Vehicle control device

Abstract

To properly switch to manual driving.SOLUTION: A vehicle control device is connected between an automatic driving system and a vehicle platform which performs automatic driving in accordance with a command from the automatic driving system. The vehicle control device includes: a memory in which a program including a prescribed API defined for each signal is stored; and a processor which controls the vehicle platform according to a command from the automatic driving system by executing a program. The vehicle control device has a manual driving mode and an automatic driving mode as vehicle modes. The vehicle platform can receive a manual driving operation in the manual driving mode and can receive a driving command from the automatic driving system in the automatic driving mode. The processor prohibits transition from the automatic driving mode to the manual driving mode on condition that the vehicle platform is not stopped.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present disclosure relates to a vehicle control device, and more particularly to a vehicle control device connected between an autonomous driving system and a vehicle platform that performs autonomous driving in accordance with commands from the autonomous driving system. [Background technology]

[0002] There is a system in which a vehicle and an information processing device work together to perform autonomous driving (for example, see Patent Document 1). In this system, the information processing device automatically generates control information using autonomous driving control software and transmits it to the vehicle. The vehicle performs autonomous driving based on the received control information. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-177807 A Summary of the Invention [Problem to be solved by the invention]

[0004] In a vehicle capable of automatic driving in the system of Patent Document 1, it is unclear whether the driver can respond appropriately when switching to manual driving while traveling. For this reason, there is a problem of how to appropriately switch to manual driving.

[0005] This disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a vehicle control device that can appropriately switch to manual driving. [Means for solving the problem]

[0006] The vehicle control device according to the present disclosure is a vehicle control device connected between an autonomous driving system and a vehicle platform that performs autonomous driving according to a command from the autonomous driving system, and includes a memory in which a program including a predetermined API defined for each signal is stored, and a processor that controls the vehicle platform according to a command from the autonomous driving system by executing the program. The vehicle control device has a manual driving mode and an autonomous driving mode as vehicle modes. The vehicle platform is capable of accepting manual driving operations in the manual driving mode, and is capable of accepting driving commands from the autonomous driving system in the autonomous driving mode. The processor prohibits transition from the autonomous driving mode to the manual driving mode on the condition that the vehicle platform is not stopped.

[0007] According to this configuration, it is possible to prevent the transition from the automatic driving mode to the manual driving mode in a state where it is difficult for the driver to respond appropriately, such as when the vehicle platform is not stopped. Therefore, it is possible to transition from the automatic driving mode to the manual driving mode in a state where it is easy for the driver to respond appropriately. As a result, it is possible to provide a vehicle control device that can appropriately switch to manual driving.

[0008] The processor may transition from the automatic driving mode to the manual driving mode when the emergency stop switch is operated, provided that the vehicle platform is immobilized.

[0009] According to this configuration, when the vehicle platform is reliably immobilized in the automatic driving mode in response to the operation of the emergency stop switch, the automatic driving mode can be switched to the manual driving mode, so that the automatic driving mode can be more appropriately switched to the manual driving mode.

[0010] When the processor transitions to the manual driving mode, the processor may allow the vehicle platform to transition to the autonomous driving mode on the condition that the vehicle platform has been started from an unstarted state.

[0011] According to this configuration, when the autonomous driving mode is switched to the manual driving mode, the vehicle platform is once put into a non-activated state before the autonomous driving mode can be switched back to the autonomous driving mode. As a result, the vehicle platform is prevented from switching back to the autonomous driving mode from the manual driving mode in an abnormal state in which it cannot be activated again.

[0012] The vehicle platform may further be capable of autonomous driving in accordance with commands from a remote driving system, and the processor may control the vehicle platform in accordance with commands from the remote driving system by executing a program, and if commands from the remote driving system cannot be accepted, the processor may transition from the autonomous driving mode to the manual driving mode on the condition that the vehicle platform is immobilized.

[0013] According to this configuration, if the vehicle platform is no longer able to be driven automatically according to the commands of the remote driving system, the vehicle can be switched to manual driving mode when the vehicle platform is in a state where it cannot move reliably in the automatic driving mode. As a result, even if the vehicle is being driven remotely, the vehicle can be appropriately switched to manual driving.

[0014] The processor may be configured to transition from the automatic driving mode to the manual driving mode if the emergency stop switch is operated when commands from the remote driving system cannot be accepted and the vehicle platform is placed in a stationary state.

[0015] According to this configuration, when the vehicle platform is reliably immobilized in the automatic driving mode in response to the operation of the emergency stop switch during remote driving, the vehicle can be transitioned to the manual driving mode. As a result, even when the vehicle is remotely driven, the vehicle can be more appropriately switched to the manual driving mode. [Brief description of the drawings]

[0016] [Figure 1]1 is a diagram showing an overview of a vehicle according to an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram showing the configuration of ADS, VCIB and VP in more detail. [Diagram 3] FIG. 4 is a state transition diagram for explaining vehicle modes in this embodiment. [Figure 4] FIG. 2 is a diagram showing the transmission directions of various signals or commands related to transitions between modes. [Diagram 5] FIG. 13 is a state transition diagram of the integrated control manager when the emergency stop switch is operated. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] 1 is a diagram showing an overview of a vehicle according to an embodiment of this disclosure. The vehicle 1 includes an autonomous driving kit (ADK) 10 and a vehicle platform (VP) 20. The ADK 10 is configured to be attachable to the VP 20 (to be mounted on the vehicle 1). The ADK 10 and the VP 20 are configured to be able to communicate with each other via a vehicle control interface (VCIB 40 described later).

[0018] The VP20 can perform automatic driving according to control requests from the ADK10. Although the ADK10 is shown in a position separate from the VP20 in FIG. 1, the ADK10 is actually attached to the rooftop of the VP20 or the like. The ADK10 can also be removed from the VP20. When the ADK10 is removed, the VP20 performs driving control in manual mode (driving control according to user operation).

[0019] The ADK10 includes an autonomous driving system (ADS) 11 for autonomously driving the vehicle 1. The ADS11 creates, for example, a driving plan for the vehicle 1. The ADS11 outputs various control requests for driving the vehicle 1 according to the driving plan to the VP20 according to an API (Application Program Interface) defined for each control request. The ADS11 also receives various signals indicating the vehicle state (state of the VP20) from the VP20 according to an API defined for each signal. Then, the ADS11 reflects the vehicle state in the driving plan.

[0020] The VP20 includes a base vehicle 30 and a vehicle control interface box (VCIB) 40. The base vehicle 30 executes various vehicle controls in accordance with control requests from the ADK10 (ADS11). The base vehicle 30 includes various systems and sensors for controlling the base vehicle 30. More specifically, the base vehicle 30 includes an integrated control manager 31, a brake system 32, a steering system 33, a powertrain system 34, an active safety system 35, a body system 36, wheel speed sensors 51, 52, a pinion angle sensor 53, a camera 54, and radar sensors 55, 56.

[0021] The integrated control manager 31 includes a processor and a memory, and controls the above-mentioned systems related to the operation of the vehicle 1 (the brake system 32, the steering system 33, the powertrain system 34, the active safety system 35, and the body system 36) in an integrated manner.

[0022] The brake system 32 is configured to control the braking devices provided on each wheel of the base vehicle 30. Wheel speed sensors 51, 52 are connected to the brake system 32. The wheel speed sensors 51, 52 detect the rotation speeds of the front and rear wheels of the base vehicle 30, respectively, and output the detected rotation speeds to the brake system 32. The brake system 32 outputs the rotation speeds of each wheel to the VCIB 40 as one piece of information included in the vehicle state. The brake system 32 also generates a braking command for the braking device according to a predetermined control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31. The brake system 32 controls the braking device using the generated braking command.

[0023] The steering system 33 is configured to be able to control the steering angle of the steering wheels of the vehicle 1 using a steering device. A pinion angle sensor 53 is connected to the steering system 33. The pinion angle sensor 53 detects a rotation angle (pinion angle) of a pinion gear connected to a rotating shaft of an actuator, and outputs the detected rotation angle to the steering system 33. The steering system 33 outputs the pinion angle to the VCIB 40 as one piece of information included in the vehicle state. The steering system 33 also generates a steering command for the steering device according to a predetermined control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31. The steering system 33 controls the steering device using the generated steering command.

[0024] The powertrain system 34 controls an electric parking brake (EPB) system 341 provided on at least one of the multiple wheels, a parking lock (P-Lock) system 342 provided on the transmission of the vehicle 1, and a propulsion system 343 including a shift device configured to select a shift range.

[0025] The active safety system 35 detects obstacles (pedestrians, bicycles, parked vehicles, utility poles, etc.) in front or behind the vehicle 1 using the camera 54 and radar sensors 55, 56. The active safety system 35 determines whether there is a possibility that the vehicle 1 will collide with the obstacle based on the distance between the vehicle 1 and the obstacle and the moving direction of the vehicle 1. If the active safety system 35 determines that there is a possibility of a collision, it outputs a braking command to the brake system 32 via the integrated control manager 31 so as to increase the braking force.

[0026] The body system 36 is configured to control parts such as a turn signal, a horn, and windshield wipers in accordance with the driving state or environment of the vehicle 1. The body system 36 controls each of the above parts in accordance with a predetermined control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31.

[0027] The VCIB 40 is configured to be able to communicate with the ADS 11 via a CAN (Controller Area Network) or the like. The VCIB 40 executes a predetermined API defined for each signal to receive various control requests from the ADS 11 and output the vehicle state to the ADS 11. When the VCIB 40 receives a control request from the ADK 10, it outputs a control command corresponding to the control request to a system corresponding to the control command via the integrated control manager 31. The VCIB 40 also acquires various pieces of information about the base vehicle 30 from various systems via the integrated control manager 31, and outputs the state of the base vehicle 30 to the ADS 11 as the vehicle state.

[0028] The base vehicle 30 further includes an emergency stop switch 39. The emergency stop switch 39 is provided so as to be operable by the driver of the vehicle 1, and when operated, outputs a signal indicating that the switch has been operated to the integrated control manager 31.

[0029] Fig. 2 is a diagram showing in more detail the configurations of the ADS 11, the VCIB 40, and the VP 20. As shown in Fig. 2, the ADS 11 includes a computer 111, an HMI (Human Machine Interface) 112, a recognition sensor 113, an attitude sensor 114, and a sensor cleaner 115.

[0030] During autonomous driving of the vehicle 1, the computer 111 acquires the environment of the vehicle 1, as well as the attitude, behavior, and position of the vehicle 1 using various sensors, and also acquires the vehicle state from the VP 20 via the VCIB 40 to set the next operation of the vehicle 1 (acceleration, deceleration, turning, etc.). The computer 111 outputs various commands to the VCIB 40 to realize the next operation. The computer 111 includes communication modules 111A and 111B. Each of the communication modules 111A and 111B is configured to be able to communicate with the VCIB 40.

[0031] The HMI 112 presents information to the user and accepts user operations during autonomous driving, during driving that requires user operation, and during a transition between autonomous driving and driving that requires user operation.

[0032] The recognition sensor 113 is a sensor for recognizing the environment of the vehicle 1. The recognition sensor 113 includes, for example, at least one of a LIDAR (Laser Imaging Detection and Ranging), a millimeter wave radar, and a camera.

[0033] The attitude sensor 114 is a sensor for detecting the attitude, behavior, and position of the vehicle 1. The attitude sensor 114 includes, for example, an IMU (Inertial Measurement Unit) and a GPS (Global Positioning System). The sensor cleaner 115 is configured to remove dirt adhering to the above-mentioned various sensors (camera lenses, laser light irradiation parts, etc.) while the vehicle 1 is traveling, using a cleaning liquid, a wiper, etc.

[0034] The VCIB40 includes a main VCIB41 and a sub VCIB42. Although neither is shown, each of the VCIBs 41 and 42 includes a processor such as a central processing unit (CPU) and a memory such as a read only memory (ROM) and a random access memory (RAM). The memory stores a program executable by the processor. The VCIB41 and the communication module 111A are connected to each other so as to be able to communicate with each other. The VCIB42 and the communication module 111B are connected to each other so as to be able to communicate with each other. Furthermore, the VCIB41 and the VCIB42 are connected to each other so as to be able to communicate with each other.

[0035] Each of the VCIBs 41 and 42 relays control requests and vehicle information between the ADS11 and the VP20. More specifically, the VCIB 41 uses an API to generate a control command from a control request from the ADS11. The VCIB 41 then outputs the generated control command to a corresponding system among the multiple systems included in the VP20. The VCIB 41 also uses an API to generate information indicating a vehicle state from vehicle information from each system of the VP20. The VCIB 41 outputs the generated information indicating the vehicle state to the ADS11. The same is true for the VCIB 42.

[0036] The EPB system 341 controls the EPB in accordance with a control request output from the ADS 11 via the VCIB 41. The EPB is provided separately from a braking device (such as a disc brake system), and fixes the wheels by the operation of an actuator.

[0037] The P-Lock system 342 controls the P-Lock device in accordance with a control request output from the ADS 11 via the VCIB 41. For example, the P-Lock system 342 activates the P-Lock device when the control request includes a control request to set the shift range to a parking range (P range), and releases the operation of the P-Lock device when the control request includes a control request to set the shift range to a range other than the P range. The P-Lock device fixes the rotation of the output shaft of the transmission and locks the wheels.

[0038] The propulsion system 343 switches the shift range of the shift device and controls the driving force from the driving source (motor generator, engine, etc.) in accordance with a control request output from the ADS 11 via the VCIB 41.

[0039] In the vehicle 1, for example, when an autonomous driving mode described later is selected by a request from the ADK 10, the vehicle 1 performs autonomous driving. As described above, the ADS 11 first creates a driving plan during autonomous driving. Examples of the driving plan include a plan to continue driving straight, a plan to turn left / right at a predetermined intersection on a predetermined driving route, and a plan to change the driving lane. The ADS 11 calculates control physical quantities (acceleration, deceleration, tire turning angle, etc.) required for the vehicle 1 to operate according to the created driving plan. The ADS 11 divides the physical quantities for each execution cycle of the API. The ADS 11 outputs a control request representing the divided physical quantities to the VCIB 40 using the API. Furthermore, the ADS 11 acquires the vehicle state (the actual moving direction of the vehicle 1, the state of immobilization of the vehicle, etc.) from the VP 20, and recreates a driving plan that reflects the acquired vehicle state. In this way, the ADS 11 enables the vehicle 1 to be driven autonomously.

[0040] 3 is a state transition diagram showing the transition of the vehicle mode. In this example, the vehicle 1 has a manual mode and an autonomous mode as the vehicle modes.

[0041] The manual mode is the same as that of a non-autonomous vehicle, that is, a mode in which the VP20 is under the control of the driver. In the manual mode, the ADK10 cannot basically control the VP20, except for some requests.

[0042] The autonomous driving mode is a mode in which the VP 20 is under the control of the ADK 10 and autonomous driving of the vehicle 1 is possible. In the autonomous driving mode, the ADK 10 is able to communicate with the VP 20 after the VCIB 40 has successfully authenticated the ADK 10. In the autonomous driving mode, the VP 20 is under the control of the ADK 10 as a result of the ADK 10 issuing a "Request for Autonomy" as a vehicle mode request (described later).

[0043] In the manual mode, the power mode status is "Wake" or "Driving Mode". The vehicle mode state is "Manual Mode". In the autonomous driving mode, the power mode status is "Driving Mode". The vehicle mode state is "Automatic Driving Mode".

[0044] 4 is a diagram showing the transmission direction of various signals or commands (requests) related to the transition between modes. During the mode transition, the VCIB 40 receives a power mode request (Power mode command) and a vehicle mode request (Vehicle Mode Command) from the ADK 10 (ADS 11). The VCIB 40 also outputs a power mode status signal, a vehicle mode status signal, and a readiness for autonomization signal (Readiness for autonomization) to the ADK 10.

[0045] The power mode request is a request for controlling the power mode of the VP20. The power mode status signal is a signal indicating the current power mode status of the VP20. In this vehicle 1, the power mode of the VP20 can be controlled from the ADS11 by transmitting a power mode request from the ADS11 to the VCIB40 according to a predetermined API. The VP20 according to this embodiment has two power modes, a wake mode and a driving mode.

[0046] The wake mode is a state in which the VCIB 40 is activated by power supplied from the vehicle's auxiliary battery. In the wake mode, there is no power supply from the main battery, and no ECUs other than the VCIB 40 are activated, except for some of the body-related ECUs of the body system 36 (for example, a verification ECU that performs smart key verification, a body ECU that controls door lock / unlock, etc.).

[0047] The driving mode is a state in which the power supply of the VP 20 is on (a state in which the vehicle power supply is on). In the driving mode, power is supplied from the main battery, the VCIB 40 and each system of the base vehicle 30 are started, and the VP 20 is ready to run.

[0048] The power mode request can take any of the values ​​0, 2, and 6 as an argument. The value 0 is set when the power mode of VP20 is not requested from ADS11. When VCIB40 receives a power mode request with the value 0 set, VP20 maintains the power mode at that time. The value 2 is set when the wake mode is requested from ADS11. That is, the power mode request with the value 2 requests the startup of VCIB40. When VCIB40 receives a power mode request with the value 2 set, the power mode of VP20 transitions to the wake mode, and VCIB40 is started by receiving power from the auxiliary battery. The value 6 is set when the driving mode is requested from ADS11. That is, the power mode request with the value 6 set requests the startup of VP20. When VCIB40 receives a power mode request with the value 6 set, the power mode of VP20 transitions to the driving mode, and VP20 is turned on.

[0049] In this vehicle 1, the state of the power mode of the VP 20 is notified to the ADS 11 by sending a signal indicating the state of the power mode from the VCIB 40 to the ADS 11 according to a predetermined API. The power mode state signal sent to the ADS 11 can take either value 2 or 6 as an argument. The value 2 is set when the power mode is the wake mode. The value 6 is set when the power mode is the driving mode.

[0050] In this vehicle 1, the vehicle mode of VP20 can be controlled from ADS11 by transmitting a vehicle mode request from ADS11 to VCIB40 according to a predetermined API. The vehicle mode request can take any one of values ​​0 to 2 as an argument. The value 0 is set when the vehicle mode of VP20 is not requested from ADS11. When the VCIB40 receives a vehicle mode request with the value 0 set, the vehicle mode at that time is maintained. The value 1 is set when the ADS11 requests an automatic driving mode (Request For Autonomy). That is, a vehicle mode request with the value 1 set requests a transition of the vehicle mode from the manual mode to the automatic driving mode. The value 2 is set when the ADS11 requests the manual mode (Deactivation Request). That is, a vehicle mode request with the value 2 set requests a transition of the vehicle mode from the automatic driving mode to the manual mode.

[0051] In this vehicle 1, the vehicle mode state of VP20 is notified to ADS11 by sending a signal indicating the vehicle mode state from VCIB40 to ADS11 according to a predetermined API. The vehicle mode state signal can take either value 0 or 1 as an argument. Value 0 is set when the vehicle mode is manual mode. Value 1 is set when the vehicle mode is autonomous driving mode. Note that when VP20 is started up (power mode state is wake or driving mode), the vehicle mode starts from manual mode. In other words, the initial state of the vehicle mode is set to "manual mode."

[0052] In this vehicle 1, the VCIB40 sends a signal indicating the automation readiness status of the VP20 to the ADS11 according to a specified API, thereby notifying the ADS11 of whether or not the VP20 can transition to the autonomous driving mode. The automation readiness signal can take one of the values ​​0, 1, or 3 as an argument. The value 0 is set when the autonomous driving mode is not ready (Not Ready For Autonomous Mode). The value 1 is set when the autonomous driving mode is ready (Ready For Autonomous Mode). The value 3 is set when the state has not yet been determined. The value 3 means an invalid value (Invalid).

[0053] Referring again to FIG. 3, the transitions between modes will be described in detail. Transition a indicates a transition from the manual mode to the automatic driving mode. When a first condition is satisfied in the manual mode, the vehicle mode transitions from the manual mode to the automatic driving mode. The first condition includes the following conditions (1) to (4). The first condition is satisfied when all of the following conditions (1) to (4) are satisfied. The first condition is not satisfied when any of the following conditions (1) to (4) is not satisfied.

[0054] (1) The ADK10 is authenticated by the VCIB40. (2) The power mode status signal is "Drive Mode". (3) The automation readiness signal is "Ready For Autonomous Mode". (4) The vehicle mode request is "Request For Autonomy".

[0055] Transition b indicates a transition from the autonomous driving mode to the manual mode. In the autonomous driving mode, when a second condition is satisfied that the vehicle mode request is a “request for deactivation”, the vehicle mode transitions from the autonomous driving mode to the manual mode.

[0056] Fig. 5 is a diagram showing state transitions of the integrated control manager 31 when the emergency stop switch 39 is operated. Referring to Fig. 5, normally, the state of the integrated control manager 31 transitions between an automatic operation OFF state (manual operation mode) and an automatic operation ON state (automatic operation mode) without fail-safe control (normal state) in response to an instruction from the VCIB 40.

[0057] AFSS (Emergency Stop System in case of ADK Failure) is a system that brings VP 20 to an emergency stop in the event of a failure of ADK 10. When an operation signal indicating that emergency stop switch 39 has been operated is input to integrated control manager 31 in the automatic operation OFF state and AFSS is in operation, the state of integrated control manager 31 transitions from automatic operation OFF to automatic operation ON and fail-safe control being (2) emergency stop switch control.

[0058] When automatic operation is ON and fail-safe control is not enabled, if an operation signal indicating that the emergency stop switch 39 has been operated is input to the integrated control manager 31, the state of the integrated control manager 31 transitions from a state in which automatic operation is ON and fail-safe control is not enabled to a state in which automatic operation is ON and fail-safe control is (2) emergency stop switch control.

[0059] In the state where the automatic driving is ON and the fail-safe control is (2) emergency stop switch control, if the vehicle is traveling, the integrated control manager 31 executes deceleration control, and if the vehicle is stopped or has been stopped by the deceleration control, the integrated control manager 31 executes vehicle fixation control. The deceleration control is a control for decelerating the VP20 by reducing the driving force by the propulsion system 343 or by braking by the brake system 32. The vehicle fixation control is a control for fixing the wheels of the VP20 by operating the EPB system 341 or the P-Lock system 342. When the vehicle fixation control is completed, the state of the integrated control manager 31 transitions to an automatic driving OFF state. Note that, when the emergency stop switch 39 is operated to transition to an automatic driving OFF state, transition to an automatic driving ON state while the VP20 is still activated is prohibited, and the VP20 is temporarily placed in an inactive state, and if it can be started normally without being affected by a malfunction of the ADK10 or the like, transition to an automatic driving ON state is permitted.

[0060] In this way, the processor of the integrated control manager 31 prohibits the transition from the automatic driving ON (automatic driving mode) state to the automatic driving OFF (manual driving mode) state, provided that the VP20 is not stopped (vehicle speed is greater than 0 km / h). Also, when the emergency stop switch 39 is operated, the processor of the integrated control manager 31 transitions from the automatic driving ON (automatic driving mode) state to the automatic driving OFF (manual driving mode) state, provided that the processor of the integrated control manager 31 places the VP20 in a state where it is not moving (here, the wheels of the VP20 are fixed). Also, when the state transitions to the automatic driving OFF (manual driving mode), the processor of the integrated control manager 31 permits the transition to the automatic driving ON state, provided that the VP20 is started from a state where it is not started.

[0061] A control similar to that when the emergency stop switch 39 is operated has also been conventionally executed in the RDK (Remote Driving Kit) limp-aside control from the VCIB. The RDK is a system in which an operator remotely controls the driving of the VP 20 instead of the ADK 10. The RDK limp-aside control is a control for automatically stopping the vehicle 1 appropriately when the control of the RDK is lost.

[0062] If it becomes impossible to accept commands from the RDK, a request for RDK limp-aside control is sent from the VCIB 40 to the integrated control manager 31. When a request for RDK limp-aside control from the VCIB 40 is sent to the integrated control manager 31 in a state where automatic operation is ON and fail-safe control is not enabled, the state of the integrated control manager 31 transitions from a state where automatic operation is ON and fail-safe control is not enabled to a state where automatic operation is ON and fail-safe control is (1) RDK limp-aside control.

[0063] When the automatic driving is ON and the fail-safe control is (1) RDK limp-aside control, if the vehicle is traveling, the integrated control manager 31 executes deceleration control and steering control, and if the vehicle is stopped or if stopping is completed by deceleration control and stopping control, the integrated control manager 31 executes vehicle fixation control. The deceleration control and vehicle fixation control are the same as described above. The steering control is a control that controls the steering system 33 to direct the VP 20 to an appropriate location. When the vehicle fixation control is completed, the state of the integrated control manager 31 transitions to the automatic driving OFF state.

[0064] When automatic operation is ON and the fail-safe control is (1) RDK limp-aside control, if an operation signal indicating that the emergency stop switch 39 has been operated is input to the integrated control manager 31, the state of the integrated control manager 31 transitions from a state in which automatic operation is ON and the fail-safe control is (1) RDK limp-aside control to a state in which automatic operation is ON and the fail-safe control is (2) emergency stop switch control. In a state in which automatic operation is ON and the fail-safe control is (2) emergency stop switch control, the same control as described above is executed.

[0065] In this way, when it becomes impossible to accept commands from the RDK, the processor of the integrated control manager 31 transitions from the automatic driving ON state (automatic driving mode) to the automatic driving OFF state (manual driving mode) on the condition that the VP20 is in a state of not moving (here, the wheels of the VP20 are fixed). Also, when the emergency stop switch 39 is operated when it becomes impossible to accept commands from the RDK, the processor of the integrated control manager 31 transitions from the automatic driving ON state (automatic driving mode) to the automatic driving OFF state (manual driving mode) on the condition that the VP20 is in a state of not moving (here, the wheels of the VP20 are fixed).

[0066] The above-mentioned processing by the processor of the integrated control manager 31 may be executed in cooperation with the processors of the VCIBs 41 and 42, or may be executed by another processor.

[0067] The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the disclosure is defined by the claims, not by the description of the embodiments described above, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0068] 1 Vehicle, 10 Autonomous Driving Kit (ADK), 11 Autonomous Driving System (ADS), 111 Computer, 111A, 111B Communication Module, 113 Recognition Sensor, 114 Attitude Sensor, 115 Sensor Cleaner, 20 Vehicle Platform (VP), 30 Base Vehicle, 31 Integrated Control Manager, 32, 321, 322 Brake System, 33, 331, 332 Steering System, 34 Power Train System, 341 EPB, 342 P-Lock System, 343 Propulsion System, 35 Active Safety System, 36 Body System, 39 Emergency Stop Switch, 40~42 Vehicle Control Interface Box (VCIB), 51, 52 Wheel Speed ​​Sensor, 53 Pinion Angle Sensor, 54 Camera, 55, 56 Radar Sensor.

Claims

1. A vehicle control device connected between an autonomous driving system and a vehicle platform that performs autonomous driving according to a command from the autonomous driving system, A memory in which a program including a predetermined API defined for each signal is stored; a processor that executes the program to control the vehicle platform in response to a command from the autonomous driving system; The vehicle control device has a manual driving mode and an automatic driving mode as vehicle modes, The vehicle platform includes: In the manual driving mode, a manual driving operation can be accepted, In the autonomous driving mode, a driving command from the autonomous driving system can be received, A vehicle control device, wherein the processor prohibits transition from the autonomous driving mode to the manual driving mode, provided that the vehicle platform is not stopped.

2. The vehicle control device according to claim 1 , wherein the processor transitions from the autonomous driving mode to the manual driving mode when an emergency stop switch is operated and the vehicle platform is placed in a stationary state.

3. 3. The vehicle control device according to claim 2, wherein when the vehicle has transitioned to the manual driving mode, the processor permits transition to the autonomous driving mode on condition that the vehicle platform has been started from a non-started state.

4. the vehicle platform is further capable of autonomous driving according to commands from a remote driving system; The processor, Controlling the vehicle platform in response to commands from the remote driving system by executing the program; 3. The vehicle control device according to claim 2, wherein when it becomes impossible to accept commands from the remote driving system, the vehicle control device transitions from the automatic driving mode to the manual driving mode on the condition that the vehicle platform is placed in a stationary state.

5. 5. The vehicle control device according to claim 4, wherein when the emergency stop switch is operated when commands from the remote driving system cannot be accepted, the processor transitions from the automatic driving mode to the manual driving mode on the condition that the vehicle platform is placed in a stationary state.

Images