vehicle

Abstract

To perform appropriate control when a part of redundant functions of an automatic driving system is restored from an abnormal state.SOLUTION: VCIB performs a process including a step (ADC1) of outputting a switching instruction when an abnormality in communication with S100 occurs (YES in S102), a step (ADC1) of invalidating a PCS deactivation instruction when the PCS deactivation instruction is received from S104 (YES in S106) and the trip is identical to the trip at the time of occurrence of the abnormality (YES in S108), and a step (S106) of outputting the PCS deactivation instruction when the trip is not identical to the trip at the time of occurrence of the abnormality (NO in S110).SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates to vehicles. [Background technology]

[0002] In recent years, autonomous driving systems that allow vehicles to travel without receiving user operations have been developed. For example, autonomous driving systems may be provided separately from the vehicle via an interface so that they can be installed in existing vehicles.

[0003] For example, Japanese Patent Application Laid-Open Publication No. 2018-132015 (Patent Document 1) discloses a technology in which automatic driving control of a vehicle is comprehensively executed by a computer constituting an automatic driving system provided in the vehicle. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2018-132015 Summary of the Invention [Problem to be solved by the invention]

[0005] The above-mentioned autonomous driving system for a vehicle is provided with two devices with the same functions that enable autonomous driving for redundancy. Therefore, for example, if an abnormality occurs between one device and the vehicle while autonomous driving is being performed using the other device, autonomous driving can be continued using the other device. However, when one of the devices that has experienced an abnormality recovers from the abnormality by restarting, it may output commands related to autonomous driving based on information acquired after the restart, and it is necessary to appropriately handle such unreliable commands.

[0006] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a vehicle that performs appropriate control when some of the redundant functions of the autonomous driving system recover from an abnormal state. [Means for solving the problem]

[0007] A vehicle according to an aspect of the present disclosure includes an autonomous driving system that performs autonomous driving of the vehicle and a vehicle platform capable of receiving commands related to autonomous driving from the autonomous driving system. The vehicle platform includes a base vehicle and a vehicle control interface that interfaces between the vehicle platform and the autonomous driving system. The vehicle control interface includes a first control device and a second control device. The autonomous driving system includes a first autonomous driving device that outputs commands to the base vehicle via the first control device, and a second autonomous driving device that outputs commands to the base vehicle via the second control device when an abnormality occurs in the first autonomous driving device. When an abnormality occurs in the first autonomous driving device, a command to execute evacuation driving using the second autonomous driving device and the second control device is output to the base vehicle. The first control device does not accept predetermined commands from the first autonomous driving device even when the first autonomous driving device recovers from the abnormality.

[0008] In this way, even if the first automatic driving device recovers from an abnormality during evacuation travel and outputs a predetermined command to the base vehicle, the first control device can be prevented from accepting the command from the first automatic driving device, thereby preventing the vehicle from being controlled based on an unreliable command from the first automatic driving device that has recovered from an abnormality.

[0009] In one embodiment, the base vehicle includes a vehicle control device that controls equipment of the vehicle independently of commands from the automated driving system. The first automated driving device outputs a stop command to the base vehicle via the first control device, requesting that control of the vehicle using the vehicle control device be stopped while automated driving is being performed.

[0010] In this way, control of the vehicle by the vehicle control device is stopped during automatic driving, thereby suppressing interference with automatic driving.

[0011] In a further embodiment, the vehicle control device controls the vehicle to avoid a vehicle collision when a condition in which a vehicle collision is predicted occurs.

[0012] In this way, collision avoidance vehicle control by the vehicle control device is stopped during automatic driving, thereby suppressing interference with automatic driving.

[0013] Furthermore, in one embodiment, the first control device does not accept commands from the first automatic driving device if the first automatic driving device is in a trip that includes the time when the abnormality occurred, even if the first automatic driving device has recovered from the abnormality.

[0014] In this way, the vehicle will not be controlled based on unreliable commands from the first automatic driving device that has recovered from the abnormality during a trip that includes the time when the abnormality occurred. [Effects of the Invention]

[0015] According to the present disclosure, it is possible to provide a vehicle that performs appropriate control when some of the redundant functions of the autonomous driving system recover from an abnormal state. [Brief explanation of the drawings]

[0016] [Figure 1] 1 is a diagram illustrating an overview of a vehicle according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a diagram for explaining in detail the configurations of ADS, VCIB, and VP. [Figure 3] 10 is a flowchart illustrating an example of processing executed by the VCIB. [Figure 4] FIG. 10 is a diagram for explaining an example of the operation of the VCIB. DETAILED DESCRIPTION OF THE INVENTION

[0017] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals, and description thereof will not be repeated.

[0018] Fig. 1 is a diagram illustrating an overview of a vehicle 10 according to an embodiment of the present disclosure. Referring to Fig. 1, the vehicle 10 includes an autonomous driving kit (hereinafter referred to as an "ADK (Autonomous Driving Kit)") 200 and a vehicle platform (hereinafter referred to as a "VP (Vehicle Platform)") 120. The ADK 200 and the VP 120 are configured to be able to communicate with each other via a vehicle control interface.

[0019] The vehicle 10 performs automatic driving in accordance with a control request (command) from the ADK 200 attached to the VP 120. The ADK 200 is attached to the rooftop or the like of the base vehicle 100, which will be described later. The ADK 200 is configured to be detachable from the VP 120. When the ADK 200 is detached, the VP 120 can be manually driven by a user. In this case, the VP 120 executes driving control in manual mode.

[0020] The ADK 200 includes an autonomous driving system (hereinafter referred to as "ADS (Autonomous Driving System)") 202 for autonomously driving the vehicle 10. The ADS 202 creates a driving plan for the vehicle 10 and outputs various commands (control requests) to the VP 120 for driving the vehicle 10 in accordance with the created driving plan, in accordance with an API (Application Program Interface) defined for each command. The ADS 202 receives various signals indicating the state of the VP 120 (vehicle state) from the VP 120 in accordance with the API defined for each signal, and reflects the received vehicle state in creating the driving plan.

[0021] The VP 120 includes a base vehicle 100 and a vehicle control interface box (hereinafter referred to as a "VCIB (Vehicle Control Interface Box)") 111 that is provided in the base vehicle 100 and that realizes a vehicle control interface.

[0022] The VCIB 111 can communicate with the ADK 200 via a CAN (Controller Area Network) or the like. The VCIB 111 executes a predetermined API defined for each communicated signal to receive various commands from the ADK 200 and also outputs the status of the VP 120 to the ADK 200. That is, when the VCIB 111 receives a control request from the ADK 200, it outputs a control command corresponding to the control request to a system corresponding to the control command via the integrated control manager 115. The VCIB 111 also acquires various pieces of information about the base vehicle 100 from various systems via the integrated control manager 115 and outputs the status of the base vehicle 100 to the ADK 200 as a vehicle status.

[0023] The VP 120 includes various systems and sensors for controlling the base vehicle 100. The VP 120 executes various vehicle controls in accordance with control requests from the ADK 200 (specifically, the ADS 202), thereby performing automatic driving of the vehicle 10. The VP 120 includes, for example, a brake system 121, a steering system 122, a powertrain system 123, an active safety system 125, and a body system 126.

[0024] The brake system 121 is configured to be able to control a plurality of braking devices provided on each wheel of the base vehicle 100. The braking devices include, for example, a disc brake system that operates using hydraulic pressure adjusted by an actuator.

[0025] Wheel speed sensors 127A and 127B, for example, are connected to the brake system 121. Wheel speed sensor 127A is provided, for example, on the front wheels of base vehicle 100 and detects the rotational speed of the front wheels. Wheel speed sensor 127A outputs the rotational speed of the front wheels to brake system 121. Wheel speed sensor 127B is provided, for example, on the rear wheels of base vehicle 100 and detects the rotational speed of the rear wheels. Wheel speed sensor 127B outputs the rotational speed of the rear wheels to brake system 121. Brake system 121 outputs the rotational speed of each wheel to VCIB 111 as one piece of information included in the vehicle state.

[0026] The brake system 121 generates a braking command for the braking device in accordance with a predetermined control request output from the ADK 200 via the VCIB 111 and the integrated control manager 115, and controls the braking device using the generated braking command.

[0027] The steering system 122 is configured to be able to use a steering device to control the steering angle of the steering wheels of the vehicle 10. The steering device includes, for example, a rack and pinion type EPS (Electric Power Steering) that is capable of adjusting the steering angle using an actuator.

[0028] A pinion angle sensor 128 that detects the rotation angle (pinion angle) of a pinion gear connected to a rotation shaft of an actuator that constitutes a steering device is connected to the steering system 122. The steering system 122 outputs the detected pinion angle to the VCIB 111 as one piece of information included in the vehicle state.

[0029] The steering system 122 generates a steering command for the steering device in accordance with a predetermined control request (steering request) output from the ADK 200 via the VCIB 111 and the integrated control manager 115, and controls the steering device using the generated steering command.

[0030] The powertrain system 123 controls an EPB (Electric Parking Brake) provided on at least one of the multiple wheels provided on the vehicle 10, a parking lock (hereinafter referred to as P-Lock) device provided on the transmission of the vehicle 10, a shift device configured to be able to select one of multiple shift ranges, and the drive source of the vehicle 10.

[0031] The active safety system 125 uses a camera 129A and radar sensors 129B, 129C to detect obstacles (obstacles or people) in front or behind the vehicle, and if it determines that there is a possibility of a collision based on the distance to the obstacle or the direction of movement of the vehicle 10, it outputs a braking command to the brake system 121 via the integrated control manager 115 to increase the braking force.

[0032] The body system 126 is configured to be able to control components such as turn signals, a horn, or wipers in accordance with the driving state or driving environment of the vehicle 10. The body system 126 controls the above-mentioned components in accordance with a predetermined control request output from the ADK 200 via the VCIB 111 and the integrated control manager 115.

[0033] Vehicle 10 may be employed as one component of a MaaS (Mobility as a Service) system. In addition to vehicle 10, the MaaS system may further include, for example, a data server, a Mobility Service Platform (MSPF), and an autonomous driving-related mobility service (none of which are shown).

[0034] Vehicle 10 further includes a DCM (Data Communication Module) (not shown) as a communication I / F (interface) for wireless communication with the data server described above. The DCM outputs various vehicle information, such as speed, position, and autonomous driving status, to the data server. The DCM also receives various data for managing the travel of autonomously driven vehicles, including vehicle 10, from the mobility service via the MSPF and the data server, for example, in an autonomous driving-related mobility service.

[0035] 2 is a diagram for explaining in detail the configuration of the ADS 202, the VCIB 111, and the VP 120. As shown in FIG. 2, the ADS 202 includes a computer assembly (hereinafter referred to as "CA") 210, an HMI (Human Machine Interface) 230, a recognition sensor 260, an attitude sensor 270, and a sensor cleaner 290.

[0036] During autonomous driving of the vehicle 10, the CA 210 acquires information about the environment around the vehicle, the vehicle's attitude, behavior, and position using various sensors described below, and also acquires the vehicle state from the VP 120 described below via the VCIB 111 to set the next operation of the vehicle 10 (such as acceleration, deceleration, or turning). The CA 210 outputs various commands to the VCIB 111 to realize the set next operation of the vehicle 10. The CA 210 includes computer modules for autonomous driving (hereinafter referred to as "ADC") 210A and 210B. In this embodiment, "ADC 210A" and "ADC 210B" correspond to the "first autonomous driving device" and the "second autonomous driving device," respectively. Each of the ADCs 210A and 210B is configured to be able to communicate with the VCIB 111.

[0037] The HMI 230 presents information to the user and accepts operations during autonomous driving, during driving requiring user operation, or during transition between autonomous driving and driving requiring user operation. The HMI 230 is configured to be connectable to input / output devices such as a touch panel display provided on the base vehicle 100, a display device, and an operation device.

[0038] The recognition sensor 260 includes a sensor for recognizing the environment around the vehicle 10, and is configured by, for example, at least one of a LIDAR (Laser Imaging Detection and Ranging), a millimeter wave radar, and a camera.

[0039] LIDAR is a distance measurement device that emits pulsed laser light (infrared light) and measures distance based on the time it takes for the light to reflect off an object and return. Millimeter-wave radar is a distance measurement device that emits short-wavelength radio waves toward an object and detects the radio waves returning from the object to measure the distance and direction to the object. The camera is placed, for example, behind the rearview mirror inside the vehicle and is used to capture images of the area ahead of the vehicle. Information acquired by the recognition sensor 260 is output to the CA 210. Image processing of the images and videos captured by the camera using artificial intelligence (AI) and an image processing processor enables the vehicle 10 to recognize other vehicles, obstacles, or people ahead.

[0040] The attitude sensor 270 includes a sensor that detects the attitude, behavior, or position of the vehicle 10, and is configured by, for example, an IMU (Inertial Measurement Unit) or a GPS (Global Positioning System).

[0041] The IMU detects, for example, acceleration in the longitudinal, lateral, and vertical directions of the vehicle, and angular velocities in the roll, pitch, and yaw directions of the vehicle 10. The GPS detects the position of the vehicle 10 using information received from multiple GPS satellites orbiting the Earth. The information acquired by the attitude sensor 270 is output to the CA 210.

[0042] Sensor cleaner 290 is configured to remove dirt that adheres to various sensors while the vehicle is traveling. For example, sensor cleaner 290 removes dirt from camera lenses, laser and radio wave emitting parts, etc., using cleaning fluid, wipers, etc.

[0043] The VCIB111 includes VCIB111A and VCIB111B. "VCIB111A" and "VCIB111B" correspond to the "first control device" and the "second control device," respectively. The VCIB111A and VCIB111B incorporate a central processing unit (CPU) and memory (including, for example, read-only memory (ROM) and random access memory (RAM)) (not shown). The VCIB111A has the same functions as the VCIB111B, but the connections to the multiple systems that make up the VP120 are partially different.

[0044] The VCIB 111A and the VCIB 111B are communicably connected to the ADC 210A and the ADC 210B, respectively, of the CA 210. Furthermore, the VCIB 111A and the VCIB 111B are communicably connected to each other.

[0045] Each of the VCIBs 111A and 111B relays various commands corresponding to control requests from the ADS 202 and outputs them as control commands to the corresponding systems of the VP 120. More specifically, each of the VCIBs 111A and 111B uses information such as programs stored in memory (for example, APIs) to generate control commands used to control the corresponding systems of the VP 120 using various command commands output from the ADS 202, and outputs the control commands to the corresponding systems. Each of the VCIBs 111A and 111B also relays vehicle information output from each system of the VP 120 and outputs it to the ADS 202 as a vehicle status. Note that the information indicating the vehicle status may be the same information as the vehicle information, or may be information extracted from the vehicle information to be used in processing executed by the ADS 202.

[0046] By providing VCIB111A and VCIB111B, which have equivalent functions for the operation of some systems (for example, braking and steering), the control system between ADS202 and VP 120 is made redundant. Therefore, when a failure occurs in part of the system, the function of VP 120 (turning, stopping, etc.) can be maintained by switching the control system as appropriate or by shutting off the control system where the failure occurred.

[0047] The brake system 121 includes brake systems 121A and 121B. The steering system 122 includes steering systems 122A and 122B. The powertrain system 123 includes an EPB system 123A, a P-Lock system 123B, and a propulsion system 124. The VCIB 111A, and among the multiple systems of the VP 120, the brake system 121A, the steering system 122A, the EPB system 123A, the P-Lock system 123B, the propulsion system 124, and the body system 126 are connected to each other via a communication bus so as to be able to communicate with each other. Furthermore, the VCIB 111B, and among the multiple systems of the VP 120, the brake system 121B, the steering system 122B, and the P-Lock 123B are connected to each other via a communication bus so as to be able to communicate with each other.

[0048] Both brake systems 121A and 121B are configured to be able to control multiple braking devices provided on each wheel of the vehicle. Brake system 121A may have the same function as brake system 121B, or, for example, one of them may be configured to be able to independently control the braking force of each wheel when the vehicle is traveling, and the other may be configured to be able to control so that the same braking force is generated on each wheel when the vehicle is traveling.

[0049] The brake systems 121A and 121B generate braking commands for the brake devices in accordance with control requests output from the ADS 202 via the VCIB 111A and VCIB 111B, respectively. Either of the brake systems 121A and 121B is used to control the brake devices, and if an abnormality occurs in one of the brake systems, the other is used to control the brake device.

[0050] Both the steering systems 122A and 122B are configured to be able to use a steering device to control the steering angle of the steering wheels of the vehicle 10. The steering system 122A has similar functions as the steering system 122B.

[0051] The steering systems 122A and 122B generate steering commands for the steering devices in accordance with control requests output from the ADS 202 via the VCIB 111A and VCIB 111B, respectively. Either of the steering systems 122A and 122B is used to control the steering devices, and if an abnormality occurs in one of the steering systems, the other is used to control the steering device.

[0052] The EPB system 123A is configured to be able to control the EPB. The EPB fixes the wheels by operating the actuator. The EPB system 123A controls the EPB in accordance with a control request output from the ADS 202 via the VCIB 111A.

[0053] The P-Lock system 123B is configured to be able to control the P-Lock device. The P-Lock system 123B controls the P-Lock device in accordance with a control request output from the ADS 202 via the VCIB 111A. For example, the P-Lock system 123B activates the P-Lock device when the control request output from the ADS 202 via the VCIB 111A includes a control request to change the shift range to parking range (hereinafter referred to as P range), and deactivates the P-Lock device when the control request includes a control request to change the shift range to a range other than P range.

[0054] The propulsion system 124 is configured to be capable of switching the shift range using a shift device and to be capable of controlling the driving force of the vehicle 10 in the direction of movement of the vehicle 10 using a driving source. The switchable shift ranges include, for example, a P range, a neutral range (hereinafter referred to as an N range), a forward driving range (hereinafter referred to as a D range), and a reverse driving range (hereinafter referred to as an R range). The driving source includes, for example, a motor generator, an engine, etc.

[0055] The propulsion system 124 controls the shift device and the drive source in accordance with the control request output from the ADS 202 via the VCIB 111A. For example, when the control request output from the ADS 202 via the VCIB 111A includes a control request to change the shift range to P range, the propulsion system 124 controls the shift device so that the shift range is set to P range.

[0056] The active safety system 125 is communicatively connected to the brake system 121A. The active safety system 125 includes a pre-crash safety system (PCS) 125A and a front camera module (FCM) 125B configured by a camera 129A and a radar sensor 129B. As described above, the PCS 125A detects obstacles, etc. (obstacles or people) ahead using the camera 129A and the radar sensor 129B, and when predicting the possibility of a collision based on the distance to the obstacle, etc., outputs a braking command to the brake system 121A to increase the braking force to avoid the collision. The PCS 125A corresponds to a "vehicle control device." Note that the active safety system 125 (PCS 125A) may be communicatively connected to the VCIB 111A via the brake system 121A, for example, or may be communicatively connected directly.

[0057] The body system 126 controls components such as a turn signal, a horn, or a wiper in accordance with a control request output from the ADS 202 via the VCIB 111A.

[0058] Note that an operating device that allows a user to manually operate the above-mentioned braking device, steering device, EPB, P-Lock device, shift device, drive source, etc. may be provided separately. The brake system 121, steering system 122, and propulsion system 124 constitute the VSC 100A.

[0059] The various commands corresponding to the control requests output from ADS202 to VCIB111 include a propulsion direction command requesting a change in the shift range, a stationary command requesting activation or deactivation of the EPB or P-Lock device, an acceleration command requesting acceleration or deceleration of the vehicle 10, a tire turning angle command requesting the tire turning angle of the steering wheels, a vehicle mode command requesting a change in the vehicle mode state between the automatic driving mode and the manual mode, and a stop command requesting the vehicle to be held stationary or the vehicle to be released from the stationary state.

[0060] In the vehicle 10 described above, when the autonomous driving mode is selected as the vehicle mode state by a user's operation on the HMI 230, autonomous driving is performed. As described above, during autonomous driving, the ADS 202 first creates a driving plan. The driving plan includes a plurality of plans related to the operation of the vehicle 10, such as a plan to continue driving straight, a plan to turn left or right at a predetermined intersection along a predetermined driving route, or a plan to change the driving lane to a lane different from the lane in which the vehicle is driving.

[0061] The ADS202 extracts control physical quantities (e.g., acceleration or deceleration, tire turning angle, etc.) necessary for the vehicle 10 to operate in accordance with the created driving plan. The ADS202 divides the physical quantities for each execution cycle of the API. The ADS202 executes the API using the divided physical quantities and outputs various commands to the VCIB111. Furthermore, the ADS202 acquires vehicle states (e.g., the actual moving direction of the vehicle 10, the vehicle's immobilization state, etc.) from the VP120 and recreates a driving plan that reflects the acquired vehicle states. In this way, the ADS202 enables autonomous driving of the vehicle 10. Note that when predetermined conditions are met, the ADS202 outputs a stop command (hereinafter referred to as a PCS stop command) to the base vehicle 100 via the VCIB111 to stop the operation of the PCS125A, which operates independently of autonomous driving. The predetermined conditions may include, for example, a condition that autonomous driving is being executed.

[0062] The ADS202 mounted on such a vehicle 10 is provided with ADCs 210A and 210B for redundancy, which enable autonomous driving as described above. Therefore, for example, if a communication error occurs with the VCIB 111A on the vehicle side while autonomous driving is being performed using the ADC210A, autonomous driving can be continued using the ADC210B. If a communication error occurs with the ADC210A, the VCIB 111A outputs an instruction to execute evacuation traveling using the ADC210B and the VCIB 111B to the base vehicle 100 and the VCIB 111B.

[0063] However, when the ADC 210A in which an abnormality occurred recovers from the abnormal state by restarting, a command related to autonomous driving may be output from the ADC 210A based on information acquired after the restart. If the information acquired after the restart is not necessary or sufficient for continuing autonomous driving, a command with low reliability will be output, and it is necessary to appropriately handle such a command with low reliability.

[0064] Therefore, in this embodiment, the VCIB 111A does not accept a predetermined command (for example, a PCS stop command) from the ADC 210A even when the ADC 210A recovers from the abnormality.

[0065] In this way, even if the ADC 210A recovers from an abnormality during evacuation travel and outputs a predetermined command to the VP 120, the VCIB 111A can be prevented from accepting the command from the ADC 210A. Therefore, it is possible to prevent the vehicle from being controlled based on an unreliable command from the ADC 210A that has recovered from an abnormality.

[0066] The processing executed by the VCIB 111A will be described below with reference to Fig. 3. Fig. 3 is a flowchart showing an example of the processing executed by the VCIB 111A. For example, the VCIB 111A repeatedly executes the following processing at each execution cycle of the API.

[0067] In step (hereinafter, step will be abbreviated as S) 100, the VCIB 111A determines whether or not a communication abnormality has occurred with the ADC 210A. For example, if the VCIB 111A does not receive any signals from the ADC 210A for a predetermined period of time, the VCIB 111A determines that the communication with the ADC 210A is abnormal. If it is determined that an abnormality has occurred in the communication with the ADC 210A (YES in S100), the process proceeds to S102.

[0068] In S102, the VCIB 111A outputs a switching command. For example, the VCIB 111A outputs a switching command to each of the VSC 100A and the VCIB 111B to switch the control entity from the VCIB 111A to the VCIB 111B. At this time, if the VCIB 111B receives a command to perform evacuation running from the ADC 210B due to an abnormality in communication between the ADC 210A and the VCIB 111A, the VCIB 111B controls the VSC 100 to perform evacuation running. The evacuation running may include, for example, control to adjust the braking force and acceleration to stop the vehicle 10, or control to adjust the braking force and acceleration to stop the vehicle 10 while steering the vehicle 10 to pull over to the shoulder of the road, or control to operate the EPB 123A or the P-Lock device 123B to restrict the movement of the vehicle 10 after the vehicle has stopped. Then, the process proceeds to S104.

[0069] In S104, the VCIB 111A determines whether or not a PCS stop command has been received from the ADC 210A. For example, if the ADC 210A determines that communication with the VCIB 111A is abnormal, it performs restart processing. If the ADC 210A determines that communication with the VCIB 111A is restored after restarting and that a predetermined condition (for example, a condition that automatic driving is being performed) is met, the ADC 210A outputs a PCS stop command to the VCIB 111A. If the PCS stop command has been received from the ADC 210A and it is determined that a PCS stop command has been received (YES in S104), the process proceeds to S106.

[0070] In S106, the VCIB 111A determines whether the current trip is the same trip as when the abnormality occurred. For example, if the IG has not been turned off between the time when the abnormality occurred and the present time during system startup, the VCIB 111A determines that the current trip is the same trip as when the abnormality occurred. If it is determined that the current trip is the same trip as when the abnormality occurred (YES in S106), the process proceeds to S108.

[0071] In S108, the VCIB 111A invalidates the PCS stop command received from the ADC 210A. For example, the VCIB 111A does not accept the PCS stop command received from the ADC 210A and does not output the PCS stop command to the PCS 125A. Then, the process ends. Note that if it is determined that the current trip is not the same trip as when the abnormality occurred (NO in S106), the process proceeds to S110.

[0072] In S110, the VCIB 111A outputs a PCS stop command to the PCS 125A. Upon receiving the PCS stop command, the PCS 125A stops vehicle travel control by the PCS 125A. The process then ends. If it is determined that there is no abnormality in communication with the ADC 210A (NO in S100), the process proceeds to S104. Furthermore, if the PCS stop command is not received from the ADC 210A (NO in S104), this process ends.

[0073] The operation of the VCIB 111A based on the above-described structure and flowchart will be described with reference to Fig. 4. Fig. 4 is a diagram for explaining an example of the operation of the VCIB 111A.

[0074] Hereinafter, it is assumed that an abnormality occurs in communication between the ADC 210A and the VCIB 111A during automatic driving, as shown in FIG. 4(A).

[0075] When it is determined that an abnormality has occurred in the communication between the ADC 210A and the VCIB 111A (YES in S100), a switch command to switch the control entity from the VCIB 111A to the VCIB 111B is output to the VSC 100A and the VCIB 111B (S102), as shown in (B) and (C) of FIG. 4. When the ADC 210B acquires information about the communication abnormality between the ADC 210A and the VCIB 111A from the ADC 210A, it outputs a command to execute evacuation travel (evacuation command) to the VCIB 111B, as shown in (D) of FIG. When the VCIB 111B receives the evacuation command, the VCIB 111B executes evacuation control on the VSC 100A, and the vehicle 10 executes evacuation travel, as shown in (E) of FIG. When it is determined that an abnormality has occurred in the communication with the VCIB 111A, the ADC 210A executes a restart process. After restarting, if the ADC 210A determines that the predetermined condition is met, it outputs a PCS stop command to the VCIB 111A, as shown in (G) of Fig. 4. If the PCS stop command is received from the ADC 210A (YES in S104) and the trip is the same as the one that occurred when the abnormality occurred (YES in S106), the PCS stop command is invalidated, as shown in (H) of Fig. 4. In other words, the PCS stop command is not accepted (S108), and stopping of the vehicle 10 by the PCS 125A is inhibited.

[0076] As described above, in the vehicle 10 according to the present embodiment, during normal autonomous driving, vehicle control by the PCS 125A is stopped in response to a PCS stop command from the ADC 210A, thereby suppressing interference with autonomous driving. Furthermore, in the case where a communication abnormality occurs between the ADC 210A and the VCIB 111A and evacuation driving is performed, if the ADC 210A recovers from the abnormality during evacuation driving and outputs a PCS stop command to the VP 120, the VCIB 111A can be prevented from accepting commands from the ADC 210A. This prevents the vehicle from being controlled based on unreliable commands from the ADC 210A that has recovered from the abnormality. Therefore, it is possible to provide a vehicle that performs appropriate control when communication with the autonomous driving system recovers from an abnormal state.

[0077] Modifications will be described below. In the above-described embodiment, the control of vehicle 10 by PCS125A has been described as an example of control of vehicle 10 that is performed independently of automatic driving, but this is not limited to control of vehicle 10 by PCS125A, and may be other vehicle control that can be performed independently of automatic driving and is stopped during automatic driving.

[0078] Furthermore, in the above embodiment, the PCS stop command is invalidated if the trip is the same as when the abnormality occurred, but after the abnormality occurs, the PCS stop command may be invalidated even if the trip is different.

[0079] The above-described modifications may be implemented in whole or in part in appropriate combination. The embodiments disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0080] 10 vehicles, 100 base vehicles, 111,111A,111B VCIB, 115 integrated control manager, 120 VP, 200 ADK.

Claims

1. An autonomous driving system that automatically drives a vehicle; a vehicle platform capable of receiving commands related to the autonomous driving from the autonomous driving system; the vehicle platform includes a base vehicle and a vehicle control interface that interfaces between the vehicle platform and the automated driving system; the vehicle control interface includes a first control device and a second control device; The automated driving system includes a first automated driving device that outputs a command to the base vehicle via the first control device, and a second automated driving device that outputs a command to the base vehicle via the second control device when an abnormality occurs in the first automated driving device, When an abnormality occurs in the first automatic driving device, an instruction to execute evacuation traveling using the second automatic driving device and the second control device is output to the base vehicle, A vehicle in which the first control device does not accept a predetermined command from the first automatic driving device even when the first automatic driving device recovers from an abnormality.

2. the base vehicle includes a vehicle control device that controls equipment of the vehicle independently of commands from the autonomous driving system; The vehicle described in claim 1, wherein the first automatic driving device outputs a stop command to the base vehicle via the first control device requesting that control of the vehicle using the vehicle control device be stopped while the automatic driving is being performed.

3. The vehicle according to claim 2 , wherein the vehicle control device controls the vehicle to avoid a collision of the vehicle when a state in which a collision of the vehicle is predicted occurs.

4. A vehicle as described in any one of claims 1 to 3, wherein the first control device does not accept commands from the first automatic driving device if the first automatic driving device is in a trip that includes the time when the abnormality occurred, even if the first automatic driving device has recovered from the abnormality.

Images