Vehicle control system, vehicle manufacturing method, program, and information processing device

Abstract

To provide a vehicle control system for assuring security by invalidating a remote or automatic vehicle control function while performing remote or automatic vehicle control.SOLUTION: A vehicle control system (100) comprises: a vehicle (101) including a communication terminal (102) having a communication function; an ECU (103) mounted on the vehicle so as to perform operation control of the vehicle by communication via the communication terminal; a transmission section (104) for transmitting a control instruction value to be used for performing the operation control of the vehicle to the ECU via the communication terminal from an outer side of the vehicle; and an invalidation request section (105) for irreversibly requesting the ECU to invalidate the operation control of the vehicle via the communication terminal from the outer side of the vehicle. The system performs the irreversible invalidation of the operation control when the invalidation request section requests the invalidation after the performance of the operation control.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to a vehicle control system, a vehicle manufacturing method, a program, and an information processing device. [Background technology]

[0002] Patent Document 1 describes an invention of an authentication system and authentication method that can ensure high security. In the invention described in Patent Document 1, when challenge-response authentication is performed between a vehicle and a terminal, a raw value of a random number is generated on the vehicle side. The raw value is converted to a first converted random number on the vehicle, and a first authentication value is generated from this first converted random number. The first authentication value on the vehicle side is transmitted from the vehicle to the terminal and compared with a first authentication value similarly generated on the terminal. In addition, the terminal converts the raw value of the random number received from the vehicle to a second converted random number, and generates a second authentication value from this second converted random number. The second authentication value on the terminal side is transmitted from the terminal to the vehicle and compared with a second authentication value similarly generated on the vehicle. If the comparison of both the first authentication value and the second authentication value is successful, the challenge-response authentication transitions to success. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-129158 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the invention of Patent Document 1 requires that a true random number generator be installed in the terminal or the on-board ECU (Electronic Control Unit) to generate random numbers for generating authentication values. Also, when random numbers are shared between the vehicle and the terminal, security measures such as encrypting messages using public key cryptography or the like are required to fully ensure the confidentiality of messages containing random numbers.

[0005] Therefore, an object of the present disclosure is to provide a vehicle control system that performs remote or automatic vehicle control while ensuring security by disabling the remote or automatic vehicle control function. [Means for solving the problem]

[0006] The vehicle control system of the present disclosure comprises: A vehicle equipped with a communication terminal having a communication function; An ECU (Electronic Control Unit) mounted on the vehicle, which executes driving control of the vehicle using communication via the communication terminal; a transmission unit that transmits a control instruction value used for controlling the operation of the vehicle to the ECU via the communication terminal from outside the vehicle; a disable request unit that requests the ECU to irreversibly disable driving control of the vehicle from outside the vehicle via the communication terminal, The vehicle control system executes irreversible invalidation of the driving control after executing the driving control.

[0007] With the above configuration, a vehicle control system can be provided that performs remote or automatic vehicle control while ensuring security by disabling the remote or automatic vehicle control function.

[0008] The vehicle control system of the present disclosure further comprises: The control instruction value is communicated using a Controller Area Network (CAN) communication. The invalidation of the operational control is characterized in that it is communicated using diagnosis communication.

[0009] With the above configuration, it is possible to provide an inexpensive vehicle control system with high security by using existing communication standards appropriately.

[0010] The vehicle control system of the present disclosure further comprises: After the operational control is disabled, the disablement is confirmed using diagnosis communication.

[0011] With the above configuration, it is possible to check the invalidation using an existing communication standard.

[0012] The vehicle control system of the present disclosure further comprises: The vehicle control system is characterized in that driving control is performed during inspection at a vehicle factory, and disabling is performed before shipment.

[0013] With the above configuration, the vehicle can be controlled in an automated manner before being shipped.

[0014] The vehicle control system of the present disclosure comprises: The communication terminal is characterized in that it is a dongle or a data communication module.

[0015] The above configuration is an example of a communication terminal that allows a vehicle to communicate with a remote information processing device such as a server.

[0016] The vehicle control system of the present disclosure comprises: The communication terminal is characterized in that it is collected by an operator after the operation control is disabled.

[0017] With the above configuration, after shipment, communication for remote or autonomous driving cannot be performed, thereby ensuring security.

[0018] The vehicle control system of the present disclosure comprises: The disabling of the operational control is Burning the circuitry of said ECU, or Delete the application that performs the communication function stored in the ECU, or The communication function is executed by rewriting the software that is stored in the ECU and that performs the communication function.

[0019] With the above configuration, irreversible operational control is disabled, thereby ensuring security.

[0020] The vehicle control system of the present disclosure comprises: The disabling of the operational control is When it is detected that the vehicle has reached a predetermined position, or When an operator performs a specified operation, or When production management information is referenced and it is confirmed that no operational control is required, or If a deactivation instruction is received, or When the vehicle has completed a predetermined power supply by the power supply device, or The method is characterized in that it is executed when the vehicle completes a lap.

[0021] The above configuration is an example of a trigger for disabling the operation control.

[0022] The vehicle control system of the present disclosure comprises: the vehicle control system performs driving control based on information from an imaging device installed in a vehicle factory; The operational control is disabled based on information about the worker's actions captured by the imaging device.

[0023] With the above configuration, driving control can be performed using an imaging device installed in a vehicle factory for various purposes such as safety, and driving control can be disabled.

[0024] The vehicle control system of the present disclosure comprises: After the irreversible driving control is disabled, the vehicle performs a predetermined operation.

[0025] With the above configuration, an operator can confirm that irreversible driving control of the vehicle has been disabled.

[0026] The vehicle control system of the present disclosure comprises: The predetermined operation is The hazard warning lights are on, or Horn honking, or Wiper operation, or Move the wheel left or right, or The display is characterized by being displayed on a monitor installed outside the vehicle.

[0027] The above configurations are examples of predetermined operations for confirming the disabling of irreversible operational control.

[0028] The vehicle manufacturing method of the present disclosure includes: controlling the operation of the vehicle in response to a request from outside the vehicle via a communication terminal during inspection at a vehicle factory; The vehicle manufacturing method includes irreversibly disabling driving control of the vehicle in response to a request made from outside the vehicle via the communication terminal before shipment.

[0029] With the above configuration, it is possible to provide a vehicle manufacturing method that ensures security by disabling the remote or automatic vehicle control function while performing remote or automatic vehicle control. Also, it is possible to manufacture vehicles by controlling the vehicle before shipment in an automatic driving mode.

[0030] The program of the present disclosure is Controlling the operation of the vehicle in response to a request from outside the vehicle via a communication terminal; The program causes an ECU (Electronic Control Unit) mounted on a vehicle to irreversibly disable driving control of the vehicle, in response to a request from outside the vehicle via the communication terminal.

[0031] With the above configuration, it is possible to provide a program that ensures security by disabling the remote or automatic vehicle control function while performing remote or automatic vehicle control.

[0032] The server of the present disclosure includes: a transmission unit that transmits a control instruction value used for controlling the operation of the vehicle to an ECU via a communication terminal from outside the vehicle; and a disable request unit that requests the ECU to irreversibly disable driving control of the vehicle from outside the vehicle via the communication terminal.

[0033] With the above configuration, it is possible to provide an information processing device that ensures security by disabling the remote or automatic vehicle control function while executing remote or automatic vehicle control. Effect of the Invention

[0034] The present disclosure makes it possible to provide a vehicle control system that performs remote or automatic vehicle control while ensuring security by disabling the remote or automatic vehicle control function. [Brief description of the drawings]

[0035] [Figure 1] 1 is a schematic diagram of a vehicle control system according to an embodiment; [Diagram 2] 1 is a block diagram showing a configuration example of a vehicle control system according to an embodiment; [Diagram 3] 4 is a flowchart of a method for manufacturing a vehicle according to an embodiment. [Figure 4] 1 is a conceptual diagram showing a configuration of a system 50 in a first embodiment. [Diagram 5] FIG. 2 is a block diagram showing the configuration of a system 50. [Figure 6] 4 is a flowchart showing a processing procedure for driving control of a vehicle 400 in the first embodiment. [Figure 7] FIG. 11 is an explanatory diagram showing a schematic configuration of a system 50v in a second embodiment. [Figure 8] 10 is a flowchart showing a processing procedure for driving control of a vehicle 400v in a second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0036] Embodiment Hereinafter, an embodiment of the present invention will be described with reference to the drawings. However, the invention according to the claims is not limited to the following embodiment. Furthermore, not all of the configurations described in the embodiment are necessarily essential as means for solving the problem. For clarity of explanation, the following description and drawings are omitted and simplified as appropriate. In each drawing, the same elements are given the same reference numerals, and repeated explanations are omitted as necessary.

[0037] (Description of Vehicle Control System According to an Embodiment) Fig. 1 is a schematic diagram of a vehicle control system according to an embodiment. Fig. 2 is a block diagram showing a configuration example of the vehicle control system according to the embodiment. The vehicle control system according to the embodiment will be described with reference to Figs. 1 and 2.

[0038] The vehicle control system 100 is used, for example, in a vehicle manufacturing factory. During vehicle manufacturing, it is necessary to move the vehicle by remote or automatic control during inspection, and to disable the remote or automatic control before shipping. By controlling the vehicle remotely or automatically during inspection, the vehicle can be operated unmanned, making it less likely that a human-caused accident will occur. In addition, by disabling the remote or automatic control before shipping, it is possible to prevent the vehicle from being remotely controlled when it is in use. The vehicle control system 100 allows the vehicle to be controlled by automatic driving before shipping.

[0039] As shown in FIGS. 1 and 2, the vehicle control system 100 includes a vehicle 101, a communication terminal 102, an ECU (Electronic Control Unit) 103, a transmission unit 104, and an invalidation request unit 105.

[0040] Vehicle 101 can be any vehicle that is manufactured. Vehicle 101 can be any vehicle that is manufactured and inspected, such as cars, trucks, buses, and construction vehicles.

[0041] The communication terminal 102 is a terminal having a communication function for communicating with devices outside the vehicle. The communication terminal 102 is a wireless communication terminal mounted on the vehicle 101, such as a dongle. The dongle is collected by an operator before shipping after disabling remote or automatic control. The communication terminal may also be a data communication module (DCM (Data Communication Module)). The communication terminal 102 may also be a wired communication terminal. The communication terminal 102 can communicate using CAN (Controller Area Network) communication and diagnosis communication, which are common for vehicle control and inspection. CAN communication is a communication standard that allows multi-directional transmission and reception. Diagnosis communication is a communication standard that allows one-to-one correspondence between requests and responses, and is used for fault diagnosis, etc.

[0042] The ECU 103 is a general ECU, such as a brake ECU, mounted on the vehicle 101 and controls the vehicle 101. The ECU 103 executes driving control of the vehicle remotely or automatically using communication via a communication terminal. For this purpose, the ECU 103 controls the actuator of the vehicle according to a control instruction value via CAN communication. The control instruction value is data required for driving control, such as steering angle, acceleration, map and route information for automatic driving, and video. Driving control is control of acceleration, speed, steering angle, etc. In addition, after executing remote or automatic driving control, the ECU 103 irreversibly executes disabling of the remote or automatic driving control of the vehicle by an instruction via diagnosis communication. For this purpose, the ECU 103 includes a secure microcomputer equipped with an FPGA (Field Programmable Gate Array), a flash memory, etc. The ECU 103 includes, for example, a hardware security module. By using existing communication standards appropriately, security can be increased at low cost.

[0043] The transmission unit 104 is an information processing device outside the vehicle, such as a control PC (Personal Computer) or a server. The transmission unit 104 transmits a control instruction value for requesting remote or automatic driving control of the vehicle to the ECU 103 from outside the vehicle 101 via the communication terminal 102. For this reason, the transmission unit 104 transmits a control instruction value for remote or automatic driving control to the vehicle 101 via CAN communication.

[0044] The invalidation request unit 105 is an information processing device outside the vehicle, such as an electronic inspection device. The invalidation request unit 105 requests the ECU 103 from outside the vehicle 101 via the communication terminal 102 to irreversibly invalidate the remote or automatic driving control of the vehicle. Therefore, the invalidation request unit 105 requests the vehicle 101 to invalidate the remote or automatic driving control via diagnosis communication.

[0045] Here, the transmitting unit 104 has been described as being an information processing device different from the invalidation request unit 105, but they may be the same information processing device. The information processing device may be one information processing device or multiple information processing devices. Also, some or all of the functions of the information processing device may be distributed to the cloud. Also, the communication terminal 102 has been described as being one. However, there may be multiple communication terminals 102, and different communication terminals may be used for each communication standard.

[0046] Using these devices, the vehicle control system 100 executes the remote or automatic driving control, and then executes the irreversible disabling of the remote or automatic driving control. The irreversible disabling of the driving control can be realized by burning a circuit used for the remote or automatic driving control. Possible methods for burning the circuit include using a fuse or shorting it with solder. In addition, the irreversible disabling of the driving control can be realized by deleting an app for the remote or automatic driving control from the software installed in the vehicle, or by rewriting the software installed in the vehicle.

[0047] The irreversible operation control can be disabled by being triggered when the vehicle reaches a predetermined position in the process. The predetermined position is, for example, a position at which a process ends in a factory, a position immediately before shipment, or a position at which a process ends where remote or automatic operation is no longer possible. The predetermined position may be acquired by an information processing device or by the vehicle.

[0048] The irreversible operation control can be disabled by being triggered by a predetermined operation by the worker. The predetermined operation is, for example, operating the turn signal, or when the worker is photographed by an imaging device, the worker takes a predetermined action, for example, a predetermined posture. In this way, the predetermined operation of the worker may be acquired by an information processing device or by the vehicle.

[0049] The irreversible driving control may be disabled by referring to the production management information and being triggered by confirming that the driving control is not necessary. The production management information is information on which vehicle is where at what time. The information processing device may refer to the production management information and transmit a disabling instruction from the transmission unit 104.

[0050] The irreversible disablement of the driving control may be triggered by receiving a remote or automatic disable instruction for the driving control, for example, the transmitting unit 104 of the information processing device transmits the disable instruction.

[0051] The irreversible driving control may be disabled by being triggered when the vehicle completes a predetermined power supply from the power supply device. The imaging device may record the time when the imaging device is connected to the power supply device and notify the information processing device that the predetermined power supply has been completed according to the power supply time. Alternatively, the vehicle may monitor the SOC (State Of Charge) and detect that the predetermined power supply has been completed.

[0052] Disabling of irreversible driving controls may be triggered when a worker completes wrapping the vehicle, which is the application of a protective sticker before delivery.

[0053] After the operation control is disabled, the disablement is confirmed using diagnosis communication. In this way, the disablement can be confirmed using an existing communication standard. If the disablement has not been completed, the disablement request unit 105 again performs communication for the disablement.

[0054] In addition to confirming the disabling of the driving control using the diagnosis communication, the disabling of the driving control may be confirmed by a person visually. For example, after irreversible disabling of the driving control is executed, the vehicle may execute a predetermined operation. The predetermined operation may be turning on the hazard warning lights, sounding the horn, operating the wipers, moving the wheels left and right, or displaying the completion on a monitor installed outside the vehicle.

[0055] Once the worker has confirmed that the vehicle is functioning as specified, they can then enter the vehicle to retrieve the dongle or begin driving to their next destination.

[0056] In this way, by using existing technology, it is possible to provide a vehicle remote control system that ensures security by disabling the remote or automatic vehicle control function while performing remote or automatic vehicle control, thereby enabling the construction of an inexpensive and safe system.

[0057] (Description of vehicle manufacturing method according to embodiment) 3 is a flowchart of the method for manufacturing a vehicle according to the embodiment. The method for manufacturing a vehicle according to the embodiment will be described with reference to FIG.

[0058] The manufacturing method of a vehicle according to the embodiment uses a vehicle control system 100. First, the vehicle 101 is remotely or automatically controlled (step S301). After the vehicle is assembled in a vehicle factory, the vehicle is remotely or automatically driven and controlled during inspection in response to a request from outside the vehicle 101 via the communication terminal 102. To this end, the transmission unit 104 transmits vehicle 101 control instruction values ​​to the ECU 103 via the communication terminal 102 by CAN communication. Then, the ECU 103 receives the control instruction values. Driving control is realized by the ECU 103, and the vehicle runs by remote or automatic control.

[0059] Next, remote or automatic driving control is disabled (step S302). Before shipment, irreversible remote driving control of the vehicle is disabled by a request from outside the vehicle via the communication terminal. Therefore, when remote or automatic vehicle control is no longer necessary, the disable request unit 105 transmits a disable request to the ECU 103 by diagnosis communication via the communication terminal 102. Then, the ECU 103 receives the disable request. Finally, the ECU 103 transitions to a state in which it disables reception of control instruction values ​​from the transmission unit 104. This ensures security.

[0060] In this way, a vehicle manufacturing method can be provided that ensures security by disabling the remote or automatic vehicle control function while performing remote or automatic vehicle control. Also, vehicles can be manufactured by controlling the vehicle in an automatic driving mode before shipment.

[0061] (Description of the system in the first embodiment) 4 is a conceptual diagram showing the configuration of a system 50 in the first embodiment. The system 50 includes one or more vehicles 400 as moving objects, a server 200, and one or more external sensors 300.

[0062] In this disclosure, a "mobile body" refers to an object that can move, such as a vehicle or an electric vertical take-off and landing aircraft (a so-called flying car). The vehicle may be a vehicle that runs on wheels or a vehicle that runs on caterpillar tracks, such as a passenger car, a truck, a bus, a two-wheeled vehicle, a four-wheeled vehicle, a tank, a construction vehicle, etc. The vehicle includes an electric vehicle (BEV: Battery Electric Vehicle), a gasoline-powered vehicle, a hybrid vehicle, and a fuel cell vehicle. When the mobile body is something other than a vehicle, the expressions "vehicle" and "car" in this disclosure can be appropriately replaced with "mobile body", and the expression "running" can be appropriately replaced with "movement".

[0063] The vehicle 400 is configured to be capable of traveling by unmanned driving. "Unmanned driving" means driving without the driving operation of the passenger. Driving operation means at least one of the operations of "running", "turning" and "stopping" of the vehicle 400. Unmanned driving is realized by automatic or manual remote control using a device located outside the vehicle 400, or by autonomous control of the vehicle 400. The vehicle 400 traveling by unmanned driving may have a passenger who does not perform driving operation on board. The passenger who does not perform driving operation includes, for example, a person who simply sits in the seat of the vehicle 400, or a person who performs work other than driving operation, such as assembly, inspection, and operation of switches, while riding on the vehicle 400. Note that driving by a passenger who performs driving operation is sometimes called "manned driving".

[0064] In this specification, "remote control" includes "full remote control" in which all of the operations of vehicle 400 are completely determined from outside vehicle 400, and "partial remote control" in which some of the operations of vehicle 400 are determined from outside vehicle 400. In addition, "autonomous control" includes "full autonomous control" in which vehicle 400 autonomously controls its own operations without receiving any information from devices external to vehicle 400, and "partial autonomous control" in which vehicle 400 autonomously controls its own operations using information received from devices external to vehicle 400.

[0065] In this embodiment, the system 50 is used in a factory FC that manufactures a vehicle 400. The reference coordinate system of the factory FC is a global coordinate system GC. That is, any position in the factory FC is expressed by X, Y, and Z coordinates in the global coordinate system GC. The factory FC includes a first location PL1 and a second location PL2. The first location PL1 and the second location PL2 are connected by a road TR along which the vehicle 400 can travel. In the factory FC, a plurality of external sensors 300 are installed along the road TR. The position of each external sensor 300 in the factory FC is adjusted in advance. The vehicle 400 moves from the first location PL1 to the second location PL2 through the road TR by unmanned driving.

[0066] 5 is a block diagram showing the configuration of the system 50. The vehicle 400 includes a vehicle control device 410 for controlling each part of the vehicle 400, an actuator group 420 including one or more actuators that are driven under the control of the vehicle control device 410, and a communication device 430 for communicating with an external device such as the server 200 by wireless communication. The actuator group 420 includes an actuator of a drive device for accelerating the vehicle 400, an actuator of a steering device for changing the traveling direction of the vehicle 400, and an actuator of a braking device for decelerating the vehicle 400.

[0067] The vehicle control device 410 is configured by a computer including a processor 411, a memory 412, an input / output interface 413, and an internal bus 414. The processor 411, the memory 412, and the input / output interface 413 are connected via the internal bus 414 to enable bidirectional communication. The input / output interface 413 is connected to an actuator group 420 and a communication device 430. The processor 411 executes a program PG1 stored in the memory 412 to realize various functions including a function as a vehicle control unit 415.

[0068] The vehicle control unit 415 controls the actuator group 420 to make the vehicle 400 run. The vehicle control unit 415 controls the actuator group 420 using the running control signal received from the server 200 to make the vehicle 400 run. The running control signal is a control signal for making the vehicle 400 run. In this embodiment, the running control signal includes the acceleration and steering angle of the vehicle 400 as parameters. In other embodiments, the running control signal may include the speed of the vehicle 400 as a parameter instead of or in addition to the acceleration of the vehicle 400.

[0069] The server 200 is configured by a computer including a processor 201, a memory 202, an input / output interface 203, and an internal bus 204. The processor 201, the memory 202, and the input / output interface 203 are connected via the internal bus 204 to enable bidirectional communication. A communication device 205 for communicating with various devices outside the server 200 is connected to the input / output interface 203. The communication device 205 can communicate with the vehicle 400 by wireless communication, and can communicate with each external sensor 300 by wired communication or wireless communication. The processor 201 executes a program PG2 stored in the memory 202 to realize various functions including the function as the remote control unit 210.

[0070] The remote control unit 210 acquires the detection results from the sensors, generates a driving control signal for controlling the actuator group 420 of the vehicle 400 using the detection result, and transmits the driving control signal to the vehicle 400, thereby causing the vehicle 400 to drive by remote control. The remote control unit 210 may generate and output not only the driving control signal, but also a control signal for controlling, for example, various auxiliary devices provided in the vehicle 400 and actuators for operating various equipment such as wipers, power windows, and lamps. In other words, the remote control unit 210 may operate such various equipment and various auxiliary devices by remote control.

[0071] The external sensor 300 is a sensor located outside the vehicle 400. In this embodiment, the external sensor 300 is a sensor that captures the vehicle 400 from outside the vehicle 400. The external sensor 300 includes a communication device (not shown) and can communicate with other devices such as the server 200 by wired communication or wireless communication.

[0072] Specifically, the external sensor 300 is configured by a camera. The camera as the external sensor 300 captures an image including the vehicle 400, and outputs the captured image as a detection result.

[0073] Fig. 6 is a flowchart showing a processing procedure for driving control of the vehicle 400 in the first embodiment. In the processing procedure in Fig. 6, the processor 201 of the server 200 functions as the remote control unit 210 by executing the program PG2. Also, the processor 411 of the vehicle 400 functions as the vehicle control unit 415 by executing the program PG1.

[0074] In step S1, the processor 201 of the server 200 acquires vehicle position information of the vehicle 400 using the detection result output from the external sensor 300. The vehicle position information is position information that is the basis for generating a driving control signal. In this embodiment, the vehicle position information includes the position and orientation of the vehicle 400 in the global coordinate system GC of the factory FC. Specifically, in step S1, the processor 201 acquires the vehicle position information using a captured image acquired from a camera, which is the external sensor 300.

[0075] In detail, in step S1, the processor 201, for example, detects the outer shape of the vehicle 400 from the captured image, calculates the coordinates of the positioning point of the vehicle 400 in the coordinate system of the captured image, i.e., the local coordinate system, and converts the calculated coordinates into coordinates in the global coordinate system GC, thereby acquiring the position of the vehicle 400. The outer shape of the vehicle 400 included in the captured image can be detected, for example, by inputting the captured image into a detection model DM utilizing artificial intelligence. The detection model DM is prepared, for example, inside or outside the system 50, and is stored in advance in the memory 202 of the server 200. As the detection model DM, for example, a trained machine learning model trained to realize either semantic segmentation or instance segmentation can be mentioned. As this machine learning model, for example, a convolutional neural network (hereinafter, CNN) trained by supervised learning using a training dataset can be used. The training dataset has, for example, a plurality of training images including the vehicle 400, and a label indicating whether each area in the training image is an area indicating the vehicle 400 or an area indicating something other than the vehicle 400. During CNN learning, it is preferable to update the parameters of the CNN by backpropagation (error backpropagation method) so as to reduce the error between the output result of the detection model DM and the label. In addition, the processor 201 can acquire the orientation of the vehicle 400 by estimating based on the orientation of the movement vector of the vehicle 400 calculated from the position change of the feature points of the vehicle 400 between frames of the captured image using, for example, an optical flow method.

[0076] In step S2, the processor 201 of the server 200 determines a target position to which the vehicle 400 should next head. In this embodiment, the target position is represented by X, Y, and Z coordinates in the global coordinate system GC. A reference route RR, which is a route along which the vehicle 400 should travel, is stored in advance in the memory 202 of the server 200. The route is represented by nodes indicating the departure point, nodes indicating passing points, nodes indicating the destination, and links connecting the nodes. The processor 201 uses the vehicle position information and the reference route RR to determine a target position to which the vehicle 400 should next head. The processor 201 determines a target position on the reference route RR that is ahead of the current location of the vehicle 400.

[0077] In step S3, the processor 201 of the server 200 generates a driving control signal for driving the vehicle 400 toward the determined target position. The processor 201 calculates the driving speed of the vehicle 400 from the transition of the position of the vehicle 400, and compares the calculated driving speed with the target speed. When the driving speed is lower than the target speed as a whole, the processor 201 determines the acceleration so that the vehicle 400 accelerates, and when the driving speed is higher than the target speed, the processor 201 determines the acceleration so that the vehicle 400 decelerates. In addition, when the vehicle 400 is located on the reference route RR, the processor 201 determines the steering angle and acceleration so that the vehicle 400 does not deviate from the reference route RR, and when the vehicle 400 is not located on the reference route RR, in other words, when the vehicle 400 deviates from the reference route RR, the processor 201 determines the steering angle and acceleration so that the vehicle 400 returns to the reference route RR.

[0078] In step S4, the processor 201 of the server 200 transmits the generated driving control signal to the vehicle 400. The processor 201 repeats, at a predetermined cycle, obtaining the position of the vehicle 400, determining the target position, generating the driving control signal, and transmitting the driving control signal.

[0079] In step S5, the processor 411 of the vehicle 400 receives a driving control signal transmitted from the server 200. In step S6, the processor 411 of the vehicle 400 controls the actuator group 420 using the received driving control signal, thereby causing the vehicle 400 to drive at the acceleration and steering angle represented in the driving control signal. The processor 411 repeats receiving the driving control signal and controlling the actuator group 420 at a predetermined cycle. According to the system 50 in this embodiment, the vehicle 400 can be driven by remote control, and the vehicle 400 can be moved without using transportation equipment such as a crane or a conveyor.

[0080] (Description of the system in the second embodiment) 7 is an explanatory diagram showing a schematic configuration of a system 50v in the second embodiment. In this embodiment, the system 50v is different from the first embodiment in that it does not include a server 200. In addition, the vehicle 400v in this embodiment can run by autonomous control of the vehicle 400v. The other configurations are the same as those in the first embodiment unless otherwise described.

[0081] In this embodiment, the processor 411v of the vehicle control device 410v executes the program PG1 stored in the memory 412v to function as the vehicle control unit 415v. The vehicle control unit 415v acquires output results from the sensors, generates a driving control signal using the output results, and outputs the generated driving control signal to operate the actuator group 420, thereby making it possible to drive the vehicle 400v by autonomous control. In this embodiment, in addition to the program PG1, the memory 412v stores a detection model DM and a reference route RR in advance.

[0082] Fig. 8 is a flowchart showing a processing procedure of driving control of a vehicle 400v in the second embodiment. In the processing procedure of Fig. 8, a processor 411v of the vehicle 400v functions as a vehicle control unit 415v by executing a program PG1.

[0083] In step S101, the processor 411v of the vehicle control device 410v acquires vehicle position information using the detection result output from the camera, which is the external sensor 300. In step S102, the processor 411v determines a target position to which the vehicle 400v should next head. In step S103, the processor 411v generates a driving control signal for driving the vehicle 400v toward the determined target position. In step S104, the processor 411v controls the actuator group 420 using the generated driving control signal to drive the vehicle 400v according to the parameters represented in the driving control signal. The processor 411v repeats the acquisition of vehicle position information, the determination of the target position, the generation of the driving control signal, and the control of the actuators at a predetermined cycle. According to the system 50v in this embodiment, the vehicle 400v can be driven by the autonomous control of the vehicle 400v without the server 200 remotely controlling the vehicle 400v.

[0084] (YY: other embodiments) (YY1) In each of the above embodiments, the external sensor 300 is a camera. In contrast, the external sensor 300 does not have to be a camera, and may be, for example, a LiDAR (Light Detection and Ranging). In this case, the detection result output by the external sensor 300 may be three-dimensional point cloud data representing the vehicle 400. In this case, the server 200 and the vehicle 400 may acquire vehicle position information by template matching using the three-dimensional point cloud data as the detection result and reference point cloud data prepared in advance.

[0085] (YY2) In the above-described first embodiment, the processes from obtaining vehicle position information to generating a driving control signal are executed by the server 200. In contrast, at least a part of the processes from obtaining vehicle position information to generating a driving control signal may be executed by the vehicle 400. For example, the following forms (1) to (3) may be used.

[0086] (1) The server 200 may acquire vehicle position information, determine a target position to which the vehicle 400 should next head, and generate a route from the current location of the vehicle 400 represented in the acquired vehicle position information to the target position. The server 200 may generate a route to a target position between the current location and the destination, or may generate a route to the destination. The server 200 may transmit the generated route to the vehicle 400. The vehicle 400 may generate a driving control signal so that the vehicle 400 drives on the route received from the server 200, and control the actuator group 420 using the generated driving control signal.

[0087] (2) Server 200 may acquire vehicle position information and transmit the acquired vehicle position information to vehicle 400. Vehicle 400 may determine a target position to which vehicle 400 should next head, generate a route from the current location of vehicle 400 represented in the received vehicle position information to the target position, generate a driving control signal so that vehicle 400 travels on the generated route, and control actuator group 420 using the generated driving control signal.

[0088] (3) In the above-mentioned (1) and (2) modes, the vehicle 400 may be equipped with an internal sensor, and a detection result output from the internal sensor may be used for at least one of generating a route and generating a driving control signal. The internal sensor is a sensor equipped in the vehicle 400. The internal sensor may include, for example, a sensor for detecting a motion state of the vehicle 400, a sensor for detecting an operating state of each part of the vehicle 400, and a sensor for detecting an environment around the vehicle 400. Specifically, the internal sensor may include, for example, a camera, a LiDAR, a millimeter wave radar, an ultrasonic sensor, a GPS sensor, an acceleration sensor, a gyro sensor, and the like. For example, in the above-mentioned (1) mode, the server 200 may acquire a detection result of the internal sensor, and may reflect the detection result of the internal sensor on the route when generating the route. In the above-mentioned (1) mode, the vehicle 400 may acquire a detection result of the internal sensor, and may reflect the detection result of the internal sensor on the driving control signal when generating the driving control signal. In the above-mentioned (2) mode, the vehicle 400 may acquire a detection result of the internal sensor, and may reflect the detection result of the internal sensor on the route when generating the route. In the above embodiment (2), the vehicle 400 may acquire the detection result of the internal sensor, and may reflect the detection result of the internal sensor in the driving control signal when generating the driving control signal.

[0089] (YY3) In the above second embodiment, an internal sensor may be mounted on the vehicle 400v, and a detection result output from the internal sensor may be used for at least one of generating a route and generating a driving control signal. For example, the vehicle 400v may acquire the detection result of the internal sensor, and when generating a route, may reflect the detection result of the internal sensor in the route. The vehicle 400v may acquire the detection result of the internal sensor, and when generating a driving control signal, may reflect the detection result of the internal sensor in the driving control signal.

[0090] (YY4) In the second embodiment, the vehicle 400v acquires vehicle position information using the detection result of the external sensor 300. In contrast, the vehicle 400v is equipped with an internal sensor, and the vehicle 400v acquires vehicle position information using the detection result of the internal sensor, determines a target position to which the vehicle 400v should next head, generates a route from the current location of the vehicle 400v represented in the acquired vehicle position information to the target position, generates a travel control signal for traveling the generated route, and controls the actuator group 420 using the generated travel control signal. In this case, the vehicle 400v can travel without using any of the detection results of the external sensor 300. The vehicle 400v may acquire a target arrival time or traffic congestion information from outside the vehicle 400v and reflect the target arrival time or traffic congestion information in at least one of the route and the travel control signal. In addition, all of the functional configurations of the system 50v may be provided in the vehicle 400v. That is, the processing realized by the system 50v in the present disclosure may be realized by the vehicle 400v alone.

[0091] (YY5) In the above first embodiment, the server 200 automatically generates a driving control signal to be transmitted to the vehicle 400. In contrast, the server 200 may generate a driving control signal to be transmitted to the vehicle 400 in accordance with the operation of an external operator located outside the vehicle 400. For example, the external operator may operate a control device including a display for displaying an image output from the external sensor 300, a steering wheel for remotely controlling the vehicle 400, an accelerator pedal, a brake pedal, and a communication device for communicating with the server 200 by wired communication or wireless communication, and the server 200 may generate a driving control signal in accordance with the operation applied to the control device.

[0092] (YY6) In each of the above embodiments, the vehicle 400 may have a configuration capable of moving by unmanned driving, and may be in the form of a platform having the configuration described below, for example. Specifically, the vehicle 400 may have at least a vehicle control device 410 and an actuator group 420 in order to perform the three functions of "running", "turning" and "stopping" by unmanned driving. When the vehicle 400 acquires information from the outside for unmanned driving, the vehicle 400 may further have a communication device 130. That is, the vehicle 400 capable of moving by unmanned driving may not have at least a part of interior parts such as a driver's seat and a dashboard, may not have at least a part of exterior parts such as a bumper and a fender, and may not have a body shell. In this case, the remaining parts such as a body shell may be attached to the vehicle 400 before the vehicle 400 is shipped from the factory FC, or the remaining parts such as a body shell may be attached to the vehicle 400 after the vehicle 400 is shipped from the factory FC in a state in which the remaining parts such as the body shell are not attached to the vehicle 400. Each part may be attached from any direction such as the upper side, lower side, front side, rear side, right side, or left side of the vehicle 400, and may be attached from the same direction or from different directions. Note that the position of the platform shape may be determined in the same manner as the vehicle 400 in the first embodiment.

[0093] (YY7) The vehicle 400 may be manufactured by combining a plurality of modules. A module means a unit composed of a plurality of parts grouped according to the location or function of the vehicle 400. For example, the platform of the vehicle 400 may be manufactured by combining a front module that constitutes the front part of the platform, a central module that constitutes the central part of the platform, and a rear module that constitutes the rear part of the platform. The number of modules that constitute the platform is not limited to three, and may be two or less or four or more. In addition to or instead of the parts that constitute the platform, parts that constitute parts of the vehicle 400 that are different from the platform may be modularized. The various modules may include any exterior parts such as a bumper or a grille, or any interior parts such as a seat or a console. In addition, not limited to the vehicle 400, any type of moving body may be manufactured by combining a plurality of modules. Such a module may be manufactured, for example, by joining a plurality of parts by welding or a fastener, or may be manufactured by integrally molding at least a part of the parts that constitute the module as one part by casting. The molding method for integrally molding a single component, particularly a relatively large component, is also called gigacast or megacast. For example, the front module, the center module, and the rear module may be manufactured using gigacast.

[0094] (YY8) Transporting the vehicle 400 by using the traveling of the vehicle 400 through unmanned driving is also called "self-propelled transport". Also, a configuration for realizing the self-propelled transport is also called a "vehicle remote control autonomous traveling transport system". Also, a production method for producing the vehicle 400 by using the self-propelled transport is also called "self-propelled production". In the self-propelled production, for example, at the factory FC where the vehicle 400 is manufactured, at least a part of the transportation of the vehicle 400 is realized by the self-propelled transport.

[0095] (YY9) In each of the above embodiments, some or all of the functions and processes implemented by software may be implemented by hardware. Also, some or all of the functions and processes implemented by hardware may be implemented by software. As hardware for implementing the various functions in each of the above embodiments, various circuits such as integrated circuits and discrete circuits may be used.

[0096] In addition, a part or all of the processes in the ECU 103 and the information processing device described above can be realized as a computer program. Such a program can be stored using various types of non-transitory computer-readable media and supplied to the computer. The non-transitory computer-readable medium includes various types of tangible recording media. Examples of the non-transitory computer-readable medium include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / Ws, and semiconductor memories (e.g., mask ROMs, PROMs (Programmable ROMs), EPROMs (Erasable PROMs), flash ROMs, and RAMs (Random Access Memory)). The program may also be supplied to the computer by various types of temporary computer-readable media. Examples of the temporary computer-readable medium include electric signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via wired communication paths such as electric wires and optical fibers, or wireless communication paths.

[0097] The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit and scope of the present invention. [Explanation of symbols]

[0098] 100 vehicle control system, 101 vehicle, 102 communication terminal, 103 ECU, 104 transmission unit, 105 invalidation request unit, 50 system, 200 server, 201 processor, 202 memory, 203 input / output interface, 204 internal bus, 205 communication device, 210 remote control unit, 300 external sensor, 400 vehicle, 410 vehicle control device, 411 processor, 412 memory, 413 input / output interface, 414 internal bus, 415 vehicle control unit, 420 actuator group, 430 communication device, 50v system, 400v vehicle, 410v vehicle control device, 411v processor, 412v memory, 415v vehicle control unit

Claims

1. A vehicle equipped with a communication terminal having a communication function; An ECU (Electronic Control Unit) mounted on the vehicle, which executes driving control of the vehicle using communication via the communication terminal; a transmission unit that transmits a control instruction value used for controlling driving of the vehicle to the ECU via the communication terminal from outside the vehicle; a disable request unit that requests the ECU to irreversibly disable driving control of the vehicle from outside the vehicle via the communication terminal, When the invalidation request unit requests invalidation after the execution of the operation control, the invalidation of the operation control is irreversibly executed; The control instruction value is communicated using one-to-multiple transmission and reception communication, The vehicle control system communicates the invalidation of the driving control using one-to-one transmission and reception communication.

2. The vehicle control system according to claim 1 , wherein after the disablement of the driving control is executed, the disablement is confirmed using diagnosis communication.

3. The vehicle control system according to claim 1 , wherein the vehicle control system is subjected to operational control during inspection at a vehicle factory and is disabled before shipment.

4. The vehicle control system according to claim 1 , wherein the communication terminal is a dongle or a data communication module.

5. The vehicle control system according to claim 1 , wherein the communication terminal is collected by an operator after the driving control is disabled.

6. The disabling of the operational control is Burning the circuitry of the ECU, or Delete the application that performs the communication function stored in the ECU, or The vehicle control system according to claim 1 , wherein the vehicle control system is executed by rewriting software that performs the communication function and is stored in the ECU.

7. The disabling of the operational control is When it is detected that the vehicle has reached a predetermined position, or When an operator performs a specified operation, or When production management information is referenced and it is confirmed that no operational control is required, or If a deactivation instruction is received, or When the vehicle has completed a predetermined power supply by the power supply device, or The vehicle control system of claim 1 , wherein the system is executed when the vehicle completes a lap.

8. the vehicle control system performs driving control based on information from an imaging device installed in a vehicle factory; The vehicle control system according to claim 1 , wherein the driving control is disabled based on information about the worker's actions captured by the imaging device.

9. The vehicle control system according to claim 1 , wherein the vehicle performs a predetermined operation after the irreversible override of the driving control is performed.

10. The predetermined operation is The hazard warning lights are on, or Horn honking, or Wiper operation, or Move the wheel left or right, or 10. The vehicle control system according to claim 9, wherein the display is displayed on a monitor installed outside the vehicle.

11. controlling the operation of the vehicle in response to a request from outside the vehicle via a communication terminal during inspection at a vehicle factory; A vehicle manufacturing method for irreversibly disabling a driving control of a vehicle when the disabling is requested from outside the vehicle via the communication terminal after the driving control is executed and before the vehicle is shipped, comprising: The operation control is communicated using one-to-multiple transmission and reception communication, The method of manufacturing a vehicle, wherein the override of the driving control is communicated using one-to-one send-receive communication.

12. Controlling the operation of the vehicle in response to a request from outside the vehicle via a communication terminal; A program for causing an ECU (Electronic Control Unit) mounted on a vehicle to execute irreversible disabling of driving control of the vehicle when disabling is requested from outside the vehicle via the communication terminal after the driving control is executed, The operation control is communicated using one-to-multiple transmission and reception communication, The program, wherein the disabling of the operational control is communicated using one-to-one transmission and reception communication.

13. a transmission unit that transmits a control instruction value used for controlling the operation of the vehicle to an ECU via a communication terminal from outside the vehicle; a disable request unit that requests the ECU to irreversibly disable driving control of the vehicle from outside the vehicle via the communication terminal, An information processing device that executes irreversible invalidation of the operation control when invalidation is requested from the invalidation request unit after the operation control is executed, The control instruction value is communicated using one-to-multiple transmission and reception communication, The invalidation of the operational control is performed by the information processing device using one-to-one communication.

Images