Autonomous driving abnormality detection device

Abstract

To appropriately determine whether an abnormality has occurred in at least one of a main control device and a sub-control device.SOLUTION: An autonomous driving abnormality detection device 1 includes a main control device 3 and a sub-control device 4, and each of the main control device 3 and the sub-control device 4 includes calculation parts 31, 41 that calculate a required deceleration instruction value, required state determination parts 32, 42 that determines a deceleration required state when the required deceleration instruction value is greater than a threshold value, and determines an acceleration required state when the required deceleration instruction value is less than the threshold value, and abnormal state determination parts 33, 43 that determines that at least one of the main control device 3 and the sub-control device 4 is in an abnormal state when the determination results of the required state determination parts 32, 42 differ between the main control device 3 and the sub-control device 4, and determines that the main control device 3 and the sub-control device 4 are in a normal state when the determination results of the required state determination parts 32, 42 match between the main control device 3 and the sub-control device 4.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an automatic driving abnormality detection device. [Background technology]

[0002] BACKGROUND ART Some vehicles, such as trucks, have redundant control devices for automatically driving the vehicle, and are equipped with two control devices, a main control device and a sub-control device (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-119077 [Patent Document 2] Patent No. 6015312 Summary of the Invention [Problem to be solved by the invention]

[0004] The main control device calculates control instruction values ​​for automatic driving of the vehicle and controls the automatic driving of the vehicle. The sub-controller calculates control instruction values ​​for automatic driving of the vehicle in the same way as the main control device, and when an abnormality occurs in the main control device, performs automatic driving control of the vehicle in place of the main control device and brings the vehicle to an emergency stop. The main control device and the sub-controller also have a mutual monitoring function that monitors the control instruction values ​​calculated by each other. For example, the mutual monitoring function determines that the main control device and the sub-controller are in a normal state if the difference between the required deceleration value calculated by the main control device and the required deceleration value calculated by the sub-controller is smaller than a threshold value (e.g., 0.2 m / s), and determines that at least one of the main control device and the sub-controller is in an abnormal state if the difference between these required deceleration values ​​is greater than a threshold value (e.g., 0.2 m / s).

[0005] Here, consider a case where the threshold value is 0.2 m / ss, the required deceleration value calculated by the main control unit is 0.15 m / ss (a state in which the vehicle is decelerating), and the required deceleration value calculated by the sub-control unit is 0 m / ss (a state in which the vehicle maintains an accelerating state without decelerating). In this case, since the two states are different, it is thought that an abnormality has occurred in at least one of the main control unit and the sub-control unit, but because the difference in the required deceleration values ​​between the two is smaller than the threshold, it is determined that the state is normal and the vehicle continues to run.

[0006] Therefore, an object of the present invention is to provide an automatic driving abnormality detection device that can appropriately determine that an abnormality has occurred in at least one of the main control device and the sub-control device. [Means for solving the problem]

[0007] [1] The automatic driving abnormality detection device of the present invention comprises a main control device that calculates a control instruction value for automatic driving of the vehicle and controls the automatic driving of the vehicle, and a sub-controller that calculates the control instruction value for automatic driving of the vehicle, and each of the main control device and the sub-controller has a calculation unit that calculates a required deceleration instruction value as the control instruction value, a required state judgment unit that determines that a deceleration is required state if the required deceleration instruction value is greater than a threshold value, and determines that an acceleration is required state if the required deceleration instruction value is less than the threshold value, and an abnormal state judgment unit that determines that at least one of the main control device and the sub-controller is in an abnormal state if the judgment results of the required state judgment unit differ between the main control device and the sub-controller, and determines that the main control device and the sub-controller are in a normal state if the judgment results of the required state judgment unit match between the main control device and the sub-controller.

[0008] In this autonomous driving abnormality detection device, the main control unit and the sub-controller each determine whether a deceleration request state or an acceleration request state is in place by comparing the required deceleration instruction value with a threshold value. If the determination results of the required state determination unit differ between the main control unit and the sub-controller, it is determined that at least one of the main control unit and the sub-controller is in an abnormal state. If the determination results of the required state determination unit match between the main control unit and the sub-controller, it is determined that the main control unit and the sub-controller are in a normal state. Therefore, even if the difference between the required deceleration value calculated by the main control unit and the required deceleration value calculated by the sub-controller is small, it can be determined that at least one of the main control unit and the sub-controller is in an abnormal state if the state indicated by the required deceleration instruction value calculated by the main control unit differs from the state indicated by the required deceleration instruction value calculated by the sub-controller. This makes it possible to appropriately determine that an abnormality has occurred in at least one of the main control unit and the sub-controller.

[0009] [2] In the autonomous driving anomaly detection device described in [1], the abnormal state determination unit of each of the main control unit and the sub-controller may determine that at least one of the main control unit and the sub-controller is in an abnormal state if the state in which the determination results of the required state determination unit between the main control unit and the sub-controller continue for a first hour or more, and may determine that at least one of the main control unit and the sub-controller is in a normal state if the state in which the determination results of the required state determination unit between the main control unit and the sub-controller do not continue for a first hour or more. In this autonomous driving anomaly detection device, in each of the main control unit and the sub-controller, if the state in which the determination results of the required state determination unit between the main control unit and the sub-controller continue for a first hour or more, at least one of the main control unit and the sub-controller is in an abnormal state, and if the state in which the determination results of the required state determination unit between the main control unit and the sub-controller do not continue for a first hour or more, the main control unit and the sub-controller are in a normal state. Therefore, even if there is a time lag such as a communication delay between the main control unit and the sub-controller or a difference in calculation processing time between the main control unit and the sub-controller, the states of the main control unit and the sub-controller can be appropriately determined.

[0010] [3] In the autonomous driving anomaly detection device described in [1] or [2], if the abnormal state determination unit of the main control device determines that the vehicle is in an abnormal state, the main control device may stop the vehicle. In this autonomous driving anomaly detection device, if the abnormal state determination unit of the main control device determines that the vehicle is in an abnormal state, the main control device stops the vehicle, thereby improving the safety of autonomous driving.

[0011] [4] In the autonomous driving anomaly detection device described in any one of [1] to [3], the sub-controller is capable of performing autonomous driving control of the vehicle in place of the main controller, and the sub-controller may stop the vehicle when the judgment result of the abnormal state judgment unit of the main controller is a normal state and the judgment result of the abnormal state judgment unit of the sub-controller is an abnormal state. In this autonomous driving anomaly detection device, if the judgment result of the abnormal state judgment unit of the main controller is a normal state and the judgment result of the abnormal state judgment unit of the sub-controller is an abnormal state, the sub-controller stops the vehicle, thereby improving the safety of autonomous driving.

[0012] [5] In the automatic driving abnormality detection device described in [4], if the judgment result of the abnormal state judgment unit of the main control unit is a normal state and the judgment result of the abnormal state judgment unit of the sub-controller is an abnormal state, the sub-controller may cut off the power supply to the main control unit. In this automatic driving abnormality detection device, if the judgment result of the abnormal state judgment unit of the main control unit is a normal state and the judgment result of the abnormal state judgment unit of the sub-controller is an abnormal state, the sub-controller cuts off the power supply to the main control unit, thereby preventing the main control unit, which may be abnormal, from performing automatic driving control of the vehicle. [Effects of the Invention]

[0013] According to the present invention, it is possible to appropriately determine whether an abnormality has occurred in at least one of the main control device and the sub-control device. [Brief explanation of the drawings]

[0014] [Figure 1] 1 is a block diagram illustrating an automatic driving abnormality detection device according to an embodiment. [Figure 2] 10 is a flowchart showing an abnormal state determination process. [Figure 3] 10 is a flowchart showing an abnormality process. [Figure 4] 10 is a flowchart showing an emergency stop process. DETAILED DESCRIPTION OF THE INVENTION

[0015] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, the same or equivalent elements will be designated by the same reference numerals, and redundant description will be omitted.

[0016] FIG. 1 is a block diagram showing an autonomous driving anomaly detection device according to an embodiment. As shown in FIG. 1, the autonomous driving anomaly detection device 1 according to this embodiment is mounted on a vehicle 2. The vehicle 2 is, for example, an electric vehicle. The electric vehicle may be, for example, a hybrid electric vehicle (HEV), a plug-in hybrid electric vehicle (PHEV), a fuel cell electric vehicle (FCEV), or an electric vehicle (BEV). The autonomous driving anomaly detection device 1 includes a main control device 3 and a sub-control device 4.

[0017] The main control device 3 and the sub-control device 4 are devices that perform automatic driving control of the vehicle 2. The main control device 3 is an automatic driving control device of the main system, and performs automatic driving control of the vehicle 2 under normal circumstances. The sub-control device 4 is an automatic driving control device of the sub-system, and performs automatic driving control of the vehicle 2 in place of the main control device 3 if an abnormality occurs in the main control device 3. The main control device 3 and the sub-control device 4 have the function of monitoring each other.

[0018] Each of the main control device 3 and the sub-control device 4 is, for example, an electronic control unit (ECU) having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), etc. Each of the main control device 3 and the sub-control device 4 performs various controls, for example, by loading a program stored in the ROM into the RAM and executing it on the CPU. Each of the main control device 3 and the sub-control device 4 may be configured by a single electronic control unit or multiple electronic control units.

[0019] The main control device 3 calculates control instruction values ​​for automatically driving the vehicle 2, and performs automatic driving control of the vehicle 2. The main control device 3 includes a calculation unit 31, a required state determination unit 32, an abnormal state determination unit 33, and an execution unit 34. The calculation unit 31, the required state determination unit 32, the abnormal state determination unit 33, and the execution unit 34 may be configured as the same electronic control unit or may be configured as different electronic control units.

[0020] The sub-controller 4 calculates control instruction values ​​for automatically driving the vehicle 2 in the same way as the main controller 3, and performs automatic driving control of the vehicle 2 in place of the main controller 3 in the event of a failure in the main controller 3, etc. The sub-controller 4 includes a calculation unit 41, a required state determination unit 42, an abnormal state determination unit 43, and an execution unit 44. The calculation unit 41, the required state determination unit 42, the abnormal state determination unit 43, and the execution unit 44 may be configured by the same electronic control unit or by different electronic control units.

[0021] Each of the calculation units 31 and 41 calculates a control instruction value for automatically driving the vehicle. Each of the calculation units 31 and 41 calculates a required deceleration instruction value as one of the control instruction values. The required deceleration instruction value is a required deceleration for decelerating the traveling vehicle 2. The required deceleration instruction value is a value calculated using information such as the amount of brake pedal operation, the vehicle speed, the acceleration / deceleration of the vehicle 2, and the steering amount of the vehicle 2 as input values. For example, a required deceleration of 0.15 m / ss indicates a state in which the vehicle 2 is decelerated at a deceleration of 0.15 m / ss. Furthermore, a required deceleration of 0 m / ss indicates a state in which the vehicle 2 is not decelerated, that is, a state in which the acceleration state of the vehicle 2 is maintained.

[0022] For mutual monitoring, the calculation unit 31 outputs the calculated various control instruction values ​​to the sub-control unit 4. For mutual monitoring, the calculation unit 41 outputs the calculated various control instruction values ​​to the main control unit 3.

[0023] The requested state determination unit 32 and the requested state determination unit 42 each determine the requested state indicated by the requested deceleration command value calculated by the calculation unit 31 and the calculation unit 41, respectively. The requested state determination unit 32 determines that a deceleration requested state exists when the requested deceleration command value calculated by the calculation unit 31 is greater than a threshold value, and determines that an acceleration requested state exists when the requested deceleration command value calculated by the calculation unit 31 is smaller than the threshold value. Furthermore, the requested state determination unit 42 determines that a deceleration requested state exists when the requested deceleration command value calculated by the calculation unit 41 is greater than the threshold value, and determines that an acceleration requested state exists when the requested deceleration command value calculated by the calculation unit 41 is smaller than the threshold value. The threshold value used by the requested state determination unit 32 and the requested state determination unit 42 is the same value, for example, 0.01 m / s.

[0024] For mutual monitoring, the required state determination unit 32 outputs the determination result, that is, the deceleration required state or the acceleration required state, to the sub-control unit 4. For mutual monitoring, the required state determination unit 42 outputs the determination result, that is, the deceleration required state or the acceleration required state, to the main control unit 3.

[0025] The abnormal state determination unit 33 and the abnormal state determination unit 43 determine whether or not the main control unit 3 and the sub-control unit 4 are in an abnormal state by comparing the determination results of the required state determination unit 32 and the required state determination unit 42. An abnormal state is, for example, a state in which the calculation unit 31 and the calculation unit 41 cannot perform calculations correctly.

[0026] When the determination result of the requested state determination unit 32 and the determination result of the requested state determination unit 42 match, the abnormal state determination unit 33 and the abnormal state determination unit 43 each determine that the main control unit 3 and the sub-control unit 4 are in a normal state. In other words, when the determination result of the requested state determination unit 32 and the determination result of the requested state determination unit 42 are both a deceleration requested state, or when the determination result of the requested state determination unit 32 and the determination result of the requested state determination unit 42 are both an acceleration requested state, the abnormal state determination unit 33 and the abnormal state determination unit 43 each determine that the requested state determined by the requested state determination unit 32 matches the requested state determined by the requested state determination unit 42. When the requested state determined by the requested state determination unit 32 matches the requested state determined by the requested state determination unit 42, the main control unit 3 and the sub-control unit 4 are considered to be normal, and therefore the abnormal state determination unit 33 and the abnormal state determination unit 43 each determine that the main control unit 3 and the sub-control unit 4 are in a normal state.

[0027] On the other hand, when the determination result of the required state determination unit 32 and the determination result of the required state determination unit 42 differ, each of the abnormal state determination unit 33 and the abnormal state determination unit 43 determines that at least one of the main control unit 3 and the sub-control unit 4 is in an abnormal state. In other words, when either the determination result of the required state determination unit 32 or the determination result of the required state determination unit 42 is a deceleration required state and the other of the determination result of the required state determination unit 32 or the determination result of the required state determination unit 42 is an acceleration required state, the abnormal state determination unit 33 and the abnormal state determination unit 43 determine that the required state determined by the required state determination unit 32 does not match the required state determined by the required state determination unit 42. When the required state determined by the required state determination unit 32 does not match the required state determined by the required state determination unit 42, it is considered that an abnormality has occurred in at least one of the main control unit 3 and the sub-control unit 4, and therefore each of the abnormal state determination unit 33 and the abnormal state determination unit 43 determines that at least one of the main control unit 3 and the sub-control unit 4 is in an abnormal state.

[0028] In this embodiment, if the state in which the determination result of the requested state determination unit 32 and the determination result of the requested state determination unit 42 differ continues for a first time or more, the abnormal state determination unit 33 and the abnormal state determination unit 43 each determine that at least one of the main control unit 3 and the sub-control unit 4 is in an abnormal state. On the other hand, if the state in which the determination result of the requested state determination unit 32 and the determination result of the requested state determination unit 42 differ does not continue for a first time or more, it is considered that the difference between the determination result of the requested state determination unit 32 and the determination result of the requested state determination unit 42 is due to a time lag such as a communication delay between the main control unit 3 and the sub-control unit 4 or a difference in calculation processing time between the main control unit 3 and the sub-control unit 4, and therefore the abnormal state determination unit 33 and the abnormal state determination unit 43 each determine that the main control unit 3 and the sub-control unit 4 are in a normal state. This first time can be, for example, 200 msec.

[0029] For mutual monitoring, the abnormal state determination unit 33 outputs the determination result, either a normal state or an abnormal state, to the sub-control unit 4. For mutual monitoring, the abnormal state determination unit 43 outputs the determination result, either a normal state or an abnormal state, to the main control unit 3.

[0030] The execution unit 34 and the execution unit 44 each execute various control instruction values ​​calculated by the calculation unit 31 and the calculation unit 41, respectively. The execution unit 34 performs automatic driving control of the vehicle 2 by transmitting various control instruction values ​​calculated by the calculation unit 31 to various electronic control units of the vehicle 2. When an abnormality occurs in the main control device 3, the execution unit 44 performs automatic driving control of the vehicle 2 by transmitting various control instruction values ​​calculated by the calculation unit 41 to various electronic control units of the vehicle 2 instead of the main control device 3.

[0031] For mutual monitoring, the execution unit 34 transmits the control instruction values ​​transmitted to the various electronic control units of the vehicle 2 to the sub-control unit 4. When the execution unit 44 transmits control instruction values ​​to the various electronic control units of the vehicle 2 on behalf of the main control unit 3, the execution unit 44 transmits the control instruction values ​​transmitted to the various electronic control units of the vehicle 2 to the main control unit 3 for mutual monitoring.

[0032] Furthermore, when the determination result of the abnormal state determination unit 33 is an abnormal state, the execution unit 34 outputs an emergency stop signal for bringing the vehicle 2 to an emergency stop, thereby bringing the vehicle 2 to an emergency stop.

[0033] Here, if an abnormality occurs in at least one of the main control unit 3 and the sub-control unit 4, the judgment result of either the abnormal state judgment unit 33 of the main control unit 3 or the abnormal state judgment unit 43 of the sub-control unit 4 may be a normal state, and the judgment result of either the abnormal state judgment unit 33 of the main control unit 3 or the abnormal state judgment unit 43 of the sub-control unit 4 may be an abnormal state. For example, if an abnormality occurs in the main control unit 3 but not in the sub-control unit 4, the judgment result of the abnormal state judgment unit 33 of the main control unit 3 may be a normal state, and the judgment result of the abnormal state judgment unit 43 of the sub-control unit 4 may be an abnormal state. In this case, even if the sub-control unit 4 queries the main control unit 3 as mutual monitoring, the main control unit 3 does not return an abnormal state response. Also, if no abnormality occurs in the main control unit 3 but an abnormality occurs in the sub-control unit 4, the judgment result of the abnormal state judgment unit 33 of the main control unit 3 may be an abnormal state, and the judgment result of the abnormal state judgment unit 43 of the sub-control unit 4 may be a normal state. In this case, even if the main control device 3 makes an inquiry to the sub-control device 4 as part of mutual monitoring, the sub-control device 4 does not return a response indicating an abnormal state.

[0034] Therefore, when the determination result of the abnormal state determination unit 33 of the main control unit 3 is a normal state and the determination result of the abnormal state determination unit 33 of the sub-control unit 4 is an abnormal state, the execution unit 44 of the sub-control unit 4 cuts off the power supply to the main control unit 3 and outputs an emergency stop signal to make an emergency stop of the vehicle 2, thereby causing the vehicle 2 to make an emergency stop. In this embodiment, when the state in which the determination result of the required state determination unit 32 and the determination result of the required state determination unit 42 differ continues for a second time period or more, the execution unit 44 of the sub-control unit 4 cuts off the power supply to the main control unit 3 and outputs an emergency stop signal to make an emergency stop of the vehicle 2, thereby causing the vehicle 2 to make an emergency stop. On the other hand, when the state in which the determination result of the required state determination unit 32 and the determination result of the required state determination unit 42 differ does not continue for a second time period or more, the execution unit 44 of the sub-control unit 4 does not output an emergency stop signal to make an emergency stop of the vehicle 2, and does not cause the vehicle 2 to make an emergency stop. This second time period can be, for example, 50 msec.

[0035] In addition, if the judgment result of the abnormal state judgment unit 33 of the main control unit 3 is an abnormal state and the judgment result of the abnormal state judgment unit 33 of the sub-control unit 4 is a normal state, the execution unit 44 of the main control unit 3 outputs an emergency stop signal to bring the vehicle 2 to an emergency stop as usual, and brings the vehicle 2 to an emergency stop.

[0036] Next, the processing operation of the autonomous driving anomaly detection device 1 will be described with reference to Fig. 2 to Fig. 4. Fig. 2 is a flowchart showing an abnormal state determination process. Fig. 3 is a flowchart showing an abnormality process. Fig. 4 is a flowchart showing an emergency stop process.

[0037] 2 is a flowchart showing the abnormal state determination process. As shown in FIG. 2, in the abnormal state determination process, first, the required state determination unit 32 and the required state determination unit 42 each determine the required state indicated by the required deceleration instruction value calculated by the calculation unit 31 and the calculation unit 41, respectively (step S1). In step S1, the required state determination unit 32 determines that a deceleration is required state if the required deceleration instruction value calculated by the calculation unit 31 is greater than a threshold value, and determines that an acceleration is required state if the required deceleration instruction value calculated by the calculation unit 31 is smaller than the threshold value. Furthermore, the required state determination unit 42 determines that a deceleration is required state if the required deceleration instruction value calculated by the calculation unit 41 is greater than the threshold value, and determines that an acceleration is required state if the required deceleration instruction value calculated by the calculation unit 41 is smaller than the threshold value.

[0038] Next, each of the abnormal state determination unit 33 and the abnormal state determination unit 43 determines whether the required state determined by the required state determination unit 32 matches the required state determined by the required state determination unit 42 (step S2).

[0039] If it is determined that the judgment result of the required state judgment unit 32 matches the judgment result of the required state judgment unit 42 (step S2: YES), the abnormal state judgment unit 33 and the abnormal state judgment unit 43 each determine that the main control unit 3 and the sub-control unit 4 are in a normal state (step S3).

[0040] On the other hand, if it is determined that the required state determined by the required state determination unit 32 does not match the required state determined by the required state determination unit 42 (step S2: NO), each of the abnormal state determination unit 33 and the abnormal state determination unit 43 determines whether the state in which the determination result of the required state determination unit 32 does not match the determination result of the required state determination unit 42 continues for more than a first time (step S4).

[0041] If it is determined that the state in which the judgment result of the required state judgment unit 32 and the judgment result of the required state judgment unit 42 do not match continues for more than the first time (step S4: NO), the abnormal state judgment unit 33 and the abnormal state judgment unit 43 each determine that the main control unit 3 and the sub-control unit 4 are in a normal state (step S3).

[0042] On the other hand, if it is determined that the state in which the judgment result of the required state judgment unit 32 and the judgment result of the required state judgment unit 42 are inconsistent continues for more than a first time (step S4: YES), the abnormal state judgment unit 33 and the abnormal state judgment unit 43 each determine that at least one of the main control unit 3 and the sub-control unit 4 is in an abnormal state (step S5).

[0043] 3 is a flowchart showing the abnormality processing. The abnormality processing is performed after the abnormal state determination processing described above. As shown in FIG. 3, in the abnormality processing, first, the execution unit 34 and the execution unit 44 each determine whether or not the determination results of both the abnormal state determination unit 33 and the abnormal state determination unit 43 indicate an abnormal state (step S11).

[0044] If the determination results of both the abnormal state determination unit 33 and the abnormal state determination unit 43 indicate a normal state (step S11: YES), the execution unit 34 of the main control device 3 continues the automatic driving control of the vehicle 2 without making an emergency stop of the vehicle 2. On the other hand, if the determination result of at least one of the abnormal state determination unit 33 and the abnormal state determination unit 43 indicates an abnormal state (step S11: NO), each of the execution unit 34 and the execution unit 44 performs emergency stop processing.

[0045] 2 and 4, in the emergency stop processing, first, the execution unit 34 and the execution unit 44 each determine whether or not the determination results of both the abnormal state determination unit 33 and the abnormal state determination unit 43 indicate an abnormal state (step S21).

[0046] If the judgment results of both the abnormal state judgment unit 33 and the abnormal state judgment unit 43 indicate an abnormal state (step S21: YES), the execution unit 34 of the main control unit 3 outputs an emergency stop signal to bring the vehicle 2 to an emergency stop, thereby bringing the vehicle 2 to an emergency stop (step S22).

[0047] On the other hand, if the judgment result of either the abnormal state judgment unit 33 or the abnormal state judgment unit 43 is determined to be an abnormal state (step S21: NO), each of the execution units 34 and 44 determines whether the judgment result of the abnormal state judgment unit 43 of the sub-control unit 4 is a normal state, that is, whether the judgment result of the abnormal state judgment unit 33 of the main control unit 3 is an abnormal state (step S23).

[0048] If the abnormal state determination unit 43 of the sub-control unit 4 determines that the determination result is a normal state (step S23: YES), it is considered that an abnormality has occurred in the sub-control unit 4, and the execution unit 34 of the main control unit 3 outputs an emergency stop signal to bring the vehicle 2 to an emergency stop, thereby bringing the vehicle 2 to an emergency stop (step S22).

[0049] On the other hand, if the judgment result of the abnormal state judgment unit 33 of the main control unit 3 is determined to be a normal state (step S23: NO), it is considered that an abnormality has occurred in the main control unit 3, and the execution unit 44 of the sub-control unit 4 judges whether the state in which the judgment result of the required state judgment unit 32 and the judgment result of the required state judgment unit 42 are inconsistent continues for more than a second time (step S24).

[0050] If it is determined that the state in which the judgment result of the required state judgment unit 32 and the judgment result of the required state judgment unit 42 do not match continues for more than a second time (step S24: NO), it is considered that the judgment result of the required state judgment unit 32 and the judgment result of the required state judgment unit 42 differ due to a time lag such as a communication delay between the main control unit 3 and the sub-control unit 4, or a difference in calculation processing time between the main control unit 3 and the sub-control unit 4, and therefore the execution unit 34 of the main control unit 3 outputs an emergency stop signal to bring the vehicle 2 to an emergency stop, thereby bringing the vehicle 2 to an emergency stop (step S22).

[0051] On the other hand, if it is determined that the state in which the determination result of the required state determination unit 32 and the determination result of the required state determination unit 42 do not match continues for more than the second time (step S24: YES), it is considered that an abnormality has occurred in the main control unit 3, and therefore the execution unit 44 of the sub-control unit 4 cuts off the power supply to the main control unit 3 (step S25). Then, the execution unit 44 of the sub-control unit 4 outputs an emergency stop signal to bring the vehicle 2 to an emergency stop instead of the main control unit 3, thereby bringing the vehicle 2 to an emergency stop (step S26).

[0052] As described above, in the autonomous driving anomaly detection device 1 according to this embodiment, the main control device 3 and the sub-control device 4 each determine whether a deceleration request state or an acceleration request state is in progress by comparing the required deceleration instruction value with a threshold value. If the determination result of the required state determination unit 32 differs from the determination result of the required state determination unit 42, it is determined that at least one of the main control device 3 and the sub-control device 4 is in an abnormal state. If the determination result of the required state determination unit 32 matches the determination result of the required state determination unit 42, it is determined that the main control device 3 and the sub-control device 4 are in a normal state. Therefore, even if the difference between the required deceleration value calculated by the main control device 3 and the required deceleration value calculated by the sub-control device 4 is small, if the state indicated by the required deceleration instruction value calculated by the main control device 3 differs from the state indicated by the required deceleration instruction value calculated by the sub-control device 4, it can be determined that at least one of the main control device 3 and the sub-control device 4 is in an abnormal state. This makes it possible to appropriately determine that an abnormality has occurred in at least one of the main control device 3 and the sub-control device 4.

[0053] Furthermore, in this autonomous driving anomaly detection device 1, if a state in which the determination result of the required state determination unit 32 differs from the determination result of the required state determination unit 42 continues for a first time or more in each of the main control unit 3 and the sub-control unit 4, it is determined that at least one of the main control unit 3 and the sub-control unit 4 is in an abnormal state, and if a state in which the determination result of the required state determination unit 32 differs from the determination result of the required state determination unit 42 does not continue for the first time or more, it is determined that the main control unit 3 and the sub-control unit 4 are in a normal state. Therefore, even if a time lag occurs, such as a communication delay between the main control unit 3 and the sub-control unit 4 or a difference in calculation processing time between the main control unit and the sub-control unit, the states of the main control unit 3 and the sub-control unit 4 can be appropriately determined.

[0054] In addition, in this automatic driving abnormality detection device 1, if the judgment result of the abnormal state judgment unit 33 of the main control device 3 is an abnormal state, the main control device 3 stops the vehicle 2, thereby improving the safety of automatic driving.

[0055] Furthermore, in this automatic driving abnormality detection device 1, if the judgment result of the abnormal state judgment unit 33 of the main control unit 3 is a normal state and the judgment result of the abnormal state judgment unit 43 of the sub-control unit 4 is an abnormal state, the sub-control unit 4 will stop the vehicle 2, thereby improving the safety of automatic driving.

[0056] Furthermore, in this automatic driving abnormality detection device 1, if the judgment result of the abnormal state judgment unit 33 of the main control unit 3 is a normal state and the judgment result of the abnormal state judgment unit 43 of the sub-control unit 4 is an abnormal state, the sub-control unit 4 cuts off the power supply to the main control unit 3, thereby preventing automatic driving control of the vehicle 2 from being performed by a main control unit 3 that may be abnormal.

[0057] The above describes an embodiment of the present invention, but the present invention is not limited to the above embodiment, and may be modified or applied to other things within the scope that does not change the gist described in each claim.

[0058] For example, in the above embodiment, the main control unit and sub-control unit were described as performing various processes in the calculation unit, required state determination unit, abnormal state determination unit, and execution unit, but these various processes may be performed in any functional unit of the main control unit and sub-control unit. [Explanation of symbols]

[0059] 1...Autonomous driving abnormality detection device, 2...Vehicle, 3...Main control unit, 4...Sub-control unit, 31...Calculation unit, 32...Required state determination unit, 33...Abnormal state determination unit, 34...Execution unit, 41...Calculation unit, 42...Required state determination unit, 43...Abnormal state determination unit, 44...Execution unit

Claims

1. a main control device that calculates a control instruction value for automatically driving a vehicle and controls the automatic driving of the vehicle; a sub-controller that calculates a control instruction value for automatically driving a vehicle; Each of the main control device and the sub-control device a calculation unit that calculates a required deceleration command value as the control command value; a request state determination unit that determines that a deceleration request state exists when the required deceleration instruction value is greater than a threshold value, and that determines that an acceleration request state exists when the required deceleration instruction value is less than the threshold value; an abnormal state determination unit that determines that at least one of the main control unit and the sub-control unit is in an abnormal state when the determination results of the required state determination unit differ between the main control unit and the sub-control unit, and that the main control unit and the sub-control unit are in a normal state when the determination results of the required state determination unit match between the main control unit and the sub-control unit; Autonomous driving abnormality detection device.

2. The abnormal state determination units of the main control device and the sub-control device each include: If a state in which the determination result of the requested state determination unit differs between the main control unit and the sub-control unit continues for a first time or more, it is determined that at least one of the main control unit and the sub-control unit is in an abnormal state; When a state in which the determination result of the requested state determination unit differs between the main control unit and the sub-control unit does not continue for a first time or more, it is determined that at least one of the main control unit and the sub-control unit is in a normal state. The automatic driving abnormality detection device according to claim 1.

3. When the determination result of the abnormal state determination unit of the main control device indicates an abnormal state, the main control device stops the vehicle. The automatic driving abnormality detection device according to claim 1 or 2.

4. The sub-controller is capable of performing automatic driving control of the vehicle in place of the main controller, When the determination result of the abnormal state determination unit of the main control unit is a normal state and the determination result of the abnormal state determination unit of the sub-control unit is an abnormal state, the sub-control unit stops the vehicle. The automatic driving abnormality detection device according to claim 1 or 2.

5. When the determination result of the abnormal state determination unit of the main control unit is a normal state and the determination result of the abnormal state determination unit of the sub-control unit is an abnormal state, the sub-control unit cuts off the power supply of the main control unit. The automatic driving abnormality detection device according to claim 4.

Images