described with reference to FIG. 2. As illustrated in FIG. 2, the autonomous driving integrated controller 600 may include the processor 610 and the memory 620.The memory 620 may store basic information required for autonomous driving control of a vehicle, or may store information generated in an autonomous driving process of a vehicle controlled by the processor 610. The processor 610 may access (or read) information stored in the memory 620, and may control autonomous driving of a vehicle. The memory 620 may be implemented as a computer readable recording medium and may operate such that the processor 610 may access it. Specifically, the memory 620 may be implemented as a hard disk, a magnetic tape, a memory card, a read only memory (ROM), a random access memory (RAM), a digital video disc (DVD), or an optical data storage such as an optical disc.The memory 620 may store map information required for autonomous driving control by the processor 610. The map information stored in the memory 620 may be a navigation map (or a digital map) that provides information to a road unit, but may be implemented as a precise road map that provides road information to a lane unit, i.e., high-precision 3-D electronic map data, to improve the precision of autonomous driving control. Accordingly, the map information stored in the memory 620 may provide dynamic and static information for autonomous driving control of a vehicle, such as a lane, the center line of a lane, an overtaking lane, a lane boundary, the center line of a roadway, a traffic sign, a lane marking, the shape and height of a roadway, and a lane width.The memory 620 may further store the autonomous driving algorithm for autonomous driving control of a vehicle. The autonomous driving algorithm is an algorithm (recognition, determination, and control algorithm) for recognizing the periphery of an autonomous vehicle, determining the state of the periphery of the vehicle, and controlling the travel of the vehicle based on a result of the determination. The processor 610 may perform active autonomous driving control for an environment of a vehicle by executing the autonomous driving algorithm stored in the memory 620.The processor 610 may perform autonomous driving of a vehicle based on the driving information and motion information obtained from the driving information input interface 101 and the motion information input interface 201, the surrounding object information detected by the sensor unit 500, and the map information and the autonomous driving algorithm stored in the memory 620. The processor 610 may be implemented as an embedded processor, such as a complex instruction set computer (CICS) or a reduced instruction set computer (RISC), or as a dedicated semiconductor circuit, such as an application-specific integrated circuit (ASIC).In the present embodiment, the processor 610 may control autonomous driving of an autonomous driving ego vehicle by analyzing the driving trajectory of the autonomous driving ego vehicle and a surrounding vehicle. To this end, the processor 610 may include a sensor processing module 611, a travel trajectory generation module 612, a travel trajectory analysis module 613, a travel control module 614, an occupant state determination module 616, and a trajectory learning module 615, as illustrated in FIG. 2. FIG. 2 shows each of the modules as an independent block based on its function, but the modules may be integrated into a single module and implemented as an element for integrating and performing the functions of the modules.The sensor processing module 611 may acquire surrounding vehicle motion information (i.e., includes the location of the surrounding vehicle, and may further include the speed and direction of motion of the surrounding vehicle along the location) based on a result of detecting, by the sensor unit 500, a surrounding object in the vicinity of an autonomously driving ego vehicle. That is, the sensor processing module 611 may determine the location of a surrounding vehicle based on a signal received from the LIDAR sensor 510, determine the location of a surrounding vehicle based on a signal received from the radar sensor 520, determine the location of a surrounding vehicle based on an image received from the camera sensor 530, and determine the location of a surrounding vehicle based on a signal received from the ultrasonic sensor 540. To this end, as illustrated in FIG. 1, the sensor processing module 611 may include a LIDAR signal processing module 611 a, a radar signal processing module 611 b, and a camera signal processing module 611 c. In some embodiments, an ultrasonic signal processing module (not shown) may be further added to the sensor processing module 611. An implementation method of the method for determining the location of a surrounding vehicle using the LIDAR sensor 510, the radar sensor 520, and the camera sensor 530 is not limited to a particular embodiment. The sensor processing module 611 may further acquire attribute information such as the size and type of a surrounding vehicle in addition to the location, the speed, and the moving direction of the surrounding vehicle. An algorithm for determining information such as the location, speed, direction of movement, size and type of surrounding vehicle may be predetermined.The driving trajectory generation module 612 may generate an actual driving trajectory and an expected driving trajectory of a surrounding vehicle and an actual driving trajectory of an autonomously driving ego vehicle. To this end, as illustrated in FIG. 2, the driving trajectory generation module 612 may include a surrounding vehicle driving trajectory generation module 612 aand an autonomously driven vehicle driving trajectory generation module 612 b.First, the surrounding vehicle travel trajectory generation module 612 amay generate an actual surrounding vehicle travel trajectory.Specifically, the surrounding vehicle travel trajectory generation module 612 acan generate an actual travel trajectory of a surrounding vehicle based on movement information about the surrounding vehicle detected by the sensor unit 500 (i.e., the surrounding vehicle location acquired by the sensor processing module 611). In this case, the surrounding vehicle travel trajectory generation module 612 afor generating the actual surrounding vehicle travel trajectory may refer to map information stored in the memory 620, and may generate the actual surrounding vehicle travel trajectory by cross-referencing the location of the vehicle detected by the sensor unit 500 and a given location in the map information stored in the memory 620. For example, when an surrounding vehicle is detected at a certain location by the sensor unit 500, the surrounding vehicle travel trajectory generation module 612 amay determine a currently detected location of the surrounding vehicle in the map information stored in the storage 620 by cross-referencing the detected location of the surrounding vehicle and a given location in the map information. The surrounding vehicle travel trajectory generation module 612 amay generate an actual surrounding vehicle travel trajectory by continuously monitoring the location of the surrounding vehicle as described above. That is, the surrounding vehicle travel trajectory generation module 612 acan generate an actual surrounding vehicle travel trajectory by associating the location of the surrounding vehicle detected by the sensor unit 500 with a location in the map information stored in the storage 620 based on the cross reference and the accumulation of the location.An actual travel trajectory of a surrounding vehicle may be compared to an expected travel trajectory of the surrounding vehicle, described below, to be used to determine whether the map information stored in the memory 620 is precise. In this case, when an actual travel trajectory of a certain surrounding vehicle is compared with an expected travel trajectory, there may arise a problem that it is erroneously determined that the map information stored in the storage 620 is inaccurate although the map information is precise. For example, if the actual travel trajectories and the expected travel trajectories are the same and an actual travel trajectory and an expected travel trajectory of a particular surrounding vehicle are different, if only the actual travel trajectory of the particular surrounding vehicle is compared with the expected travel trajectory, it may be erroneously determined that the map information stored in the memory 620 is inaccurate, although the map information is precise. In order to prevent this problem, it is necessary to determine whether the tendency of actual travel trajectories of a plurality of surrounding vehicles falls out of the expected travel trajectory. To this end, the surrounding vehicle travel trajectory generation module 612 amay generate the actual travel trajectory of all of the plurality of surrounding vehicles. Moreover, when considering that a driver of a surrounding vehicle tends to slightly move a steering wheel to the left and right during his or her driving process to travel on a straight line, an actual travel trajectory of the surrounding vehicle may be generated in a curved shape, not in a rectilinear shape. To calculate an error between expected travel trajectories, which will be described later, the surrounding vehicle travel trajectory generation module 612 amay generate an actual travel trajectory in a rectilinear shape by applying a given smoothing scheme to the original actual travel trajectory generated in a curved shape. Various schemes such as interpolation for each location of a surrounding vehicle may be employed as the smoothing scheme.In addition, the surrounding vehicle travel trajectory generation module 612 amay generate an expected surrounding vehicle travel trajectory based on map information stored in the memory 620.As described above, the map information stored in the memory 620 may be 3-D high-precision electronic map data. Accordingly, the map information may provide dynamic and static information for autonomous driving control of a vehicle, such as a lane, the center line of a lane, an overtaking lane, a lane boundary, the center line of a roadway, a traffic sign, a lane marking, a shape and height of a roadway, and a lane width. When considering that a vehicle frequently travels in the center of a lane, it may be expected that an surrounding vehicle traveling near an autonomous driving ego vehicle will also travel in the center of the lane. Accordingly, the surrounding vehicle travel trajectory generation module 612 amay generate an expected travel trajectory of the surrounding vehicle as the center line of a roadway incorporated in the map information.The autonomous driving vehicle driving trajectory generation module 612 bmay generate an actual driving trajectory of an autonomous driving ego vehicle that has been driven based on the motion information of the autonomous driving ego vehicle obtained through the motion information input interface 201.Specifically, the autonomous driven vehicle driving trajectory generation module 612 bmay generate an actual driving trajectory of an autonomous driving ego vehicle by cross-referencing a location of an autonomous driving ego vehicle obtained via the motion information input interface 201 (i.e., information on the location of the autonomous driving ego vehicle obtained via the GPS receiver 260) and a given location in the map information stored in the storage 620. For example, the autonomous driven vehicle driving trajectory generation module 612 bmay determine a current location of an autonomous driving ego vehicle in the map information stored in the memory 620 by cross-referencing a location of the autonomous driving ego vehicle obtained via the movement information input interface 201 and a given location in the map information. As described above, the autonomous driven vehicle driving trajectory generation module 612 bmay generate an actual driving trajectory of an autonomous driving ego vehicle by continuously monitoring the location of the autonomous driving ego vehicle. That is, the autonomous driven vehicle driving trajectory generation module 612 bmay generate an actual driving trajectory of the autonomous driving ego vehicle by associating the location of the autonomous driving ego vehicle obtained via the motion information input interface 201 with a location in the map information stored in the storage 620 based on the cross reference and the accumulation of the location.Further, the autonomous driven vehicle driving trajectory generation module 612 bmay generate an expected driving trajectory to the destination of the autonomous driving ego vehicle based on map information stored in the memory 620.That is, the autonomous driven vehicle driving trajectory generation module 612 bmay generate the expected driving trajectory to a destination using a current location of the autonomous driving ego vehicle obtained via the motion information input interface 201 (i.e., current location information of the autonomous driving ego vehicle obtained via the GPS receiver 260) and the map information stored in the storage 620. Like the expected travel trajectory of the surrounding vehicle, the expected travel trajectory of the autonomous driving ego vehicle may be generated as the center line of a road that is incorporated into the map information stored in the memory 620.The driving trajectories generated by the surrounding vehicle driving trajectory generation module 612 aand the autonomously driven vehicle driving trajectory generation module 612 bmay be stored in the memory 620, and may be used for various purposes in a process of controlling, by the processor 610, autonomous driving of an autonomous driving ego vehicle.The driving trajectory analysis module 613 may diagnose a current reliability of autonomous driving control for an ego vehicle driving autonomously by analyzing driving trajectories (i.e., an actual driving trajectory and an expected driving trajectory of a surrounding vehicle and an actual driving trajectory of the ego vehicle driving autonomously) generated by the driving trajectory generation module 612 and stored in the memory 620. The reliability diagnosis of the autonomous driving control may be performed in a process of analyzing a trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle.The driving control module 614 may perform a function of controlling autonomous driving of an autonomously driving ego vehicle. Specifically, the driving control module 614 may synthetically process the autonomous driving algorithm using the driving information and motion information obtained via the driving information input interface 101 and the motion information input interface 201, respectively, the information on an object detected by the sensor unit 500, and the map information stored in the memory 620, may transmit the control information to the low-level control system 400 via the vehicle control output interface 401, such that the low-level control system 400 controls autonomous driving of an autonomous driving ego vehicle, and may transmit the driving state information and warning information of the autonomous driving ego vehicle to the output unit 300 via the occupant output interface 301, such that a driver may recognize the driving state information and warning information. Further, when integrating and controlling such autonomous driving, the driving control module 614 controls the autonomous driving in consideration of the driving trajectories of an autonomous driving ego vehicle and a surrounding vehicle analyzed by the sensor processing module 611, the driving trajectory generation module 612, and the driving trajectory analysis module 613, thereby improving the precision of the autonomous driving control and enhancing the safety of the autonomous driving control.The trajectory learning module 615 may perform learning or corrections on an actual driving trajectory of an autonomously driving ego vehicle generated by the autonomous driven vehicle driving trajectory generation module 612 b. For example, when a trajectory error between an actual driving trajectory and an expected driving trajectory of a surrounding vehicle is a predetermined threshold or more, the trajectory learning module 615 may determine that an actual driving trajectory of an autonomously driving ego vehicle needs to be corrected by determining that the map information stored in the memory 620 is inaccurate. Accordingly, the trajectory learning module 615 may determine a lateral displacement value for correcting the actual driving trajectory of an autonomous driving ego vehicle, and may correct the driving trajectory of the autonomous driving ego vehicle.The occupant state determination module 616 may determine a state and behavior of an occupant based on a state and biosignal of the occupant detected by the internal camera sensor 535 and the biosensor. The occupant's state determined by the occupant state determination module 616 may be used for autonomous driving control via an autonomous driving ego vehicle or in a process for issuing a warning to the occupant.Hereinafter, an embodiment in which a warning corresponding to an autonomous driving risk of an ego vehicle is output to an occupant based on the above contents will be described.As described above, the processor 610 (the travel trajectory generation module 612 of the processor 610) according to the present embodiment may generate an actual travel trajectory of a surrounding vehicle based on travel information of the surrounding vehicle detected by the sensor unit 500. That is, when the surrounding vehicle is detected by the sensor unit 500 at a certain location, the processor 610 may determine the location of the currently detected surrounding vehicle in map information by cross-referencing the location of the detected surrounding vehicle and a location in the map information stored in the memory 620. The processor 610 may generate the actual travel trajectory of the surrounding vehicle by continuously monitoring the location of the surrounding vehicle, as described above.In addition, the processor 610 (the travel trajectory generation module 612 of the processor 610) may generate an expected travel trajectory of the surrounding vehicle based on the map information stored in the memory 620. In this case, the processor 610 may generate the expected travel trajectory of the surrounding vehicle as the center line of a lane integrated with the map information.Subsequently, the processor 610 may determine an autonomous driving risk of the ego vehicle based on whether a driving mode of the surrounding vehicle is an autonomous driving mode and on a trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle, and may output a warning to an occupant at a level corresponding to the determined autonomous driving risk via the output unit 300. The autonomous driving risk of the ego vehicle may be defined as the possibility of a collision with an external object in the autonomous driving process of the ego vehicle. In this case, the processor 610 is configured to be able to output warnings to the occupant via the output unit 300 as first to third levels in ascending order of the autonomous driving risk of the ego vehicle.The warning corresponding to the first level may be a warning output to the occupant when the autonomous driving risk of the ego vehicle is at the lowest level. The warning corresponding to the first stage may be implemented, for example, as an embodiment in which a visual display having a first color (e.g., blue) is output via the output unit 300. The warning corresponding to the second level may be a warning output to the occupant when the autonomous driving risk of the ego vehicle is at a middle level. The warning corresponding to the second stage may be implemented, for example, as an embodiment in which a visual display having a second color (e.g., yellow) is output via the output unit 300. The warning corresponding to the third level may be a warning output to the occupant when the autonomous driving risk of the ego vehicle is at the highest level. The third-stage warning may be implemented, for example, as an embodiment in which a visual display having a third color (e.g., red) is output and a voice warning is output together with the visual display via the output unit 300. The visual warning and the audio warning may be output via the display device 320 and speakers 310 of the output unit 300. In addition, the visual warning and the audio warning are only examples for better understanding of the present embodiment, and may be implemented as different embodiments within the range in which an occupant can recognize a current level of autonomous driving risk of an ego vehicle. A detailed implementation method of the embodiment is not limited to a specific embodiment. The detailed implementation method may further include an additional implementation example, such as a warning using vibration of a seat depending on specifications of a vehicle. A method of outputting the warnings corresponding to the first to third levels may be set or modified by an occupant based on a UI (User Interface) provided by the user terminal 120 or a UI provided by the display device 320 itself.A construction in which the processor 610 outputs a warning to the occupant via an output unit 300 at a level corresponding to the autonomous driving risk will be described in detail. The processor 610 may determine whether a driving mode of a surrounding vehicle is the autonomous driving mode or the manual driving mode based on a V2X communication.When the driving mode of the surrounding vehicle is the autonomous driving mode, the processor 610 may output the warning corresponding to the first level to an occupant via the output unit 300. That is, when the driving mode of the surrounding vehicle is the autonomous driving mode, the possibility that an unexpected situation occurs due to the manual driving of the driver of the surrounding vehicle or the possibility that a collision with an ego vehicle occurs due to poor driving of the driver of the surrounding vehicle may be considered relatively low. In this case, the processor 610 may determine that the autonomous driving risk of the ego vehicle corresponds to the lowest level, and may output a warning corresponding to the first level to the occupant via the output unit 300.When the driving mode of the surrounding vehicle is the manual driving mode, the processor 610 may output the second-stage warning to an occupant via the output unit 300. That is, when the driving mode of the surrounding vehicle is the manual driving mode, the possibility that an unexpected situation occurs due to the manual driving of the driver of the surrounding vehicle or the possibility that a collision with an ego vehicle occurs due to poor driving of the driver of the surrounding vehicle may be considered relatively high compared to a case where the surrounding vehicle is driving in the autonomous driving mode. In this case, the processor 610 may determine that the autonomous driving risk of the ego vehicle corresponds to a middle level, and may output a warning corresponding to the second level to the occupant via the output unit 300.As described above, the warning corresponding to the first or second stage is output to an occupant by the process of determining whether a driving mode of a surrounding vehicle is the autonomous driving mode. Accordingly, the occupant can effectively recognize an autonomous driving risk due to an external factor, that is, an autonomous driving risk based on a collision between an own vehicle and the surrounding vehicle caused by the driving of the surrounding vehicle.The processor 610 may perform the reliability diagnostic of autonomous driving control over an ego vehicle based on a trajectory error between an actual driving trajectory and an expected driving trajectory of the surrounding vehicle. When it is determined as a result of the execution that the autonomous driving control over the own vehicle is unreliable, the processor 610 may output the third-stage warning to an occupant via the output unit 300. In performing the reliability diagnosis of the autonomous driving control over the ego vehicle, the processor 610 may perform the reliability diagnosis of the autonomous driving control over the ego vehicle based on the magnitude of a trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle or the cumulative addition of the trajectory errors.In particular, the state in which there is a trajectory error between the actual travel trajectory or the expected travel trajectory of the surrounding vehicle may correspond to the state in which the autonomous driving control applied to the subject vehicle is unreliable. That is, when there is an error between the actual travel trajectory generated based on travel information about the surrounding vehicle detected by the sensor unit 500 and the expected travel trajectory generated based on map information stored in the memory 620, this is the state in which the surrounding vehicle does not travel along the center line of a lane on which the surrounding vehicle is to travel in the map information. That is, there is a possibility that the surrounding vehicle is erroneously detected by the sensor unit 500, or there is a possibility that the map information stored in the memory 620 is inaccurate. That is, there may be two possibilities. First, although an surrounding vehicle actually travels based on an expected travel trajectory, an error may occur in an actual travel trajectory of the surrounding vehicle due to the abnormality of the sensor unit 500. Second, the map information stored in the memory 620 and the state of the roadway on which the surrounding vehicle is now traveling may not match each other (e.g., the surrounding vehicles are traveling in a displaced lane because the lane has displaced leftward or rightward compared to the map information stored in the memory 620 because a roadway on which the surrounding vehicle is now traveling has been built or newly repaired). Accordingly, the processor 610 may perform the reliability diagnostic of the autonomous driving control over the ego vehicle based on the magnitude of a trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle or on a cumulative addition of the trajectory errors. Moreover, as described above, to take into account a general driving tendency of the surrounding vehicle, trajectory errors between actual driving trajectories and expected driving trajectories of a plurality of surrounding vehicles, not an actual driving trajectory of a specific surrounding vehicle, may be taken into account.A process for performing, by the processor 610, the reliability diagnosis based on a trajectory error between an actual travel trajectory and an expected travel trajectory of a surrounding vehicle will be described in detail. When the state in which the magnitude of the trajectory error is a predetermined first critical value or more occurs within a predetermined first critical time, the processor 610 may first determine that autonomous driving control over an ego vehicle is unreliable.In this case, the first critical time is a time set for diagnosing the reliability of the autonomous driving control. A point in time, i.e. a criterion for the time, can be the point in time at which a comparison between an actual travel trajectory and an expected travel trajectory of a surrounding vehicle is initiated by means of the processor 610. Specifically, a process of generating, by the processor 610, an actual travel trajectory and an expected travel trajectory of a surrounding vehicle, calculating a trajectory error between the actual travel trajectory and the expected travel trajectory, and diagnosing the reliability of the autonomous travel control in a predetermined determination cycle may be periodically performed to reduce the resource of the memory 620 and a computational load of the processor 610 (accordingly, an actual travel trajectory and an expected travel trajectory of a surrounding vehicle stored in the memory 620 may be periodically deleted in the determination cycle). In this case, when the state in which the magnitude of the trajectory error is the first critical value or more occurs before the first critical time has elapsed from the time point at which a cycle was initiated, the processor 610 may determine that the autonomous driving control is unreliable. The magnitude of the first critical time, which is a value smaller than the magnitude of the time portion of the determination cycle, may be configured in various ways depending on the intention of a developer and stored in the memory 620. In addition, the first critical value may also be configured in various ways depending on the intention of a developer and stored in the memory 620.Further, the processor 610 may additionally perform the reliability diagnosis by cumulative addition of the trajectory errors while the magnitude of the trajectory error is less than the first critical value for the first critical time. That is, although the magnitude of the trajectory error is less than the first critical value for the first critical time, when a cumulative and added value of the trajectory errors less than the first critical value is a given value or more, the state of the surrounding vehicle corresponds to the state in which the surrounding vehicle has moved a given time by deviating from the expected travel trajectory despite the low degree of error. Accordingly, the processor 610 may more accurately determine whether the autonomous driving control over the ego vehicle is reliable by additionally performing the reliability diagnosis by the cumulative addition of the trajectory errors.In this case, in the state in which the magnitude of the trajectory error is less than the first critical value for the first critical time, when the state in which cumulative addition obtained by accumulating and adding the trajectory errors (i.e., a cumulative and added value of the trajectory errors within one cycle) is the predetermined second critical value or more occurs within a second critical time set as a value greater than the first critical time, the processor 610 may determine that the autonomous driving control over the own vehicle is unreliable. In this case, the second critical time, which is a value larger than the first critical time and smaller than the size of a temporal portion of the determination cycle, may be stored in the memory 620 in advance. In addition, the second critical value may be configured in various ways depending on the intention of a developer and stored in the memory 620.When it is determined via the above process that the autonomous driving control over the own vehicle is unreliable, the processor 610 may output the third-stage warning to the occupant via the output unit 300. That is, when it is determined via the above process that the autonomous driving control over the ego vehicle is unreliable, an autonomous driving risk may be considered to be higher than an autonomous driving risk caused in the autonomous driving mode or the manual driving mode of the surrounding vehicle. Accordingly, the processor 610 may determine that the autonomous driving risk corresponds to the highest level and may output a warning corresponding to the third level to the occupant via the output unit 300. In this case, the processor 610 may output the warning to the occupant in consideration of a state of the occupant (e.g., the state of the occupant detected by the occupant state determination module 616) detected by the sensor unit 500 (the internal camera sensor 535 thereof) via the output unit 300. In this case, when it is determined that the eyes of the occupant are not directed forward, the processor 610 may output the warning to the occupant via the output unit 300. Accordingly, the occupant can recognize the third-stage warning output via the output unit 300 and can take appropriate follow-up action by perceiving the possibility that an operation of the sensor unit 500 may be abnormal or the possibility that the map information stored in the memory 620 may be inaccurate.As described above, the reliability of the autonomous driving control is diagnosed via the own vehicle, and the third-stage warning is output to the occupant. Accordingly, the occupant can effectively recognize the autonomous driving risk due to an internal factor, that is, the autonomous driving risk due to a collision between the own vehicle and the surrounding vehicle caused by erroneous autonomous driving control of the own vehicle itself.After outputting the warning to the occupant via the output unit 300, when the magnitude of the trajectory error between the actual travel trajectory and the expected travel trajectory of the surrounding vehicle becomes less than the first critical value or the cumulative addition of the trajectory errors becomes less than the second critical value, the processor 610 may cancel the warning via the output unit 300. That is, after outputting the warning, when the magnitude of the trajectory error becomes less than the first critical value or the cumulative addition of the trajectory errors becomes less than the second critical value within one cycle, this means that the reliability of the autonomous driving control over the own vehicle is recovered. Accordingly, the processor 610 may cancel the warning output via the output unit 300 to prevent an unnecessary warning from being output to a driver. In this case, when the warning is output at a certain time although the warning output via the output unit 300 has been canceled, it means that there is a possibility that the map information stored in the memory 620 may be inaccurate with respect to a certain location or a certain portion of a lane. Accordingly, the processor 610 may update map information stored in the memory 620 with new map information that is later received from the server 700 at a time when the current autonomous driving control over an own vehicle is not impaired.Further, after outputting the warning to the occupant via the output unit 300, when it is determined that a state of the occupant detected by the sensor unit 500 is a looking forward state, the processor 610 may cancel the warning output via the output unit 300. That is, when the occupant keeps the eyes forward after the output of the warning, it may be determined that the subject vehicle is currently traveling safely. Accordingly, the processor 610 may cancel the warning output via the output unit 300 to prevent an unnecessary warning from being output to a driver. Even in this case, the processor 610 may update map information stored in the memory 620 with new map information that is later received from the server 700 at a time when the current autonomous driving control over an own vehicle is not impaired.When the autonomous driving mode of the ego vehicle is turned off based on an autonomous driving risk of the ego vehicle determined based on the trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle, the processor 610 may control one or more of driving the ego vehicle and communication with an external organization based on a state of the occupant detected by the sensor unit 500. That is, even after the warning is output to the occupant via the output unit 300, when it is determined that the magnitude of the trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle is the first critical value or more or a cumulative addition of the trajectory errors is the second critical value or more and a state of the occupant detected by the sensor unit 500 does not correspond to the looking-forward state, the processor 610 may turn off the autonomous driving mode to cause the occupant to manually drive. After the autonomous driving mode is turned off, the processor 610 may control one or more of driving of the ego vehicle and communication with an external organization based on a state of the occupant detected by the sensor unit 500.An operation of the processor 610 ofor controlling the driving of the ego vehicle and communication with an external organization based on the state of the occupant after the autonomous driving mode of the ego vehicle is turned off will be described. When no manual driving manipulation of the occupant is performed after the autonomous driving mode of the ego vehicle is turned off, the processor 610 may switch the driving mode of the ego vehicle to an emergency autonomous driving mode so that the ego vehicle may move to a specific location required for the occupant. That is, although the autonomous driving mode has been turned off, if manual driving manipulation of the occupant is not detected via the steering angle sensor 210 or via the APS / PTS 220 of the driving information detector 200, the processor 610 may primarily determine that an emergency situation has occurred in the occupant, and may control the low-level control system 400 by allowing the driving mode of the ego vehicle to enter the emergency autonomous driving mode so that the ego vehicle moves to a specific location required by an occupant (e.g., a nearby hospital, an emergency room, a gas station, or a stop room).Further, when a behavior of the occupant is not detected via the sensor unit 500 or the biosignal of the occupant detected by the sensor unit 500 has a different pattern from a normal biosignal previously stored in the memory 620 as a biosignal in normal physical sensing of the occupant, the processor 610 may transmit a rescue signal to an external organization.That is, when a behavior of the occupant is not detected by the internal camera sensor 535 provided in the sensor unit 500 (i.e., the occupant does not move) or a biosignal (i.e., a pulse or a body temperature) of the occupant detected by a biosensor provided in the sensor unit 500 has a different pattern from the normal biosignal, the processor 610 may determine that an emergency situation has occurred in the occupant and may transmit an emergency signal to an external organization (e.g., a nearby hospital, a fire station, or a police station) required for the occupant.FIG. 7 is a flowchart for describing an autonomous driving method according to an embodiment of the present disclosure. FIG. 8 is a flowchart for describing a step of outputting a warning in the autonomous driving method according to the embodiment of the present disclosure in concrete terms.The autonomous driving mode according to the embodiment of the present disclosure will be described with reference to FIG. 7. First, the processor 610 controls autonomous driving over an ego vehicle based on map information stored in the memory 620 (S 100).Further, the processor 610 generates an actual travel trajectory and an expected travel trajectory of a surrounding vehicle in the vicinity of the subject vehicle based on travel information about the surrounding vehicle detected by the sensor unit 500 and map information stored in the memory 620 (S 200).Further, the processor 610 determines an autonomous driving risk of the subject vehicle based on whether a driving mode of the surrounding vehicle is the autonomous driving mode and a trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle, and outputs a warning to an occupant at a level corresponding to the determined autonomous driving risk via the output unit 300 (S 300). In step S 300, the processor 610 may output the warnings to the occupant via the output unit 300 as first to third levels based on an ascending order of the autonomous driving risk of the ego vehicle.Step S 300 will be described in detail with reference to FIG. 8. The processor 610 determines the driving mode of the surrounding vehicle (S 301). When the driving mode of the surrounding vehicle is the autonomous driving mode as a result of the determination, the processor 610 outputs a warning corresponding to the first level to the occupant via the output unit 300 (S 302). When the traveling mode of the surrounding vehicle is the manual traveling mode as a result of the determination in step S 301, the processor 610 outputs a second-stage warning to the occupant via the output unit 300 (S 303).After step S 302 or S 303, the processor 610 performs the reliability diagnosis of the autonomous driving control over the ego vehicle based on the magnitude of the trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle or a cumulative addition of the trajectory errors. When it is determined as a result of the execution that the autonomous driving control over the own vehicle is unreliable, the processor 610 outputs a third-stage warning to the occupant via the output unit 300.Specifically, when the state in which the magnitude of the trajectory error between the actual travel trajectory and the expected travel trajectory of the surrounding vehicle is a predetermined first critical value or more occurs within a predetermined first critical time (S 304) or the state in which a cumulative addition obtained by accumulating and adding the trajectory errors is a predetermined second critical value or more occurs within a second critical time predetermined as a value greater than the first critical time (S 305), in the state in which the magnitude of the trajectory error is less than the first critical value for the first critical time, the processor 610 determines that the autonomous driving control over the subject vehicle is unreliable and outputs a third-stage corresponding warning to the third stage to the occupant via the output unit 300 (S 306). When the state in which the cumulative addition is the second critical value or more does not occur in step S 305, the processor 610 performs normal autonomous driving control (S 600).After step S 300, when it is determined in step S 400 that the magnitude of the trajectory error between the actual travel trajectory and the expected travel trajectory of the surrounding vehicle becomes less than the first critical value or the cumulative addition of the trajectory errors becomes less than the second critical value or a state of the occupant detected by the sensor unit 500 is a looking-forward state (when a warning cancel condition in FIG. 7 is satisfied), the processor 610 cancels the warning output via the output unit 300 (S 500) and performs normal autonomous driving control (S 600).On the other hand, after step S 300, when it is determined in step S 400 that the state of the occupant detected by the sensor unit 500 does not match the looking-forward state in the state in which the magnitude of the trajectory error is the first critical value or more or the cumulative addition of the trajectory errors is the second critical value or more (when the warning cancel condition in FIG. 7 is not satisfied), the processor 610 turns off the autonomous driving mode (S 700).After step S 700, the processor 610 controls one or more of the driving of the subject vehicle and the communication with an external organization based on a state of the occupant detected by the sensor unit 500 (S 800).In step S 800, when no manual driving manipulation of the occupant is performed (S 810), the processor 610 allows the driving mode of the ego vehicle to enter the emergency autonomous driving mode so that the ego vehicle can move to a specific location required for the occupant (S 820). Further, when a behavior of the occupant is not detected by the sensor unit 500 or a biosignal of the occupant detected by the sensor unit 500 has a different pattern from a normal biosignal previously stored in the memory 620 as a biosignal in normal physical sensing of the occupant (S 830), the processor 610 transmits a rescue signal to an external organization (S 840).As described above, in the present embodiment, it is possible to alert an occupant via an output device such as a speaker or a display device employed in an autonomous vehicle, in consideration of both an autonomous driving risk due to an external factor determined by a process of determining whether a driving mode of a surrounding vehicle in the vicinity of an ego vehicle is the autonomous driving mode and an autonomous driving risk due to an internal factor determined by a process of performing the reliability diagnosis of the autonomous driving control via the ego vehicle. Accordingly, the occupant can accurately recognize an autonomous driving state of the subject vehicle and take appropriate follow-up action, thereby improving the driving stability and driving accuracy of the autonomous vehicle.Further, in the present embodiment, it is possible to effectively deal with an emergency situation occurring at an occupant by controlling emergency running of an ego vehicle and transmission of an emergency signal to an external organization based on a state of the occupant after turning off the autonomous driving mode of the ego vehicle.Although the present disclosure has been disclosed with reference to embodiments illustrated in the figures, the embodiments are for illustrative purposes only, and it will be apparent to those skilled in the art that various modifications and other equivalent embodiments are possible without departing from the scope or spirit of the disclosure as defined in the appended claims. The true technical scope of the disclosure is therefore to be defined by the following claims.

Claims

An autonomous driving apparatus, comprising: a sensor unit (500) configured to detect a surrounding vehicle in the vicinity of an autonomous driving ego vehicle and to detect a state of an occupant boarding the ego vehicle; an output unit (300); a memory (620) configured to store map information; and a processor (610) configured to control autonomous driving of the ego vehicle based on the map information stored in the memory, wherein the processor (610) is configured to: generate an actual driving trajectory and an expected driving trajectory of the surrounding vehicle based on the driving information of the surrounding vehicle detected by the sensor unit (500) and the map information stored in the memory (620), and controlling one or more of driving of the ego vehicle and communication with an external organization based on a state of the occupant detected by the sensor unit ( 500) when an autonomous driving mode of the ego vehicle is turned off, based on an autonomous driving risk of the ego vehicle determined based on a trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle.The autonomous driving apparatus according to claim 1, wherein the processor (610) is configured to: determine the autonomous driving risk of the ego vehicle based on whether a driving mode of the surrounding vehicle is an autonomous driving mode and based on the trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle, and output a warning to the occupant via the output unit (300) at a level corresponding to the determined autonomous driving risk, wherein the processor (610) outputs the warnings to the occupant via the output unit (300) as first to third levels based on an ascending order of the autonomous driving risk of the ego vehicle.The autonomous driving apparatus according to claim 2, wherein the processor (610) is configured to: output a warning corresponding to the first level to the occupant via the output unit (300) when the driving mode of the surrounding vehicle is the autonomous driving mode, and output a warning corresponding to the second level to the occupant via the output unit (300) when the driving mode of the surrounding vehicle is a manual driving mode.The autonomous driving apparatus according to claim 2, wherein the processor (610) is configured to: perform a reliability diagnosis of the autonomous driving control over the ego vehicle based on a magnitude of the trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle or a cumulative addition of the trajectory errors; and output a third-stage corresponding warning to the third stage to the occupant via the output unit (300) when it is determined that the autonomous driving control over the ego vehicle is unreliable as a result of the execution of the diagnosis.The autonomous driving apparatus according to claim 4, wherein the processor (610) is configured to determine that the autonomous driving control over the ego vehicle is unreliable when the state in which the magnitude of the trajectory error is a predetermined first critical value or more occurs within a predetermined first critical time.The autonomous driving apparatus according to claim 5, wherein the processor (610) is configured to: additionally perform the reliability diagnosis by means of the cumulative addition of the trajectory errors in the state where the magnitude of the trajectory error is less than the first critical value for the first critical time, and determine that the autonomous driving control over the ego vehicle is unreliable when the state where the cumulative addition obtained by accumulating and adding the trajectory errors is a predetermined second critical value or more occurs within a second critical time predetermined as a value greater than the first critical time in the state where the magnitude of the trajectory error is less than the first critical value for the first critical time.The autonomous driving apparatus according to claim 6, wherein the processor (610) is configured to cancel the warning output via the output unit (300) when the magnitude of the trajectory error becomes less than the first critical value, when the cumulative addition of the trajectory errors becomes less than the second critical value, or when it is determined that the state of the occupant detected by the sensor unit (500) is a looking-forward state, after the output of the warning to the occupant via the output unit (300).The autonomous driving apparatus according to claim 7, wherein the processor (610) is configured to turn off the autonomous driving mode of the ego vehicle when it is determined that the state of the occupant detected by the sensor unit (500) does not match the looking-forward state in a state in which the magnitude of the trajectory error becomes the first critical value or more or the cumulative addition of the trajectory errors becomes the second critical value or more.The autonomous driving apparatus of claim 8, wherein the processor (610) is configured to allow the driving mode of the ego vehicle to enter an emergency autonomous driving mode such that the ego vehicle can move to a specific location required for the occupant when no manual driving manipulation is performed by the occupant after the autonomous driving mode of the ego vehicle is turned off.The autonomous driving apparatus according to claim 9, wherein the processor (610) is configured to transmit a rescue signal to the external organization when a behavior of the occupant is not detected via the sensor unit (500) or a biosignal of the occupant detected by the sensor unit (500) has a different pattern from a normal biosignal previously stored in the memory (620) as a biosignal in normal physical sensing of the occupant.A method for autonomous driving, comprising the steps of: controlling, by a processor (610), autonomous driving of an ego vehicle based on map information stored in a memory (620); generating, by the processor (610), an actual driving trajectory and an expected driving trajectory of a surrounding vehicle in the vicinity of the ego vehicle based on driving information of the surrounding vehicle detected by the sensor unit and the map information stored in the memory (620); and controlling, by the processor ( 610), one or more of driving the ego vehicle and communication with an external organization based on a state of an occupant detected by the sensor unit ( 500), when an autonomous driving mode of the ego vehicle is turned off, based on an autonomous driving risk of the ego vehicle determined based on a trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle.The autonomous driving method according to claim 11, further comprising: determining, by the processor (610), the autonomous driving risk of the ego vehicle based on whether a driving mode of the surrounding vehicle is an autonomous driving mode and based on the trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle; and outputting a warning to the occupant via the output unit (300) at a level corresponding to the determined autonomous driving risk, wherein the processor (610) outputs the warnings to the occupant via the output unit (300) as first to third levels based on an ascending order of the autonomous driving risk of the ego vehicle.The autonomous driving method according to claim 12, wherein, in outputting the warning, the processor (610) outputs a warning corresponding to the first level to the occupant via the output unit (300) when the driving mode of the surrounding vehicle is the autonomous driving mode, and outputs a warning corresponding to the second level to the occupant via the output unit (300) when the driving mode of the surrounding vehicle is a manual driving mode.The autonomous driving method according to claim 12, wherein, in outputting the warning, the processor (610) performs reliability diagnosis of the autonomous driving control over the ego vehicle based on a magnitude of the trajectory error between the actual driving trajectory and the expected driving trajectory of the surrounding vehicle or cumulative addition of the trajectory errors, and outputs a warning corresponding to the third level to the occupant via the output unit (300) when it is determined that the autonomous driving control over the ego vehicle is unreliable as a result of the diagnosis.The autonomous driving method according to claim 14, wherein the processor (610), in outputting the warning, determines that the autonomous driving control over the ego vehicle is unreliable when the state in which the magnitude of the trajectory error is a predetermined first critical value or more occurs within a predetermined first critical time.The autonomous driving method according to claim 15, wherein the processor (610), in outputting the warning, determines that the autonomous driving control over the ego vehicle is unreliable when the state in which the cumulative addition of the trajectory errors obtained by accumulating and adding the trajectory errors is a predetermined second critical value or more occurs within a second critical time predetermined as a value greater than the first critical time in the state in which the magnitude of the trajectory error is less than the first critical value for the first critical time.The autonomous driving method according to claim 16, further comprising, after the outputting of the warning, cancelling, by the processor (610), the warning outputted via the output unit (300) when the magnitude of the trajectory error becomes less than the first critical value, when the cumulative addition of the trajectory errors becomes less than the second critical value, or when it is determined that the state of the occupant detected by the sensor unit (500) is a looking-forward state.The autonomous driving apparatus according to claim 17, further comprising turning off, by the processor (610), the autonomous driving mode of the ego vehicle when it is determined that the state of the occupant detected by the sensor unit (500) does not match the looking-forward state in a state in which the magnitude of the trajectory error becomes the first critical value or more or the cumulative addition of the trajectory errors becomes the second critical value or more.The autonomous driving apparatus of claim 18, wherein the processor (610), in controlling one or more of the ego vehicle driving and the communication, allows the ego vehicle driving mode to enter an emergency autonomous driving mode such that the ego vehicle can move to a specific location required by the occupant if no manual driving manipulation is performed by the occupant after the ego vehicle autonomous driving mode is turned off.The autonomous driving method of claim 19, wherein the processor (610), in controlling one or more of the driving of the ego vehicle and the communication, sends a rescue signal to the external organization when a behavior of the occupant is not detected via the sensor unit (500) or a biosignal of the occupant detected by the sensor unit (500) has a different pattern than a normal biosignal previously stored in the memory as a biosignal in normal physical sensing of the occupant.

Images