Operation management apparatus, operation management method, and computer program

Abstract

To enable a service to be continued in each service vehicle as much as possible while ensuring the safety of a user of each service vehicle when a cyber attack is launched against a business operator developing a mobility service.SOLUTION: An operation management apparatus 200 for managing the operation of a plurality of vehicles 100 capable of autonomous traveling is provided with a communication unit 210 configured to be able to communicate with the vehicles 100, and a processing unit 230. The processing unit 230 detects the presence of an abnormal vehicle exhibiting abnormal behavior among the plurality of vehicles 100. When the presence of the abnormal vehicle is detected, if an abnormal communication generation signal indicating abnormal communication different from normal communication has been received from the abnormal vehicle, the processing unit transmits a stop signal for instructing all vehicles 100 performing operation management to stop, and, if the abnormal communication generation signal has not been received from the abnormal vehicle, transmits a stop signal only to the abnormal vehicle.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a traffic management device, a traffic management method, and a computer program. [Background technology]

[0002] Patent Document 1 discloses a conventional vehicle operation system that manages the operation of autonomous taxis, which is configured to cut off communication lines between the hacked autonomous taxi and the outside world in response to detecting that the autonomous taxi has been hacked. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2023-1493 A Summary of the Invention [Problem to be solved by the invention]

[0004] It is expected that mobility services that use multiple autonomous service vehicles to provide transportation services, delivery services, and sales services will become widespread in the future. In the event of a cyberattack being launched against a mobility service provider, it is necessary to ensure the safety of users of each service vehicle while continuing to provide services as much as possible in each service vehicle.

[0005] The present invention has been made with attention to such problems, and aims to enable each service vehicle to continue providing services as much as possible while ensuring the safety of users of each service vehicle in the event of a cyber attack being launched against an operator providing mobility services. [Means for solving the problem]

[0006] In order to solve the above problems, a traffic management device according to an aspect of the present invention, which manages the traffic of a plurality of vehicles capable of autonomous driving, includes a communication unit configured to be able to communicate with the vehicles, and a processing unit. The processing unit is configured to detect the presence of an abnormal vehicle exhibiting abnormal behavior from among the plurality of vehicles, and when the presence of the abnormal vehicle is detected, to transmit a stop signal ordering all vehicles being managed for traffic to stop when an abnormal communication occurrence signal is received from the abnormal vehicle notifying that there has been abnormal communication different from normal communication with the abnormal vehicle, and to transmit a stop signal only to the abnormal vehicle when an abnormal communication occurrence signal is not received from the abnormal vehicle.

[0007] In addition, a computer program according to one aspect of the present invention for a traffic management device that communicates with a plurality of autonomously driving vehicles and manages the operation of the vehicles causes the traffic management device to detect the presence of an abnormal vehicle exhibiting abnormal behavior among the plurality of vehicles, and when the presence of an abnormal vehicle is detected, causes the traffic management device to send a stop signal ordering all vehicles under traffic management to stop if an abnormal communication occurrence signal is received from the abnormal vehicle notifying the abnormal vehicle that abnormal communication different from normal communication has occurred, and sends a stop signal only to the abnormal vehicle if an abnormal communication occurrence signal is not received from the abnormal vehicle.

[0008] In addition, an operation management method according to one aspect of the present invention, using an operation management device that communicates with a plurality of autonomously driven vehicles to manage the operation of the vehicles, detects the presence of an abnormal vehicle exhibiting abnormal behavior among the plurality of vehicles, and when an abnormal vehicle is detected, if an abnormal communication occurrence signal is received from the abnormal vehicle notifying the abnormal vehicle that abnormal communication different from normal communication has occurred, a stop signal is transmitted to all vehicles being operated under operation management, ordering them to stop, and if an abnormal communication occurrence signal is not received from the abnormal vehicle, the stop signal is transmitted only to the abnormal vehicle. Effect of the Invention

[0009] According to these aspects of the present invention, in the event of a cyber attack being launched against an operator providing mobility services, it is possible to continue services as much as possible in each service vehicle while ensuring the safety of users of each service vehicle. [Brief description of the drawings]

[0010] [Figure 1] 1 is a schematic configuration diagram of a vehicle operation system according to a first embodiment of the present invention. [Diagram 2] 5 is a flowchart illustrating an example of processing content executed in the user terminal, the service vehicle, and the server according to the first embodiment of the present invention when a user makes a vehicle dispatch request. [Diagram 3] 1 is a flowchart illustrating an example of processing executed by a service vehicle and a server according to a first embodiment of the present invention when the service vehicle detects a trace of a cyber-attack. [Figure 4] 5 is a flowchart illustrating an example of processing executed by the server according to the first embodiment of the present invention when a service vehicle exhibits abnormal behavior. [Diagram 5] 10 is a flowchart illustrating an example of processing content executed by a server according to a second embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, like components are designated by like reference numerals.

[0012] (First embodiment) FIG. 1 is a schematic configuration diagram of a vehicle operation system 1 according to a first embodiment of the present invention.

[0013] The vehicle operation system 1 includes a plurality of service vehicles 100 and a server 200 that manages the operation of each service vehicle 100. Since each service vehicle 100 has the same configuration, FIG. 1 shows the configuration of only one service vehicle 100.

[0014] The service vehicle 100 is an autonomous vehicle capable of autonomous driving for providing mobility services such as transportation services, delivery services, and merchandise sales services. In this embodiment, the service vehicle 100 provides a transportation service as a mobility service, and transports a user 2 who uses the transportation service to a destination specified by the user 2. The user 2 can request the server 200 to dispatch the service vehicle 100 by operating a user terminal 3 such as a smartphone or tablet computer to start a dispatch app and inputting predetermined user information required for dispatching on the dispatch app. The user terminal 3 is configured to be able to communicate with the server 200 via a network configured of optical communication lines or the like.

[0015] The service vehicle 100 according to this embodiment includes an HMI (Human Machine Interface) 110, a communication device 120, a surrounding sensor 130, a positioning sensor 135, and a control device 140. The HMI 110, the communication device 120, the surrounding sensor 130, the positioning sensor 135, and the control device 140 are each communicatively connected via an in-vehicle network 150 that complies with a standard such as a controller area network or in-vehicle Ethernet.

[0016] The HMI 110 is an interface for exchanging information with a user 2 who uses the service vehicle 100. The HMI 110 according to this embodiment includes a display 111 as an information display screen arranged in a position where the user 2 who uses the service vehicle 100 can see it, and a touch panel 112 as an operating device for the user 2 to perform input operations and response operations. The HMI 100 displays output information (e.g., character information and image information) output from the control device 140 on the display 111, and outputs input information input via the touch panel 112 to the control device 140.

[0017] The HMI 110 may be a user terminal 3 carried by the user 2, instead of being mounted on the service vehicle 100 as described above. In this case, information may be exchanged between the user terminal 3 and the service vehicle 100 by short-distance wireless communication, or information may be exchanged indirectly with the service vehicle 100 via the server 200 by communicating between the user terminal 3 and the server 200.

[0018] The communication device 120 has a communication interface circuit for connecting to a network configured by optical communication lines or the like, and is configured to connect the service vehicle 100 to the server 200 via the network so as to enable mutual communication with the server 200.

[0019] The surrounding sensor 130 is a sensor for generating surrounding data that indicates the situation around the service vehicle 100. In this embodiment, the surrounding sensor 130 includes one or more external cameras 131 for capturing images of the surroundings of the service vehicle 100. The external camera 131 captures images of the surroundings of the service vehicle 100 at a predetermined frame rate (for example, 10 [Hz] to 40 [Hz]) and generates images showing the surroundings of the service vehicle 100. Every time the external camera 131 generates an image, it outputs the generated image to the control device 140 as surrounding data.

[0020] Instead of or in addition to the external camera 131, a distance measuring sensor that measures the distance to a target such as a vehicle or a pedestrian present around the service vehicle 100 may be provided as the surrounding sensor 130. Examples of the distance measuring sensor include a LiDAR (Light Detection And Ranging) that irradiates a laser beam and measures the distance based on the reflected light, and a millimeter wave radar sensor that irradiates a radio wave and measures the distance based on the reflected wave.

[0021] The positioning sensor 135 generates position data indicating the current position of the service vehicle 100 , and outputs the generated position data of the service vehicle 100 to the control device 140 .

[0022] The control device 140 includes an in-vehicle communication interface 141 , a storage unit 142 , and a processing unit 143 .

[0023] The in-vehicle communication interface 141 has a communication interface circuit for connecting the control device 140 to the in-vehicle network 150, and is configured to enable communication between the control device 140 and other devices such as the HMI 110 connected to the in-vehicle network 150.

[0024] The storage unit 142 has a storage medium such as a hard disk drive (HDD), a solid state drive (SSD), or a semiconductor memory, and stores various computer programs, data, and the like used for processing by the processing unit 143.

[0025] The processing unit 143 has one or more CPUs (Central Processing Units) and their peripheral circuits, and is, for example, a processor, which executes various computer programs stored in the storage unit to centrally control the overall operation of the service vehicle 100. An example of the processing executed by the processing unit 143, and therefore the control device 140, will be described later with reference to FIG. 2 etc.

[0026] The server 200 includes a communication unit 210, a storage unit 220, and a processing unit 230, and performs operation management of each service vehicle 100.

[0027] The communication unit 210 has a communication interface circuit for connecting the server 200 to a network (not shown) composed of optical communication lines, etc., and is configured to connect the server 200 to the service vehicle 100 and the user terminal 3 via the network so as to be able to communicate with the service vehicle 100 and the user terminal 3.

[0028] The storage unit 220 has a storage medium such as an HDD, an SSD, or a semiconductor memory, and stores various computer programs and data used in the processing by the processing unit 230.

[0029] The processing unit 230 is, for example, a processor, and has one or more CPUs and their peripheral circuits, and executes various computer programs stored in the storage unit 220 to centrally control the overall operation of the server 200. An example of the processing executed by the processing unit 230, and therefore the server 200, will be described later with reference to FIG. 2 etc.

[0030] Here, when providing a mobility service by operating a plurality of service vehicles 100 as in this embodiment, the operator needs to enable each service vehicle 100 to communicate with the server 200 via a network in order to perform operation management of each service vehicle 100. Therefore, there is a risk that various cyber attacks will be launched against the service vehicle 100 via the network for the purpose of, for example, remotely operating the service vehicle 100 to steal, stealing data acquired by sensors of the service vehicle 100 (for example, images generated by the external camera 131, etc.), or damaging the image of the operator.

[0031] As a measure to be taken when a cyber attack is launched against the service vehicle 100, for example, in order to ensure the safety of the user of the cyber-attacked service vehicle 100, it is possible to stop the provision of mobility services by the cyber-attacked service vehicle 100. Therefore, for example, if the service vehicle 100 provides a transportation service, it is possible to take measures such as stopping the service vehicle 100 to have the user disembark and having another service vehicle 100 transport the user to the destination.

[0032] When a cyber attack is launched against one service vehicle 100 operated by the operator, there is a possibility that the cyber attack will be launched against the other service vehicles 100 as well. Therefore, when a cyber attack is launched against one service vehicle 100 operated by the operator, it is possible to take measures to stop the provision of mobility services by all service vehicles 100 operated by the operator. However, since cyber attacks often end in failure, if the provision of mobility services by all service vehicles 100 is stopped every time a cyber attack is detected, the provision of mobility services will be stopped frequently. As a result, the convenience of users is impaired, the quality of the service is deteriorated, and there is a risk that users' evaluation of the operator will be lowered.

[0033] Therefore, in this embodiment, it is determined whether there is a possibility that a cyber-attack has been launched against each service vehicle 100 operated by the operator, and if a service vehicle 100 that may be the subject of such a cyber-attack, i.e., a service vehicle 100 that shows traces of a cyber-attack, exhibits abnormal behavior, it is determined that the abnormal behavior may be caused by a cyber-attack, and in order to ensure the safety of users of each service vehicle 100, the provision of mobility services by all service vehicles 100 operated by the operator is suspended.

[0034] On the other hand, if a service vehicle 100 that shows no signs of a cyber-attack exhibits abnormal behavior, it will be determined that the cause of the abnormal behavior is a vehicle malfunction, such as a failure of an onboard sensor, and only the provision of mobility services by the service vehicle 100 exhibiting abnormal behavior will be suspended.

[0035] FIG. 2 is a flowchart illustrating an example of the process executed by the user terminal 3, the service vehicle 100, and the server 200 when the user 2 makes a vehicle dispatch request.

[0036] In this embodiment, each service vehicle 100 periodically transmits its own vehicle position data to the server 200. That is, in this embodiment, the server 200 is capable of grasping the current position of each service vehicle 100.

[0037] In step S1, the user 2 operates the user terminal 3 to start the vehicle dispatch application, and inputs predetermined user information required for vehicle dispatch on the vehicle dispatch application to request dispatch of the service vehicle 100. Examples of the user information include the user's personal information, desired vehicle dispatch location, desired vehicle dispatch time, number of service users, etc. When a vehicle dispatch request is made via the vehicle dispatch application, the user terminal 3 transmits a vehicle dispatch request signal including the user information to the server 200.

[0038] In step S2, when the server 200 receives the dispatch request signal, it determines a service vehicle 100 to be used for picking up from among the service vehicles 100 based on the desired dispatch location included in the signal and the position data of each service vehicle 100 periodically received from each service vehicle 100, and transmits a pick-up signal including predetermined pick-up information required for picking up the user to the service vehicle 100. Examples of the pick-up information include personal information of the user, information regarding the desired dispatch location and the driving route to the destination (hereinafter referred to as "driving route information").

[0039] In step S3, when the control device 140 of the service vehicle 100 receives the pick-up signal, the control device 140 starts automatic driving based on the driving route information included in the signal, and starts providing the transportation service.

[0040] 3 is a flowchart illustrating an example of the process executed by the service vehicle 100 and the server 200 when the service vehicle 100 detects a trace of a cyber-attack. The service vehicle 100 executes this routine in a predetermined calculation cycle.

[0041] In step S11, the control device 140 of the service vehicle 100 judges whether or not there is a possibility of a cyber attack (whether or not there is an abnormal communication). The service vehicle 100 according to this embodiment usually communicates with limited communication destinations such as the server 200 (hereinafter referred to as "normal communication destinations"). Therefore, when the control device 140 of the service vehicle 100 detects communication from a communication destination with an IP address different from the normal communication destination, for example, it can judge that there has been an abnormal communication and judge that there is a possibility of a cyber attack. Note that the judgment of the possibility of a cyber attack (the presence or absence of traces of a cyber attack) is not limited to the above method, and may be performed by various known methods. If there is a possibility of a cyber attack, the control device 140 of the service vehicle 100 proceeds to the processing of step S12. On the other hand, if there is no possibility of a cyber attack, the service vehicle 100 ends this processing.

[0042] In step S12, the control device 140 of the service vehicle 100 transmits an abnormal communication occurrence signal including vehicle identification information of the vehicle (e.g., vehicle number, etc.) to the server 200 to inform the server 200 that a cyber-attack may have been carried out on the vehicle.

[0043] In step S13, when the server 200 receives the abnormal communication occurrence signal, it identifies the service vehicle 100 that is the source of the signal from among the service vehicles 100 that it manages operation of, based on the vehicle identification information included in the signal, that is, the service vehicle 100 that may have been subjected to a cyber-attack, and sets the abnormal communication occurrence flag of the identified service vehicle 100 to 1. The initial value of the abnormal communication occurrence flag of each service vehicle 100 is set to 0, and after being set to 1, it is reset to 0 by, for example, an administrator of the server 200.

[0044] 4 is a flowchart illustrating an example of the process executed by the server 200 when the service vehicle 100 exhibits abnormal behavior. The server 200 executes this routine in a switching manner at a predetermined calculation cycle.

[0045] In step S21, the server 200 determines whether or not there is a service vehicle 100 exhibiting abnormal behavior, i.e., an abnormal vehicle, among the service vehicles 100. For example, the server 200 determines whether or not there is a service vehicle 100 that has deviated from the travel route (i.e., a service vehicle 100 that is not heading toward the desired dispatch location or destination) based on the travel route information of each service vehicle 100 and the position data of each service vehicle 100, and can determine that an abnormal vehicle exists if there is a service vehicle 100 that has deviated from the travel route. If there is an abnormal vehicle, the server 200 proceeds to the process of step S22. On the other hand, if there is no abnormal vehicle, the server 200 ends the current process.

[0046] In step S22, the server 200 identifies a service vehicle 100 exhibiting abnormal behavior, and determines whether the abnormal communication occurrence flag of the service vehicle 100 is set to 1. If the abnormal communication occurrence flag of the service vehicle 100 exhibiting abnormal behavior is set to 1, the server 200 determines that the abnormal behavior may be caused by a cyber attack, and proceeds to processing in step S23. On the other hand, if the abnormal communication occurrence flag of the service vehicle 100 exhibiting abnormal behavior is set to 0, the server 200 determines that the abnormal behavior is likely not caused by a cyber attack, but by a vehicle malfunction such as a malfunction of an onboard sensor, and proceeds to processing in step S24.

[0047] In step S23, the server 200 transmits a stop signal to all service vehicles 100 for which operation management is performed. The stop signal is a signal for making the service vehicles 100 that receive the signal make an emergency stop at a nearby safe place.

[0048] In step S24, the server 200 transmits a stop signal only to the service vehicle 100 exhibiting abnormal behavior.

[0049] The server 200 (operation management device) according to the present embodiment described above is a server that performs operation management of a plurality of service vehicles 100 capable of autonomous driving, and includes a communication unit 210 configured to be able to communicate with the service vehicles 100, and a processing unit 230. The processing unit 230 detects the presence of an abnormal vehicle exhibiting abnormal behavior among the plurality of service vehicles 100, and when detecting the presence of an abnormal vehicle, if an abnormal communication occurrence signal is received from the abnormal vehicle notifying that there has been abnormal communication different from normal communication with the abnormal vehicle, the processing unit 230 is configured to transmit a stop signal ordering all service vehicles 100 that are undergoing operation management to stop, and if an abnormal communication occurrence signal is not received from the abnormal vehicle, the processing unit 230 is configured to transmit a stop signal only to the abnormal vehicle.

[0050] Thus, according to this embodiment, when the presence of an abnormal vehicle is detected, the provision of mobility services by all service vehicles 100 that are managed by the operation is temporarily stopped only if an abnormal communication occurrence signal has been received from the abnormal vehicle, and if an abnormal communication occurrence signal has not been received from the abnormal vehicle, the provision of mobility services by other service vehicles 100 that are managed by the operation is continued. Therefore, even if a cyber attack is launched against a service vehicle 100 operated by a business operator that develops mobility services, the safety of users of each service vehicle 100 is ensured, and services can be continued as much as possible in each service vehicle 100.

[0051] Furthermore, the processing unit 230 of the server 200 according to this embodiment is configured to determine that the service vehicle 100 is an abnormal vehicle when it is detected that the service vehicle 100 has deviated from a preset driving route based on the position data of the service vehicle 100 received from the service vehicle 100. This allows the server 200 to objectively determine whether the service vehicle 100 is abnormal in an easy manner.

[0052] Second embodiment Next, a second embodiment of the present invention will be described. This embodiment differs from the first embodiment in that a response to a cyber attack is implemented according to the number of service vehicles 100 for which the abnormal communication occurrence flag is set to 1. The following description will focus on this difference.

[0053] In the first embodiment described above, a response to a cyber-attack (sending a stop signal) was implemented when a service vehicle 100 exhibiting abnormal behavior was detected, but in this embodiment, in addition to this response, a response to a cyber-attack is also implemented when the number of service vehicles 100 with the abnormal communication occurrence flag set to 1 exceeds a predetermined number.

[0054] 5 is a flowchart illustrating an example of the process executed by the server 200 according to this embodiment. The server 200 switches between executing this routine at a predetermined calculation cycle.

[0055] In step S31, the server 200 determines whether the number N of service vehicles 100 for which the abnormal communication occurrence flag is set to 1 is less than a predetermined first threshold value N1. If the number N of service vehicles 100 for which the abnormal communication occurrence flag is set to 1 is less than the first threshold value N1, the server 200 ends this processing. On the other hand, if the number N of service vehicles 100 for which the abnormal communication occurrence flag is set to 1 is equal to or greater than the first threshold value N1, the server 200 proceeds to processing in step S32.

[0056] In step S32, the server 200 determines whether the number N of service vehicles 100 for which the abnormal communication occurrence flag is set to 1 is less than a predetermined second threshold N2. The second threshold is set to a value greater than the first threshold N1. If the number N of service vehicles 100 for which the abnormal communication occurrence flag is set to 1 is less than the second threshold N2, the server 200 proceeds to processing in step S33. On the other hand, if the number N of service vehicles 100 for which the abnormal communication occurrence flag is set to 1 is equal to or greater than the second threshold N2, the server 200 proceeds to processing in step S34.

[0057] In step S33, the server 200 transmits a slow-down signal to all service vehicles 100 for which operation management is performed. The slow-down signal is a signal for causing the service vehicles 100 that receive the signal to drive at a slow speed.

[0058] In step S34, the server 200 transmits a stop signal to all service vehicles 100 for which operation management is being performed.

[0059] The processing unit 230 of the server 200 in this embodiment described above is configured to send a slow down signal to all service vehicles 100 under operational management instructing them to drive slowly if the number N of service vehicles 100 that have transmitted an abnormal communication occurrence signal is equal to or greater than a first threshold value N1 and is less than a second threshold value N2 that is greater than the first threshold value N1, and to send a stop signal to all service vehicles 100 under operational management if the number N of service vehicles 100 that have transmitted an abnormal communication occurrence signal is equal to or greater than the second threshold value N2.

[0060] As a result, when the number N of the service vehicles 100 that have transmitted the abnormal communication occurrence signal becomes equal to or greater than the first threshold value N1, increasing the possibility that a cyberattack is being conducted against the operator, it is possible to command all the service vehicles 100 that are under operational management to drive slowly even if the presence of an abnormal vehicle is not detected. When the number N of the service vehicles 100 that have transmitted the abnormal communication occurrence signal becomes equal to or greater than the second threshold value N2, increasing the possibility that a cyberattack is being conducted against the operator, it is possible to command all the service vehicles 100 that are under operational management to make an emergency stop even if the presence of an abnormal vehicle is not detected. Therefore, the safety of the users of each service vehicle 100 can be further ensured.

[0061] Although the embodiments of the present invention have been described above, the above-mentioned embodiments merely show some of the application examples of the present invention, and it is not intended that the technical scope of the present invention be limited to the specific configurations of the above-mentioned embodiments.

[0062] For example, in each of the above embodiments, the driving route was generated by the server 200 and transmitted to each service vehicle 100, but the driving route may be generated by the service vehicle 100 based on the desired dispatch location and destination and transmitted to the server 200.

[0063] In addition, in the above embodiment, the computer programs executed in the service vehicle 100 and the server 200 may be provided in a form recorded on a computer-readable portable recording medium, such as a semiconductor memory, a magnetic recording medium, or an optical recording medium. [Explanation of symbols]

[0064] 100 Service vehicles (vehicles) 200 Server (operation management device) 210 Communications Department 230 Processing section

Claims

1. A traffic management device that manages traffic of a plurality of autonomous vehicles, A communication unit configured to be able to communicate with the vehicle; A processing section; Equipped with The processing unit includes: Detecting the presence of an abnormal vehicle exhibiting abnormal behavior from among the plurality of vehicles; When the presence of the abnormal vehicle is detected, When an abnormal communication occurrence signal is received from the abnormal vehicle, notifying the abnormal vehicle that an abnormal communication different from normal communication has occurred, a stop signal is transmitted to all of the vehicles under operation management to command them to stop; When the abnormal communication occurrence signal is not received from the abnormal vehicle, the stop signal is transmitted only to the abnormal vehicle. Operation control device.

2. The processing unit includes: If the number of the vehicles that have transmitted the abnormal communication occurrence signal is equal to or greater than a first threshold value and is less than a second threshold value that is greater than the first threshold value, a slow-down signal is transmitted to all of the vehicles that are under traffic management to instruct them to drive at a slow speed; If the number of the vehicles that have transmitted the abnormal communication occurrence signal is equal to or greater than the second threshold, the stop signal is transmitted to all of the vehicles that are being managed by the traffic control system. The operation management device according to claim 1.

3. The processing unit includes: and determining that the vehicle is the abnormal vehicle when it is detected that the vehicle deviates from a preset driving route based on the position data of the vehicle received from the vehicle. The operation management device according to claim 1 or 2.

4. A computer program for a traffic management device that communicates with a plurality of autonomous vehicles to manage the traffic of the vehicles, The traffic management device includes: Detecting the presence of an abnormal vehicle exhibiting abnormal behavior from among the plurality of vehicles; When the presence of the abnormal vehicle is detected, When an abnormal communication occurrence signal is received from the abnormal vehicle, notifying the abnormal vehicle that an abnormal communication different from normal communication has occurred, a stop signal is transmitted to all of the vehicles under operation management to command them to stop; When the abnormal communication occurrence signal has not been received from the abnormal vehicle, the stop signal is transmitted only to the abnormal vehicle. Computer program.

5. A traffic management method by a traffic management device that communicates with a plurality of autonomous vehicles and manages the traffic of the vehicles, Detecting the presence of an abnormal vehicle exhibiting abnormal behavior from among the plurality of vehicles; When the presence of the abnormal vehicle is detected, When an abnormal communication occurrence signal is received from the abnormal vehicle, notifying the abnormal vehicle that an abnormal communication different from normal communication has occurred, a stop signal is transmitted to all of the vehicles under operation management to command them to stop; When the abnormal communication occurrence signal has not been received from the abnormal vehicle, the stop signal is transmitted only to the abnormal vehicle. Operation management method.

Images