Control device, control method, and program for vehicle

Abstract

To improve the convenience of vehicle control functions.SOLUTION: A control device for a vehicle includes: a receiving unit that receives first authorization information indicating whether a user of the vehicle has the usage authorization for a specific vehicle control function from a server; an updating unit that updates second authorization information being the second authorization information which indicates whether the user has the usage authorization for the specific vehicle control function and is stored in a storage device of the vehicle on the basis of the first authorization information; and a vehicle control unit that executes the vehicle control function on the basis of the second authorization information indicating that the user has the usage authorization. The updating unit waits to update the second authorization information until traveling of the vehicle ends when the first authorization information indicates that the user does not have the usage authorization.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to a vehicle control device, a control method, and a program. [Background technology]

[0002] In recent years, efforts to provide access to sustainable transportation systems that take into consideration vulnerable traffic participants have been gaining momentum. To achieve this, we are focusing on research and development to further improve traffic safety and convenience through research and development of driving assistance technology. A business model is known that allows a specific function of a vehicle to be executed only when a user has the authority to use it. Patent Document 1 describes making a function available in multiple vehicles based on the user's license data. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2022-140011 Summary of the Invention [Problem to be solved by the invention]

[0004] A possible configuration is one in which a server centrally manages whether a user has the authority to use a specific vehicle control function. In a configuration in which a vehicle constantly queries the server about the authority to use a specific vehicle control function, if the vehicle cannot access the server, the vehicle cannot determine whether the user has the authority to use the function, and the user cannot use the vehicle control function. In order to solve the above problem, the present application aims to achieve a technology for improving the convenience of the vehicle control function. This will ultimately contribute to the development of a sustainable transportation system. [Means for solving the problem]

[0005] According to some embodiments, a control device for a vehicle is provided, comprising: a receiving means for receiving from a server first authority information indicating whether a user of the vehicle has authority to use a specific vehicle control function; an updating means for updating second authority information indicating whether the user has authority to use the specific vehicle control function, the second authority information being stored in a storage device of the vehicle, based on the first authority information; and a vehicle control means for executing the vehicle control function based on the second authority information indicating that the user has the usage authority, wherein the updating means waits to update the second authority information until the vehicle's travel ends when the first authority information indicates that the user does not have the usage authority. Effect of the Invention

[0006] Some embodiments provide improved convenience for vehicle control functions. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a block diagram illustrating an example configuration of a vehicle according to some embodiments. [Diagram 2] FIG. 1 is a block diagram illustrating an example of the configuration of a function providing system according to some embodiments. [Diagram 3] FIG. 4 is a flow diagram illustrating an example operation of a vehicle according to some embodiments. [Figure 4] FIG. 4 is a flow diagram illustrating an example operation of a vehicle according to some embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the invention according to the claims, and not all combinations of features described in the embodiments are essential to the invention. Two or more features among the multiple features described in the embodiments may be arbitrarily combined. In addition, the same reference numbers are used for the same or similar configurations, and duplicated descriptions are omitted.

[0009] FIG. 1 is a block diagram of a control device CNT according to an embodiment of the present invention, and a schematic diagram of a vehicle V which is an application example of the control device CNT. In FIG. 1, the vehicle V is shown in a plan view and a side view. The vehicle V of this embodiment is, as an example, a four-wheeled sedan-type passenger vehicle, and may be, for example, a parallel hybrid vehicle. The vehicle V is not limited to a four-wheeled passenger vehicle, and may be a saddle-type vehicle (motorcycle, motor three-wheeler), or a large vehicle such as a truck or a bus.

[0010] The control device CNT includes a controller 1 which is an electronic circuit that executes control of the vehicle V including driving assistance of the vehicle V. The controller 1 includes a plurality of ECUs (Electronic Control Units). For example, an ECU is provided for each function of the control device CNT. Each ECU includes a processor represented by a CPU (Central Processing Unit), a storage device such as a semiconductor memory, an interface with an external device, and the like. The storage device stores a program executed by the processor, data used by the processor for processing, and the like. The interface includes an input / output interface and a communication interface. Each ECU may include a plurality of processors, a plurality of storage devices, and a plurality of interfaces. The program stored in the storage device may be stored in the storage device by being installed in the control device CNT using a storage medium such as a CD-ROM. In addition to or instead of this, the program stored in the storage device may be downloaded from an external server through wireless communication.

[0011] The controller 1 controls the drive (acceleration) of the vehicle V by controlling a power unit (power plant) 2. The power unit 2 is a traveling drive unit that outputs a driving force to rotate the drive wheels of the vehicle V, and may include an internal combustion engine, a motor, and an automatic transmission. The motor can be used as a drive source to accelerate the vehicle V, and can also be used as a generator during deceleration, etc. (regenerative braking).

[0012] In this embodiment, the controller 1 controls the output of the internal combustion engine and the motor and changes the gear of the automatic transmission in response to the driving operation of the driver detected by the operation detection sensor 2a provided on the accelerator pedal AP and the operation detection sensor 2b provided on the brake pedal BP, and the vehicle speed of the vehicle V detected by the rotation speed sensor 2c. The automatic transmission is provided with a rotation speed sensor 2c that detects the rotation speed of the output shaft of the automatic transmission as a sensor that detects the running state of the vehicle V. The vehicle speed of the vehicle V can be calculated from the detection result of the rotation speed sensor 2c.

[0013] The controller 1 controls the braking (deceleration) of the vehicle V by controlling the hydraulic device 3. The driver's braking operation on the brake pedal BP is converted into hydraulic pressure in the brake master cylinder BM and transmitted to the hydraulic device 3. The hydraulic device 3 is an actuator capable of controlling the hydraulic pressure of the hydraulic oil supplied to the brake devices 3a (e.g., disc brake devices) provided on each of the four wheels, based on the hydraulic pressure transmitted from the brake master cylinder BM.

[0014] The controller 1 can control the braking of the vehicle V by controlling the driving of an electromagnetic valve or the like provided in the hydraulic device 3. The controller 1 can also configure an electric servo brake system by controlling the distribution of the braking force by the brake device 3a and the braking force by regenerative braking of the motor provided in the power unit 2. The controller 1 may turn on the brake lamps 3b during braking.

[0015] The controller 1 controls the steering of the vehicle V by controlling the electric power steering device 4. The electric power steering device 4 includes a mechanism for steering the front wheels in response to the driver's driving operation (steering operation) with respect to the steering wheel ST. The electric power steering device 4 includes a drive unit 4a that exerts a driving force (sometimes referred to as steering assist torque) for assisting the steering operation or automatically steering the front wheels of the vehicle V. The drive unit 4a includes a motor as a drive source. The electric power steering device 4 also includes a steering angle sensor 4b that detects the steering angle, a torque sensor 4c that detects the steering torque borne by the driver (called steering burden torque and distinguished from steering assist torque), and the like.

[0016] The controller 1 controls an electric parking brake device 3c provided on the rear wheels of the vehicle V. The electric parking brake device 3c includes a mechanism for locking the rear wheels. The controller 1 can control the locking and unlocking of the rear wheels by the electric parking brake device 3c.

[0017] The controller 1 controls an information output device 5 that notifies the inside of the vehicle of information. The information output device 5 includes, for example, a display device 5a that notifies the driver of information by image and / or a voice output device 5b that notifies the driver of information by voice. The display device 5a includes, for example, a display device provided on an instrument panel or a display device provided on a steering wheel ST. The display device 5a may also include a head-up display. The information output device 5 may notify the occupant of information by vibration or light.

[0018] The controller 1 receives instruction inputs from a passenger (e.g., the driver) via the input device 6. The input device 6 is disposed in a position operable by the driver, and includes, for example, a switch group 6a with which the driver issues instructions to the vehicle V, and / or a turn signal lever 6b for operating a turn signal (blinker).

[0019] The controller 1 recognizes and determines the current position and course (attitude) of the vehicle V. In this embodiment, the vehicle V is provided with a gyro sensor 7a, a GNSS (Global Navigation Satellite System) sensor 7b, and a communication device 7c. The gyro sensor 7a detects the rotational motion (yaw rate) of the vehicle V. The GNSS sensor 7b detects the current position of the vehicle V. The communication device 7c wirelessly communicates with a server that provides map information and traffic information to acquire this information. In this embodiment, the controller 1 determines the course of the vehicle V based on the detection results of the gyro sensor 7a and the GNSS sensor 7b, and sequentially acquires map information related to the course from the server via the communication device 7c and stores it in a database 7d (storage device). The vehicle V may be provided with other sensors for detecting the state of the vehicle V, such as an acceleration sensor that detects the acceleration of the vehicle V.

[0020] The controller 1 executes driving assistance for the vehicle V based on the detection results of various detection units provided in the vehicle V. The vehicle V is provided with surrounding detection units 8a-8b, which are external sensors that detect the outside (surrounding conditions) of the vehicle V, and interior detection units 9a-9b, which are interior sensors that detect the conditions inside the vehicle (the conditions of the occupants (particularly the driver)). The controller 1 can grasp the surrounding conditions of the vehicle V based on the detection results of the surrounding detection units 8a-8b, and execute driving assistance in accordance with the surrounding conditions. In addition, the controller 1 can determine whether the driver is performing a predetermined operational obligation imposed on the driver when executing driving assistance based on the detection results of the interior detection units 9a-9b.

[0021] The surroundings detection unit 8a is an imaging device that captures an image in front of the vehicle V (hereinafter, may be referred to as the forward camera 8a), and is attached, for example, to the inside of the passenger compartment of the windshield at the front of the roof of the vehicle V. The controller 1 can extract the contours of targets and lane markings (white lines, etc.) on the road by analyzing the image captured by the forward camera 8a.

[0022] The surroundings detection unit 8b is a millimeter wave radar (hereinafter, sometimes referred to as radar 8b), which detects targets around the vehicle V using radio waves and detects (measures) the distance to the target and the direction (azimuth) of the target relative to the vehicle V. In the example shown in Fig. 1, five radars 8b are provided, one at the center of the front of the vehicle V, one at each of the left and right corners of the front, and one at each of the left and right corners of the rear.

[0023] The surrounding detection unit installed in the vehicle V is not limited to the above configuration, and the number of cameras and the number of radars may be changed, or a LIDAR (Light Detection and Ranging) that detects targets around the vehicle V may be installed.

[0024] The in-vehicle detection unit 9a is an imaging device that captures images of the interior of the vehicle (hereinafter, may be referred to as the in-vehicle camera 9a), and is attached, for example, to the inside of the vehicle compartment at the front part of the roof of the vehicle interior V. In the case of this embodiment, the in-vehicle camera 9a is a driver monitor camera that captures images of the driver (for example, the driver's eyes and face). The controller 1 can determine the driver's line of sight and the direction of the driver's face by analyzing the image (driver's facial image) captured by the in-vehicle camera 9a.

[0025] The in-vehicle detection unit 9b is a grip sensor that detects the driver's grip of the steering wheel ST (hereinafter, may be referred to as grip sensor 9b), and is provided, for example, on at least a part of the steering wheel ST. As the in-vehicle detection unit, the torque sensor 4c that detects the steering torque of the driver may be used.

[0026] Driving assistance for the driver of the vehicle V includes, for example, acceleration / deceleration assistance, lane keeping assistance, and lane change assistance. Acceleration / deceleration assistance is a driving assistance (ACC: Adaptive Cruise Control) in which the controller 1 automatically controls the power unit 2 and the hydraulic device 3 based on the detection results of the surroundings detection unit 8 and map information, thereby automatically controlling the acceleration / deceleration of the vehicle V within a predetermined vehicle speed. With ACC, when there is a preceding vehicle, it is also possible to accelerate or decelerate the vehicle V so as to maintain a distance from the preceding vehicle. ACC reduces the operational burden on the driver of acceleration / deceleration operations (operations of the accelerator pedal AP and the brake pedal BP).

[0027] The lane keeping assist is a driving assist system (LKAS) in which the controller 1 automatically controls the electric power steering device 4 based on the detection results of the surrounding detection unit 8 and map information to keep the vehicle V inside the lane. The LKAS reduces the driver's burden of steering (operation of the steering wheel ST) while the vehicle V is traveling straight.

[0028] The lane change assist is a driving assist (ALC: Auto Lane Changing, ALCA: Active Lane Change Assist) in which the controller 1 automatically controls the power unit 2, the hydraulic device 3, and the electric power steering device 4 based on the detection result of the surrounding detection unit 8 and map information to automatically change the driving lane of the vehicle V to an adjacent lane. ALC is lane change assist based on a system request, and ALCA is lane change assist based on an occupant request. Examples of system requests include a case where a navigation system that guides the vehicle V to a destination requests the vehicle V to change lanes, and a case where the vehicle V overtakes a preceding vehicle regardless of whether route guidance is provided. When making an occupant request, the driver instructs the vehicle to change lanes by operating an input device (e.g., the turn signal lever 6b). ALC or ACLA reduces the driver's operational burden of accelerating, decelerating, and steering the vehicle V when changing lanes.

[0029] Other examples of driving assistance control may include, for example, a collision mitigation brake that assists in avoiding a collision with an object on the road (e.g., a pedestrian, another vehicle, or an obstacle) by controlling the hydraulic device 3, an ABS function, traction control, and / or attitude control of the vehicle V.

[0030] In some embodiments, the controller 1 selectively executes one of three modes 1 to 3 having different driving assistance contents. The mode may be called a state. In the following, a case where ACC, LKAS, ALC, or ACLA is provided as driving assistance will be described, but the driving assistance contents of each of the modes 1 to 3 are not limited to ACC, LKAS, ALC, or ACLA, and may include other driving assistance contents. Also, only one of ALC and ACLA may be provided.

[0031] Mode 1 is a manual driving mode in which none of ACC, LKAS, ALC, and ACLA are executed, and is a mode based on the manual driving operation of the driver. This is the mode that is initially set when the vehicle V is started.

[0032] Mode 2 and Mode 3 are modes that are set on the condition that the occupant issues a driving assistance command in Mode 1. Mode 2 is a normal assistance mode in which ACC and LKAS can be executed. ALC and ACLA are not executed in Mode 2.

[0033] Mode 3 is an extended assistance mode in which all of ACC, LKAS, ALC, and ACLA can be executed. The extended assistance mode may also be called AHD (Advanced Highway Driving) mode. Mode 3 is a mode on the premise that the controller 1 has acquired high-precision map information including information on the road (traveling path) on which the vehicle V travels. The high-precision map information is map information having more accurate information on road information than map information (sometimes called normal map information) used for route guidance to a destination. Specifically, the high-precision map information may have at least position information within a lane. This can be used to control the position of the vehicle V in the vehicle width direction. The high-precision map information may further include information on the detailed shape of the road, such as the presence or absence of a curve, the curvature, the increase or decrease of lanes, and the gradient. The high-precision map information is prepared for each region or road section, for example, and there may be regions or road sections in which high-precision map information is not provided.

[0034] In mode 3, lane change assistance (ALC and ACLA) is performed by using this high-precision map information. By utilizing position information within the lane included in the high-precision map information and the current position of the vehicle V detected by the GNSS sensor 7b, reliable and smooth lane change assistance can be performed while recognizing other vehicles in the vicinity from the external detection results of the detection units 8a to 8b. Lane change assistance may be performed without using high-precision map information.

[0035] Both mode 2 and mode 3 are modes in which ACC and LKAS can be executed, but mode 3 is capable of executing ACC and LKAS using high-precision map information. The controller 1 can obtain road information ahead of the vehicle V from the high-precision map information and control the acceleration / deceleration and lateral position of the vehicle V, thereby providing the occupants with more reliable and smoother ACC and LKAS.

[0036] A vehicle control function such as the driving assistance function according to the above-mentioned modes 2 and 3 may be executable by a provider of the vehicle control function (e.g., a manufacturer of the vehicle V) granting a usage authority of the vehicle control function to a user of the vehicle V. The user of the vehicle V may be called an occupant of the vehicle V when the user is in the vehicle V. Also, the user of the vehicle V may be called a driver of the vehicle V when the user is driving the vehicle V. In the following description, the user of the vehicle V is simply referred to as a user. The usage authority of the vehicle control function may be granted, for example, by the user entering into a contract with the provider of the vehicle control function after starting to use the vehicle V. With reference to FIG. 2, a configuration example of a function providing system 200 for providing a vehicle control function requiring usage authority will be described.

[0037] The function providing system 200 may include, for example, a vehicle V, a user management server 201, a map distribution server 202, and a user device 203. In the example of FIG. 2, only one vehicle V is shown, but the function providing system 200 may include a plurality of vehicles. Similarly, the function providing system 200 may include a plurality of user devices 203. The vehicle V, the user management server 201, the map distribution server 202, and the user device 203 may be capable of communicating with each other through a network 204. The network 204 may include a local area network (LAN), a wide area network (WAN), the Internet, a cellular network, or any combination thereof. The communication between the vehicle V and the network 204 is typically wireless communication.

[0038] The user management server 201 manages information about users. For example, the user management server 201 may grant a user authority to use a vehicle control function in response to a request from the user. The request to grant the authority to use may be made by the user using a user device 203. The user device 203 is a device used by the user, and may be, for example, a personal computer, a mobile phone, a smartphone, a tablet computer, or the like. The request to grant the authority to use may be made by the user using a vehicle V.

[0039] The request for granting the usage authority may include the user's account information and the identification information of the vehicle (e.g., vehicle V) for which the vehicle control function is to be executable. The user's account information is information for the user management server 201 to uniquely identify the user. The identification information of the vehicle may be a vehicle identification number (VIN). The request for granting the usage authority may include a designation of the type of vehicle control function for which the usage authority is to be granted. The vehicle control function for which the usage authority is to be granted may be the entire AHD described above, a part of the functions therein (e.g., ALC or ALCA), another driving assistance function, or a function other than the driving assistance function.

[0040] In response to a request from a user, the user management server 201 grants the user the right to use a vehicle control function specified by the user for a vehicle (e.g., vehicle V) specified by the user. The granting of the right to use may be for a fee or free of charge. The user management server 201 may set an expiration date for the right to use. When the expiration date has passed, the right to use is cancelled. The user may be able to extend the expiration date by updating the right to use before it expires. The user management server 201 may store, for each user to be managed, the user's account information, the vehicle identification information, the vehicle control functions that the user has the right to use, and the expiration date of the right to use (if set), in association with each other.

[0041] The vehicle V (specifically, its controller 1, the same applies below) may inquire of the server whether the user has the right to use a specific vehicle control function. This inquiry may include the user's account information and the identification information of the vehicle V. In response to receiving the inquiry including the user's account information and the identification information of the vehicle V, the user management server 201 refers to the user information managed by itself and determines whether the user has the right to use associated with this information. If the user has the right to use, the user management server 201 transmits information indicating the vehicle control functions that the user has the right to use to the vehicle V. If an expiration date is set for this right to use, the user management server 201 also transmits this expiration date to the vehicle V. If the user does not have the right to use, the user management server 201 may transmit information indicating that there is no vehicle control function that the user has the right to use to the vehicle V. In this way, the vehicle V obtains from the user management server 201 the information indicating whether the user has the right to use a specific vehicle control function and the expiration date, if set. The vehicle V may store this information and use it for subsequent processing.

[0042] The vehicle V may transmit information indicating the status of the vehicle V to the user management server 201. The information indicating the status of the vehicle V may include, for example, information regarding a malfunction occurring in the vehicle V. The user management server 201 may notify the user device 203 using the information indicating the status of the vehicle V. For example, when the user management server 201 receives information from the vehicle V indicating that a malfunction has occurred in the vehicle V, the user management server 201 may notify the user device 203 of this.

[0043] The map distribution server 202 is an example of a server that provides information used by the vehicle V to execute a specific vehicle control function. The map distribution server 202 may provide map information (e.g., high-precision map information as described above) as such information. The map distribution server 202 may provide the map information to the vehicle V based at least on the fact that the user has usage authority to use the map information.

[0044] For example, in order to obtain map information from the map distribution server 202, the vehicle V may transmit information indicating that the user has the authority to use the map information to the map distribution server 202. This information may be a token provided by the user management server 201. When the map distribution server 202 determines that the user has the authority to use the map information, it may transmit the map information to the vehicle V.

[0045] An example of a method for the controller 1 of the vehicle V to initiate execution of a particular vehicle control function will be described with reference to Fig. 3. Each step of the method of Fig. 3 may be performed by a processor of the controller 1 executing a program stored in a memory of the controller 1. Alternatively, some or all of the steps of the method of Fig. 3 may be performed by a dedicated integrated circuit such as an application specific integrated circuit (ASIC).

[0046] The method of FIG. 3 may be initiated in response to the power (e.g., ignition power) of the vehicle V being turned on. Furthermore, the method of FIG. 3 may be initiated in response to a user logging in to the vehicle V using his / her own account information. For example, the user may input his / her own account information into the input device 6. The controller 1 may determine whether the account information input by the user matches the account information registered in the vehicle V. If the account information matches, the controller 1 may execute subsequent processing using the matching account information. This makes it possible to prevent the vehicle control function from being executed when a person other than a user having usage authority uses the vehicle V.

[0047] In S301, the controller 1 determines whether an instruction to execute a specific vehicle control function has been received from the user. If it is determined that an instruction to execute a specific vehicle control function has been received from the user ("YES" in S301), the controller 1 transitions the process to S302, and otherwise ("NO" in S301) repeats S301. In this manner, the controller 1 waits for an instruction to execute a specific vehicle control function. The specific vehicle control function may be, for example, a driving assistance function of the vehicle V, and may be, for example, the above-mentioned ACC, LKAS, ALC, ACLA, or a combination thereof.

[0048] In S302, the controller 1 determines whether the user has the authority to use the specified vehicle control function. If it is determined that the user has the authority to use the specified vehicle control function ("YES" in S302), the controller 1 transitions the process to S303, and otherwise ("NO" in S302), the controller 1 transitions the process to S307. If it is determined that the user does not have the authority to use the specified vehicle control function, the controller 1 notifies the user in S307 that the specified vehicle control function cannot be executed. Furthermore, the controller 1 may notify the user that the user does not have the authority. In this case, the controller 1 may guide the user on a method for acquiring the authority (for example, a method for applying for a usage contract).

[0049] The controller 1 may obtain information indicating whether the user has the authority to use the specific vehicle control function from the user management server 201 before S301 is executed, and store the information in the memory of the controller 1. For example, the controller 1 may send an inquiry to the user management server 201 as to whether the user has the authority to use the specific vehicle control function in response to the ignition power of the vehicle V being turned on. The controller 1 may determine that the user does not have the authority to use the specific vehicle control function if the expiration date of the authority to use the function has passed. A program for realizing the specific vehicle control function may be stored in the vehicle V in advance (for example, when the vehicle V is manufactured), or may be downloaded to the vehicle V after the authority to use this function is granted to the user.

[0050] In S303, the controller 1 determines whether the user has consented to the controller 1's use of the personal information. If it is determined that the user has consented to the use of the personal information ("YES" in S303), the controller 1 transitions the process to S304, and otherwise ("NO" in S303), transitions to S307. If it cannot be confirmed that the user has consented to the use of the personal information, the controller 1 notifies the user in S307 that the instructed vehicle control function cannot be executed. Furthermore, the controller 1 may notify the user that it cannot be confirmed that the user has consented to the use of the personal information. In this case, the controller 1 may guide the user on a method for consenting to the use of the personal information (for example, the controller 1 may present the user with a screen for consenting to the use of the personal information).

[0051] Consent regarding the use of the personal information may be given to the vehicle V, and the controller 1 may store the consent in memory and use it for subsequent processing. Alternatively or in addition, consent regarding the use of the personal information may be given to the user management server 201 through the user device 203. The controller 1 may obtain information indicating that the user has consented to the use of the personal information from the user management server 201 and store it in memory for subsequent processing.

[0052] Depending on the content of the vehicle control function, the user's personal information may be used. For example, when using high-precision map information as described above, the current position of the vehicle V is provided to the map distribution server 202. The current position of the vehicle V coincides with the current position of the user, and may therefore be considered personal information. In addition, an image of the user captured by the in-vehicle camera 9a may also be considered personal information. In order to use such personal information, depending on the country, the user's consent may be required by law. If the instructed vehicle control function does not use personal information, S303 may be omitted. If the vehicle V is used in a country that does not have a law requiring the user's consent to use personal information, S303 may be omitted.

[0053] In S304, the controller 1 determines whether the user has set in advance to enable the execution of the instructed vehicle control function. If it is determined that the user has set in advance to enable the execution of the instructed vehicle control function ("YES" in S304), the controller 1 transitions the process to S305, and otherwise ("NO" in S304), transitions to S307. If it is determined that the user has not set in advance to enable the execution of the instructed vehicle control function, the controller 1 notifies the user in S307 that the instructed vehicle control function cannot be executed. Furthermore, the controller 1 may notify the user that the execution of the instructed vehicle control function has not been set. In this case, the controller 1 may guide the user on a method for setting to enable the execution of the instructed vehicle control function (for example, the controller 1 may present the user with a screen for setting to enable the execution of the instructed vehicle control function).

[0054] Information indicating whether the execution of the instructed vehicle control function is set to be enabled may be stored in the memory of the controller 1, and the processor of the controller 1 may refer to this information. In S301, the user may unintentionally instruct the execution of a specific vehicle control function (for example, by accidentally touching a button for instructing). In this case, the controller 1 may set the enabling of the execution of a specific vehicle control function as a precondition for executing this function, that the user has set the function in advance. If such a precondition is not necessary, S304 may be omitted.

[0055] In S305, the controller 1 determines whether the instructed vehicle control function is in an executable state. If it is determined that the instructed vehicle control function is in an executable state ("YES" in S305), the controller 1 transitions the process to S306, and otherwise ("NO" in S305), transitions to S307. If it is determined that the instructed vehicle control function is not in an executable state, the controller 1 notifies the user in S307 that the instructed vehicle control function cannot be executed. Furthermore, the controller 1 may notify the user that the instructed vehicle control function is not in an executable state.

[0056] For example, if the instructed vehicle control function requires high-precision map information and the high-precision map information is not available, the controller 1 may determine that the function is not in an executable state. If the instructed vehicle control function is executable only in a specific driving environment (e.g., a highway) and the vehicle V is not in such a driving environment, the controller 1 may determine that the function is not in an executable state. If the instructed vehicle control function requires an initial check of a sensor (e.g., a radar) and such an initial check has not been completed, the controller 1 may determine that the function is not in an executable state.

[0057] In S306, the controller 1 executes the instructed vehicle control function. Thereafter, the controller 1 controls the vehicle V according to the vehicle control function. When the vehicle control function is terminated in response to a user's instruction or in response to a change in the driving environment, the controller 1 may execute the method of FIG. 3 again and wait for an instruction to execute a specific vehicle control function. The instructed vehicle control function may use map information provided by the map distribution server 202. The controller 1 may receive map information from the map distribution server 202 while executing the vehicle control function.

[0058] The above-mentioned determination in S302 (i.e., whether or not the user has the authority to use the instructed vehicle control function) may be performed based on the authority information stored in the storage device of the vehicle V (e.g., the memory of the controller 1). The authority information may be information indicating whether or not the user has the authority to use a specific vehicle control function. In the following description, the authority information stored in the storage device of the vehicle V is called internal authority information. For example, the controller 1 may determine "YES" in S302 when the internal authority information indicates that the user has the authority to use, and may determine "NO" in S302 when the internal authority information indicates that the user does not have the authority to use. Therefore, as described above in FIG. 3, the controller 1 may execute the specific vehicle control function based at least in part on the internal authority information indicating that the user has the authority to use. Thereby, even if the controller 1 cannot communicate with the user management server 201 at the time of receiving the instruction in S301, the controller 1 can execute the specific vehicle control function by satisfying the conditions in S302 to S305.

[0059] The controller 1 may update the internal authority information based on the authority information received from the user management server 201. In the following description, the authority information received from the user management server 201 is referred to as external authority information. The external authority information is information indicating whether or not a user has authority to use a specific vehicle control function, and may be information managed by the user management server 201. The user management server 201 may update the external authority information to indicate that the user has the authority to use, in response to granting the authority to use to the user in response to a request from the user. The user management server 201 may cancel the authority to use of the user in response to a request from the user or in response to the expiration of the authority to use, and update the external authority information to indicate that the user does not have the authority to use.

[0060] With reference to FIG. 4, an example of a method for the controller 1 of the vehicle V to manage the internal authority information will be described. Each step of the method of FIG. 4 may be performed by the processor of the controller 1 executing a program stored in the memory of the controller 1. Alternatively, some or all of the steps of the method of FIG. 4 may be executed by a dedicated integrated circuit such as an ASIC. The method of FIG. 4 may be started in response to the power supply (e.g., ignition power supply) of the vehicle V being turned on. Before the start of the method of FIG. 4, an initial value may be set in the internal authority information. The initial value may indicate that the user does not have the usage authority.

[0061] In S401, the controller 1 judges whether or not external authority information has been received from the user management server 201. If it is judged that the external authority information has been received from the user management server 201 ("YES" in S401), the controller 1 transitions the process to S402, and otherwise ("NO" in S401), the controller 1 transitions the process to S406. The controller 1 may inquire of the user management server 201 about the external authority information at a predetermined timing, and may receive the external authority information as a response to this inquiry. For example, the controller 1 may inquire about the external authority information in response to the power supply (e.g., ignition power supply) of the vehicle V being turned on, may inquire about the external authority information periodically, or may inquire about the external authority information in response to a predetermined length of time (e.g., three days) remaining until the expiration of the usage authority.

[0062] The user management server 201 may proactively (i.e., without response to an inquiry from the vehicle V) transmit the external authority information to the vehicle V, and the vehicle V may receive this external authority information. The user management server 201 may transmit the external authority information to the vehicle V periodically, or may transmit the external authority information to the vehicle V in response to an update of the external authority information (e.g., in response to granting a user usage authority or in response to canceling a user usage authority).

[0063] In S402, the controller 1 judges whether the external authority information received in S401 matches the internal authority information. If it is judged that the external authority information matches the internal authority information ("YES" in S402), the controller 1 transitions the process to S401, and otherwise ("NO" in S402), transitions the process to S403. If the external authority information matches the internal authority information, there is no need to update the internal authority information, so the controller 1 transitions to S401 and waits for reception of new external authority information.

[0064] In S403, the controller 1 judges whether the external authority information indicates that the user does not have the usage authority. If it is judged that the external authority information indicates that the user does not have the usage authority ("YES" in S403), the controller 1 transitions the process to S404, and otherwise ("NO" in S403), the controller 1 transitions the process to S405.

[0065] If the external authority information indicates that the user has the usage authority and the internal authority information indicates that the user does not have the usage authority, the controller updates the internal authority information to indicate that the user has the usage authority in S405. Such an update to grant the usage authority may be performed immediately without performing S404.

[0066] In S404, the controller 1 determines whether the vehicle V is traveling. If it is determined that the vehicle V is traveling ("YES" in S404), the controller 1 repeats S404, and otherwise ("NO" in S404), transitions the process to S405. If the vehicle V is traveling, the controller 1 waits to transition to S405 until the vehicle V stops traveling.

[0067] The controller 1 may determine whether the traveling of the vehicle V has ended based on at least one of the following: the speed of the vehicle V has become zero; the shift position of the vehicle V has become in the parking range; the parking brake of the vehicle V has been activated; and the power source (e.g., the ignition power source) of the vehicle V has been turned off. These conditions may be combined in any manner. For example, the controller 1 may determine that the traveling of the vehicle V has ended based on the shift position of the vehicle V having become in the parking range and the parking brake of the vehicle V having been activated.

[0068] When the external authority information indicates that the user does not have the use authority and the internal authority information indicates that the user has the use authority, in S405, the controller updates the internal authority information to indicate that the user does not have the use authority. In this way, the controller 1 may wait for the update to cancel the use authority until the vehicle V stops traveling. This can prevent the user from being confused due to being unable to execute a specific vehicle control function while traveling.

[0069] In S406, the controller 1 judges whether the inability to receive the external authority information is due to an action of the user. If it is judged that the inability to receive the external authority information is due to an action of the user ("YES" in S406), the controller 1 transitions the process to S404, and otherwise ("NO" in S406), the controller 1 transitions the process to S401.

[0070] As described above, whether or not the user has the use authority is determined based on the internal authority information, and the internal authority information is updated based on the external authority information. Therefore, even if the use authority is released by the user management server 201, if the controller 1 cannot receive the external authority information, the user can continue to use the vehicle control function. Therefore, in some embodiments, if the failure to receive the external authority information is caused by the user's actions, the controller 1 executes the process from S404 onwards. That is, the controller 1 updates the internal authority information so as to indicate that the user does not have the use authority. On the other hand, if the failure to receive the external authority information is not caused by the user's actions, the controller 1 transitions the process to S401 and waits for the reception of new external authority information.

[0071] The user's action to prevent the external authority information from being received may include at least one of not agreeing to provide personal information to the user management server 201 and putting the communication device 7c of the vehicle V in an out-of-communication state. For example, the user management server 201 may provide the external authority information to the vehicle V in response to acquiring the user's personal information from the vehicle V. In such a case, if the controller 1 cannot transmit the personal information to the user management server 201, the controller 1 cannot receive the external authority information. Therefore, the controller 1 may determine "YES" in S406 when the state of not agreeing to provide the personal information to the user management server 201 continues for a predetermined period (for example, one week or one month). The personal information transmitted to the user management server 201 may include the user's account information, the identification information of the vehicle V (for example, VIN), etc.

[0072] The user management server 201 may determine "YES" in S406 if the communication device 7c of the vehicle V has been out of communication range for a predetermined period of time (for example, one week or one month). Such a situation may occur when the user manually turns off the communication device 7c or continues to use the vehicle V outside the communication service range.

[0073] In the method of Fig. 4 described above, S403 and S404 may be omitted. In this case, the controller 1 may transition the process to S405 when the result of S402 is "NO". In the method of Fig. 4 described above, S406 may be omitted. In this case, the controller 1 may repeat S401 when the result of S401 is "NO".

[0074] <Summary of the embodiment> <Item 1> A control device (1) for a vehicle (V), a receiving means (1) for receiving from a server (201) first authority information indicating whether a user of the vehicle has authority to use a specific vehicle control function; an update means (1) for updating second authority information, which indicates whether the user has authority to use the specific vehicle control function and is stored in a storage device of the vehicle, based on the first authority information; and a vehicle control means (1) that executes the vehicle control function based at least in part on the second authority information indicating that the user has the usage authority. According to this item, even if the server cannot be accessed, the vehicle control function can be executed by referring to the authority information stored in the storage device, thereby improving the convenience of the vehicle control function. <Item 2> The control device according to item 1, wherein the update means waits to update the second authority information until the vehicle stops traveling when the first authority information indicates that the user does not have the usage authority. According to this item, the usage authority will not be revoked while the vehicle is traveling, thereby reducing confusion for the user. <Item 3> The control device described in item 2, wherein the update means determines whether the vehicle has stopped traveling based on at least one of the following: the speed of the vehicle has become zero; the shift position of the vehicle has entered the parking range; the parking brake of the vehicle has been activated; and the power source of the vehicle has been turned off. According to this item, the end of vehicle travel can be appropriately determined. <Item 4> The control device described in item 2, wherein the update means updates the second authority information to indicate that the user does not have the usage authority based on an inability to receive the first authority information from the server due to an action of the user. This item makes it possible to prevent users who do not have the authority to use the vehicle control function from using the vehicle control function. <Item 5> The control device described in item 4, wherein the user's action includes at least one of not agreeing to provide personal information to the server and placing the vehicle's communication device in an out-of-communication range state. This item makes it possible to appropriately determine whether the inability to receive authority information from the server is due to an action of the user. <Item 6> A program for causing a computer to function as each of the means of the control device described in any one of items 1 to 5. According to this item, a program capable of realizing the control device of the above item is provided. <Item 7> A method for controlling a vehicle (V), comprising: A receiving step (S401) of receiving, from a server (201), first authority information indicating whether a user of the vehicle has authority to use a specific vehicle control function; an updating step (S405) of updating second authority information, which indicates whether the user has authority to use the specific vehicle control function and is stored in a storage device of the vehicle, based on the first authority information; and a vehicle control step (S306) of executing the vehicle control function based at least in part on the second authority information indicating that the user has the usage authority. According to this item, even if the server cannot be accessed, the vehicle control function can be executed by referring to the authority information stored in the storage device, thereby improving the convenience of the vehicle control function.

[0075] This item allows for efficient confirmation of consent to the use of personal information.

[0076] The invention is not limited to the above-described embodiment, and various modifications and variations are possible within the scope of the gist of the invention. [Explanation of symbols]

[0077] V vehicle, 1 controller, 201 user management server, 202 map distribution server

Claims

1. A control device for a vehicle, a receiving means for receiving from a server first authority information indicating whether a user of the vehicle has authority to use a specific vehicle control function; an update unit for updating second authority information, the second authority information indicating whether the user has authority to use the specific vehicle control function and stored in a storage device of the vehicle, based on the first authority information; a vehicle control means for executing the vehicle control function based on the second authority information indicating that the user has the use authority, The update means waits to update the second authority information until the vehicle stops traveling when the first authority information indicates that the user does not have the use authority.

2. 2. The control device according to claim 1, wherein the update means determines whether the vehicle has stopped traveling based on at least one of the following: the speed of the vehicle has become zero; the shift position of the vehicle has entered a parking range; a parking brake of the vehicle has been activated; and a power source of the vehicle has been turned off.

3. The control device according to claim 1 , wherein the update means updates the second authority information to indicate that the user does not have the usage authority based on an inability to receive the first authority information from the server due to an action of the user.

4. The control device according to claim 3 , wherein the action of the user includes at least one of: not agreeing to provide personal information to the server; and setting the communication device of the vehicle to an out-of-communication range state.

5. A program for causing a computer to function as each of the means of the control device according to any one of claims 1 to 4.

6. A method for controlling a vehicle, comprising: receiving, from a server, first authority information indicating whether a user of the vehicle has authority to use a specific vehicle control function; an updating step of updating second authority information, which indicates whether the user has authority to use the specific vehicle control function and is stored in a storage device of the vehicle, based on the first authority information; a vehicle control step of executing the vehicle control function based on the second authority information indicating that the user has the use authority, A control method, in which, in the updating process, if the first authority information indicates that the user does not have the use authority, updating of the second authority information is postponed until the vehicle stops traveling.

Images