Vehicle platform, vehicle control interface box, and autonomous driving system

Abstract

To enable appropriate automatic driving even when a failure point exists in a vehicle.SOLUTION: The VP20 is configured such that a ADS11 can be mounted thereon. The VP20 includes a base car 30 and a VCIB40. The VCIB40 includes a VCIB40A that interfaces between the base vehicles 30 and the ADS11 through a communication bus 43, and a VCIB40B that interfaces between the base vehicles 30 and the ADS11 through a communication bus 44. The circuits VCIB40A and VCIB40B output signals S1 and S2, respectively. The signal S1 indicates the status of whether or not a fault relating to the functioning of the autonomous mode in VP20 has occurred. The signal S2 indicates the status of the in-vehicle system according to the failure point in the VP20. The on-board system is a wheel lock control system 340, a directional control system 344, or a propulsion system 345.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to a vehicle platform, a vehicle control interface box, and an automated driving system. [Background technology]

[0002] Japanese Patent Laid-Open Publication No. 2018-132015 (Patent Document 1) discloses a vehicle equipped with an autonomous driving system that comprehensively controls the autonomous driving of the vehicle (see Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-132015 Summary of the Invention [Problem to be solved by the invention]

[0004] It is conceivable that an autonomous driving system developed by an autonomous driving system provider may be externally installed on a vehicle. In this case, the vehicle is automatically driven according to commands from the external autonomous driving system. In such a vehicle, the interface of various requests and signals exchanged between the external autonomous driving system and the vehicle is important. The requests and signals are interfaced, for example, by a vehicle control interface box. The vehicle control interface box may include a main vehicle interface box and a sub-vehicle interface box.

[0005] If a fault exists in the vehicle, it is preferable for the automated driving system to determine the fault and send a request to the vehicle. On the other hand, if the automated driving system is unable to determine the fault, it may not be able to properly send a request to the vehicle. For example, if a fault exists on a communication path to a specific in-vehicle system related to automated driving, the request (command) from the automated driving system may disappear on the communication path and may not be able to reach the in-vehicle system. As a result, automated driving may not be properly performed according to the request from the automated driving system.

[0006] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a vehicle, a vehicle control interface box, and an autonomous driving system that enable appropriate autonomous driving even when a fault point exists in the vehicle. [Means for solving the problem]

[0007] A vehicle platform of the present disclosure is configured to be capable of mounting an autonomous driving system. The vehicle platform includes a vehicle and a vehicle control interface box. The vehicle control interface box interfaces between the vehicle and the autonomous driving system via a main bus and a sub-bus. The vehicle includes an on-board system connected to the vehicle control interface box. The vehicle control interface box includes a main vehicle control interface box that interfaces between the vehicle and the autonomous driving system via the main bus, and a sub-vehicle control interface box that interfaces between the vehicle and the autonomous driving system via the sub-bus. The main vehicle control interface box and the sub-vehicle control interface box each output a first signal and a second signal. The first signal indicates a fault related to the functionality of the autonomous mode in the vehicle platform. The second signal indicates the status of an on-board system depending on the fault point in the vehicle platform, the on-board system being the wheel lock control system, the directional control system or the propulsion system of the vehicle.

[0008] The first signal indicates a status (first status) of whether or not a fault has occurred, and the second signal indicates a status (second status) of the in-vehicle system. These statuses change depending on the location of the fault point. With the above configuration, the first and second signals from the main vehicle control interface box and the first and second signals from the sub-vehicle control interface box are input to the automated driving system. As a result, the automated driving system is notified of the first and second statuses indicated by the first and second signals, respectively, from the main vehicle control interface box and the first and second statuses indicated by the first and second signals, respectively, from the sub-vehicle control interface box. As a result, the automated driving system can determine the location of the fault point according to these four statuses and can appropriately send a request to the vehicle according to the result of this determination. Therefore, automated driving can be performed appropriately even if a fault point exists in the vehicle.

[0009] In one aspect, the on-board system is a wheel immobilization control system. The wheel immobilization control system includes an electric parking brake system and a parking lock system of the vehicle. The parking lock system is connected to the sub-vehicle control interface box. The status of the wheel immobilization control system indicated by the second signal includes a loss of function of the wheel immobilization control system, a degraded operation of the electric parking brake system, and a degraded operation of the parking lock system.

[0010] In one aspect, the vehicle further includes a motion control unit that communicates with each of the main vehicle control interface box, the sub-vehicle control interface box, the electric parking brake system, and the parking lock system. The main vehicle control interface box is configured to be able to communicate with each of the electric parking brake system and the parking lock system through the motion control unit. The status of the wheel immobilization control system indicated by the second signal output by the main vehicle control interface box is a loss of function if a fault exists on the communication path between the main vehicle control interface box and the motion control unit or in the motion control unit; a degraded operation of the parking lock system if the fault exists on the communication path between the motion control unit and the parking lock system or in the parking lock system; and a degraded operation of the electric parking brake system if the fault exists in the electric parking brake system.

[0011] In one aspect, the vehicle further includes a motion control unit that communicates with each of the main vehicle control interface box, the sub-vehicle control interface box, the electric parking brake system, and the parking lock system. The sub-vehicle control interface box is configured to be able to communicate with each of the electric parking brake system and the parking lock system through the motion control unit. The status of the wheel immobilization control system indicated by the second signal output by the sub-vehicle control interface box is a degraded operation of the electric parking brake system if the fault point is in the motion control unit, on the communication path between the sub-vehicle control interface box and the motion control unit, or in the electric parking brake system, and is a degraded operation of the parking lock system if the fault point is in the parking lock system or on the communication path between the sub-vehicle control interface box and the parking lock system.

[0012] The vehicle control interface box of the present disclosure is a main bus and a communication bus between a vehicle included in a vehicle platform configured to be able to mount an autonomous driving system and the autonomous driving system. The vehicle includes an on-board system connected to a vehicle control interface box. The vehicle control interface box includes a main vehicle control interface box that interfaces between the vehicle and the automated driving system through the main bus, and a sub-vehicle control interface box that interfaces between the vehicle and the automated driving system through the sub-bus. Each of the main vehicle control interface box and the sub-vehicle control interface box outputs a first signal and a second signal. The first signal indicates a status of whether or not a fault has occurred in the vehicle platform related to the functionality of the autonomous mode. The second signal indicates a status of the on-board system according to a fault point in the vehicle platform. The on-board system is a wheel lock control system, a directional control system, or a propulsion system of the vehicle.

[0013] The autonomous driving system of the present disclosure is configured to be mountable on a vehicle platform. The vehicle platform includes a vehicle and a vehicle control interface box. The vehicle control interface box interfaces between the vehicle and the autonomous driving system via a main bus and a sub-bus. The vehicle includes an on-board system connected to the vehicle control interface box. The vehicle control interface box includes a main vehicle control interface box that interfaces between the vehicle and the autonomous driving system via the main bus, and a sub-vehicle control interface box that interfaces between the vehicle and the autonomous driving system via the sub-bus. The main vehicle control interface box and the sub-vehicle control interface box each output a first signal and a second signal. The first signal indicates a status of whether or not a fault has occurred in the vehicle platform related to the functionality of the autonomous mode. The second signal indicates a status of the on-board system according to a fault point in the vehicle platform. The on-board system is a wheel lock control system, a direction control system, or a propulsion system of the vehicle. The autonomous driving system includes a computer, a first communication module, and a second communication module. The first communication module communicates with the main vehicle control interface box. The second communication module communicates with the sub-vehicle control interface box. The computer is programmed to receive the first and second signals of the main vehicle control interface box from the main vehicle control interface box through the first communication module, and to receive the first and second signals of the sub-vehicle control interface box from the sub-vehicle control interface box through the second communication module. [Effects of the Invention]

[0014] According to the present disclosure, automatic driving can be performed appropriately even when a fault exists in a vehicle. [Brief explanation of the drawings]

[0015] [Figure 1]1 is a diagram showing an overview of a vehicle according to an embodiment; [Figure 2] FIG. 2 is a diagram showing in detail the configuration of an ADS (Autonomous Driving System), a VCIB (Vehicle Control Interface Box), and a VP (Vehicle Platform) according to an embodiment. [Figure 3] FIG. 4 is a diagram illustrating a signal flow related to wheel fixing control. [Figure 4] FIG. 2 is a diagram schematically showing data stored in a memory of a VCIB in an embodiment. [Figure 5] FIG. 2 is a diagram schematically showing data stored in a memory of a VCIB in an embodiment. [Figure 6] FIG. 2 is a diagram schematically illustrating data stored in a memory of an ADS according to an embodiment. [Figure 7] 10 is a flowchart illustrating a procedure of a process executed in relation to determining a fault point in an embodiment. [Figure 8] FIG. 2 is a diagram illustrating a signal flow related to vehicle direction control. [Figure 9] FIG. 10 is a diagram schematically showing data stored in a memory of a VCIB in the first modification. [Figure 10] FIG. 10 is a diagram schematically showing data stored in a memory of a VCIB in the first modification. [Figure 11] FIG. 10 is a diagram schematically showing data stored in a memory of an ADS in the first modification. [Figure 12] FIG. 4 is a diagram illustrating a signal flow related to thrust control. [Figure 13] FIG. 10 is a diagram schematically showing data stored in a memory of a VCIB in Modification 2. [Figure 14] FIG. 10 is a diagram schematically showing data stored in a memory of a VCIB in Modification 2. [Figure 15] FIG. 10 is a diagram schematically showing data stored in a memory of an ADS in Modification 2. DETAILED DESCRIPTION OF THE INVENTION

[0016] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals, and description thereof will not be repeated.

[0017] 1 is a diagram illustrating an overview of a vehicle 1 according to an embodiment of the present disclosure. The vehicle 1 includes an autonomous driving kit (ADK) 10 and a vehicle platform 20. The ADK 10 is configured to be attachable to a VP 20 (to be mounted on the vehicle 1). The ADK 10 and the VP 20 are configured to be able to communicate with each other via a vehicle control interface (a VCIB 40, described later).

[0018] The VP20 can perform automatic driving in accordance with control requests from the ADK10. Although the ADK10 is shown in a position separate from the VP20 in FIG. 1, the ADK10 is actually attached to the rooftop of the VP20 or the like. The ADK10 can also be detached from the VP20. When the ADK10 is detached, the VP20 performs driving control in manual mode (driving control according to user operation).

[0019] The ADK 10 includes an automatic driving system 11 for performing automatic driving of the vehicle 1. The ADS 11 creates, for example, a driving plan for the vehicle 1. The ADS 11 outputs various control requests for driving the vehicle 1 according to the driving plan to the VP 20 in accordance with an API (Application Program Interface) defined for each control request. The ADS 11 also outputs vehicle status (VP The ADS 11 receives various signals indicating the vehicle status (state of the vehicle 20) from the VP 20 according to the API defined for each signal. The ADS 11 then reflects the vehicle status in the driving plan. The detailed configuration of the ADS 11 is explained in Figure 2.

[0020] The VP 20 includes a base vehicle 30 and a vehicle control interface box 40 . The base vehicle 30 executes various vehicle controls in accordance with control requests from the ADK 10 (ADS 11). The base vehicle 30 includes various on-board systems and sensors for controlling the base vehicle 30. More specifically, the base vehicle 30 includes an integrated control manager 31, a brake system 32, a steering system 33, a powertrain system 34, an active safety system 35, a body system 36, wheel speed sensors 51 and 52, a pinion angle sensor 53, a camera 54, and radar sensors 55 and 56.

[0021] The integrated control manager 31 includes a processor such as a CPU (Central Processing Unit) and memories such as a ROM (Read Only Memory) and a RAM (Random Access Memory), neither of which are shown in the figure, and controls the above-mentioned systems (brake system, etc.) related to the operation of the vehicle 1. It integrates and controls the vehicle's system (stem 32, steering system 33, powertrain system 34, active safety system 35, and body system 36).

[0022] The brake system 32 is configured to control braking devices provided on each wheel of the base vehicle 30. The braking devices include, for example, a disc brake system (not shown) that operates in response to hydraulic pressure adjusted by an actuator.

[0023] Wheel speed sensors 51 and 52 are connected to the brake system 32. The wheel speed sensor 51 detects the rotational speed of the front wheels of the base vehicle 30 and outputs the detected rotational speed of the front wheels to the brake system 32. The wheel speed sensor 52 detects the rotational speed of the rear wheels of the base vehicle 30 and outputs the detected rotational speed of the rear wheels to the brake system 32. The brake system 32 outputs the rotational speed of each wheel to the VCIB 40 as one piece of information included in the vehicle state. In addition, the brake system 32 generates a braking command for the braking device in accordance with a predetermined control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31. The brake system 32 controls the braking device using the generated braking command. The integrated control manager 31 can calculate the speed (vehicle speed) of the vehicle 1 based on the rotational speed of each wheel.

[0024] The steering system 33 is configured to be able to use a steering device to control the steering angle (tire turning angle) of the steering wheels of the vehicle 1. The steering device includes, for example, a rack and pinion type electric power steering (EPS) that can adjust the steering angle using an actuator.

[0025] A pinion angle sensor 53 is connected to the steering system 33. The pinion angle sensor 53 detects the rotation angle (pinion angle) of a pinion gear connected to the rotary shaft of the actuator, and outputs the detected pinion angle to the steering system 33. The steering system 33 outputs the pinion angle to the VCIB 40 as one piece of information included in the vehicle state. In addition, the steering system 33 generates a steering command for the steering device in accordance with a predetermined control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31. The steering system 33 controls the steering device using the generated steering command.

[0026] The powertrain system 34 controls an electric parking brake (EPB) system 341 provided on at least one of the wheels, a parking lock (P-Lock) system 342 provided on the transmission of the vehicle 1, and a propulsion system 343 including a shift device (not shown) configured to be able to select a shift range. A detailed configuration of the powertrain system 34 will be described with reference to FIG. 2.

[0027] The active safety system 35 detects obstacles (pedestrians, bicycles, parked vehicles, utility poles, etc.) in front or behind the vehicle 1 using the camera 54 and radar sensors 55, 56. The active safety system 35 determines whether there is a possibility that the vehicle 1 will collide with the obstacle based on the distance between the vehicle 1 and the obstacle and the direction of movement of the vehicle 1. If the active safety system 35 determines that there is a possibility of a collision, it outputs a braking command to the brake system 32 via the integrated control manager 31 to increase braking force.

[0028] The body system 36 is configured to control components such as turn signals, a horn, and wipers (none of which are shown) in accordance with the driving state or environment of the vehicle 1. The body system 36 controls each of the above components in accordance with a predetermined control request output from the ADS 11 via the VCIB 40 and the integrated control manager 31.

[0029] VCIB40 communicates with ADS11 via CAN (Controller Area Network) etc. The VCIB 40 executes a predetermined API defined for each signal to receive various control requests from the ADS 11 and output the vehicle status to the ADS 11. When the VCIB 40 receives a control request from the ADK 10, it outputs a control command corresponding to the control request to a system corresponding to the control command via the integrated control manager 31. The VCIB 40 also acquires various pieces of information about the base vehicle 30 from various systems via the integrated control manager 31 and outputs the status of the base vehicle 30 to the ADS 11 as the vehicle status.

[0030] The vehicle 1 can be used as one of the components of a MaaS (Mobility as a Service) system. The MaaS system includes, in addition to the vehicle 1, for example, a data server and a Mobility Service Platform (MSPF) (either (also not shown).

[0031] MSPF is a unified platform that connects various mobility services. Autonomous driving-related mobility services will be connected to MSPF. In addition to autonomous driving-related mobility services, mobility services provided by ride-sharing operators, car-sharing operators, rental car operators, taxi operators, insurance companies, etc. can also be connected to MSPF.

[0032] Vehicle 1 is equipped with a DCM (Data Communication Module) that can communicate wirelessly with the data server. (not shown). The DCM outputs vehicle information such as speed, location, and autonomous driving status to the data server. The DCM also receives various data for managing the travel of autonomously driven vehicles, including vehicle 1, from the mobility service via the MSPF and the data server in an autonomous driving-related mobility service.

[0033] MSPF has published APIs for accessing various vehicle status and vehicle control data required for the development of ADS11. Various mobility services can use the APIs published on MSPF to utilize the various functions provided by MSPF according to the content of the service. For example, an autonomous driving-related mobility service can use the APIs published on MSPF to obtain vehicle 1's driving control data and information stored in the data server from MSPF. Furthermore, an autonomous driving-related mobility service can use the above APIs to send data for managing autonomous driving vehicles, including vehicle 1, to MSPF.

[0034] 2 is a diagram showing in detail the configuration of the ADS 11, the VCIB 40, and the VP 20 according to this embodiment. As shown in FIG. 2, the ADS 11 includes a computer 111, an HMI (Human Machine Interface) 112, a recognition sensor 113, an attitude sensor 114, and and a sensor cleaner 115.

[0035] The computer 111 includes a processor 111P such as a CPU, and a memory 111M such as a ROM and RAM. The memory 111M stores programs executable by the processor 111P. During autonomous driving of the vehicle 1, the computer 111 acquires the environment of the vehicle 1, as well as the attitude, behavior, and position of the vehicle 1, using various sensors (described later), and also acquires the vehicle state from the VP 20 via the VCIB 40 to set the next operation of the vehicle 1 (acceleration, deceleration, turning, etc.). The computer 111 outputs various commands to the VCIB 40 to realize the next operation. The computer 111 further includes communication modules (hereinafter also referred to as "VIM (Vehicle Interface Module)") 111A and 111B. Each of the communication modules 111A and 111B is configured to be able to communicate with the VCIB 40. In detail, the communication modules 111A and 111B communicate with the VCIB 40A and 40B, respectively. (see below for details).

[0036] The HMI 112 presents information to the user and accepts user operations during automatic driving, during driving requiring user operation, during transition between automatic driving and driving requiring user operation, etc. The HMI 112 is configured to be connected to an input / output device (not shown), such as a touch panel display, provided on the base vehicle 30, for example.

[0037] The recognition sensor 113 is a sensor for recognizing the environment of the vehicle 1. The recognition sensor 113 is, for example, a LIDAR (Laser Imaging Detection and Ranging) and a millimeter wave The vehicle 1 includes at least one of a radar and a camera (neither of which is shown). The LIDAR measures the distance and direction of an object by emitting, for example, infrared pulsed laser light and detecting the light reflected from the object. The millimeter-wave radar measures the distance and direction of an object by emitting millimeter waves and detecting the millimeter-wave waves reflected from the object. The camera is placed, for example, behind the rearview mirror, and captures an image of the area ahead of the vehicle 1.

[0038] The attitude sensor 114 is a sensor for detecting the attitude, behavior, and position of the vehicle 1. The attitude sensor 114 includes, for example, an IMU (Inertial Measurement Unit) and a GPS (Global Positioning System) (neither of which are shown). The IMU detects, for example, the acceleration in the forward / backward, left / right, and up / down directions of the vehicle 1, and the angular velocities in the roll, pitch, and yaw directions of the vehicle 1. The GPS detects the position of the vehicle 1 using information received from multiple GPS satellites orbiting the Earth.

[0039] The sensor cleaner 115 is configured to remove dirt adhering to the above-mentioned various sensors (camera lenses, laser light irradiation parts, etc.) while the vehicle 1 is traveling, using a cleaning liquid, a wiper, etc.

[0040] The VCIB 40 includes a VCIB 40A (main VCIB) and a VCIB 40B (sub VCIB). Each of the VCIBs 40A and 40B includes a processor such as a CPU and a memory 41 such as a ROM and a RAM, neither of which are shown. The memory 41 stores programs executable by the processor. The memory 41 of the VCIB 40A is also referred to as memory 41A. The memory 41 of the VCIB 40B is also referred to as memory 41B. The VCIB 40A and the communication module 111A are connected to each other via a communication bus 43 (main bus) so that they can communicate with each other. The VCIB 40B and the communication module 111B are connected to each other via a communication bus 44 (sub bus) so that they can communicate with each other. Furthermore, the VCIB 40A and the VCIB 40B are connected to each other so that they can communicate with each other.

[0041] Each of the VCIBs 40A and 40B relays control requests and vehicle information between the ADS11 and the VP 20. The VCIB 40A interfaces between the base vehicle 30 and the ADS11 via a communication bus 43. The VCIB 40B interfaces between the base vehicle 30 and the ADS11 via a communication bus 44. In this way, the VCIB 40 interfaces between the base vehicle 30 and the ADS11 via the communication buses 43 and 44. The VCIBs 40A and 40B use an API to generate control commands from control requests from the ADS11.

[0042] Control commands corresponding to control requests supplied from the ADS 11 to the VCIB 40 include, for example, a propulsion direction command requesting switching of the shift range, a stationary command requesting activation / deactivation of the EPB system 341 and the P-Lock system 342, an acceleration command requesting acceleration or deceleration of the vehicle 1, a tire turning angle command requesting the tire turning angle of the steering wheels, an autonomous command requesting switching between an autonomous mode and a manual mode, and a stop command requesting the vehicle to be held stationary or to be released from the stationary state. Includes:

[0043] The VCIBs 40A and 40B then output the generated control commands to the corresponding systems among the multiple systems included in the VP 20. The VCIBs 40A and 40B also use the API to generate information indicating the vehicle status from the vehicle information from each system of the VP 20. The information indicating the vehicle status may be the same information as the vehicle information, or may be information extracted from the vehicle information that is used for processing executed by the ADS 11. The VCIBs 40A and 40B output the generated information indicating the vehicle status to the ADS 11.

[0044] The brake system 32 includes brake systems 321 and 322. The steering system 33 includes steering systems 331 and 332. The powertrain system 34 includes a wheel immobilization control system 340 and a propulsion system 343.

[0045] Although the VCIB 40A and the VCIB 40B basically have the same functions, there are some differences between the VCIB 40A and the VCIB 40B in the connections to the in-vehicle systems included in the VP 20. Specifically, the VCIB 40A, the brake system 321, the steering system 331, the EPB system 341, the P-Lock system 342, the propulsion system 343, and the body system 36 are interconnected via a communication bus so as to be able to communicate with each other. The VCIB 40B, the brake system 322, the steering system 332, and the P-Lock system 342 are interconnected via a communication bus so as to be able to communicate with each other.

[0046] In this way, the VCIB 40 includes the VCIBs 40A and 40B, which have equivalent functions for some system operations (braking, steering, etc.), making the control system between the ADS 11 and the VP 20 redundant. Therefore, if any failure occurs in the system, the function of the VP 20 can be maintained by appropriately switching the control system or shutting off the control system in which the failure occurred.

[0047] Each of the brake systems 321 and 322 is configured to be able to control a braking device. The brake system 321 generates a braking command for the braking device in accordance with a control request output from the ADS 11 via the VCIB 40A. The brake system 322 generates a braking command for the braking device in accordance with a control request output from the ADS 11 via the VCIB 40B. The brake systems 321 and 322 may have equivalent functions. Alternatively, one of the brake systems 321 and 322 may be configured to be able to independently control the braking force of each wheel, and the other may be configured to be able to control the same braking force for each wheel. For example, the brake systems 321 and 322 may control the braking device using a braking command generated by one of the brake systems, and if an abnormality occurs in the first brake system, the brake system may be controlled using a braking command generated by the other brake system.

[0048] Each of the steering systems 331, 332 is configured to be able to control the steering angle of the steering wheels of the vehicle 1 using a steering device. The steering system 331 generates a steering command for the steering device in accordance with a control request output from the ADS 11 via the VCIB 40A. The steering system 332 generates a steering command for the steering device in accordance with a control request output from the ADS 11 via the VCIB 40B. The steering systems 331 and 332 may have equivalent functions. Alternatively, the steering systems 331, 332 may, for example, control the steering device using a steering command generated by one of the steering systems, and if an abnormality occurs in the steering system, control the steering device using a steering command generated by the other steering system.

[0049] The wheel lock control system 340 is connected to the VCIB 40 and includes an EPB system 341 and a P-Lock system 342 .

[0050] The EPB system 341 controls the EPB in accordance with a control request output from the ADS 11 via the VCIB 40A. The EPB is provided separately from a braking device (such as a disc brake system) and immobilizes the wheels by operating an actuator. For example, the EPB immobilizes the wheels by using an actuator to activate drum brakes for parking brakes provided on some of the wheels, or immobilizes the wheels by operating a braking device using an actuator that is separate from the brake systems 321 and 322 and that can adjust the hydraulic pressure supplied to the braking device. The EPB system 341 has a brake hold function and is configured to be able to switch between activation and release of the brake hold function.

[0051] The P-Lock system 342 is connected to the VCIB 40B. The P-Lock system 342 controls the P-Lock device in accordance with a control request output from the ADS 11 via the VCIB 40A. For example, the P-Lock system 342 activates the P-Lock device when the control request includes a control request to set the shift range to parking range (P range), and deactivates the P-Lock device when the control request includes a control request to set the shift range to a range other than P. The P-Lock device engages a protrusion at the tip of a parking lock pole, the position of which can be adjusted by an actuator, with the teeth of a gear (lock gear) connected to a rotating element in the transmission of the vehicle 1. This fixes the rotation of the output shaft of the transmission, and locks the wheels.

[0052] The propulsion system 343 includes a direction control system 344 and a propulsion system 345. The direction control system 344 is connected to the VCIB 40. The direction control system 344 controls the traveling direction (forward or reverse) of the VP 20 by switching the shift range of the shift device in accordance with a control request output from the ADS 11 via the VCIB 40A. The shift range includes a forward driving range (D range) and a reverse driving range (R range) in addition to a P range and a neutral range (N range). The propulsion system 345 is connected to the VCIB 40. The propulsion system 345 controls the propulsion (e.g., acceleration and deceleration) of the VP 20 by controlling the driving force from a driving source (motor generator, engine, etc.).

[0053] The active safety system 35 is communicatively connected to the brake system 321. As described above, the active safety system 35 detects an obstacle ahead using the camera 54 and / or radar sensor 55, and outputs a braking command to the brake system 321 to increase the braking force if it determines that there is a possibility of a collision.

[0054] The body system 36 controls components such as turn signals, a horn, and wipers in accordance with control requests output from the ADS 11 via the VCIB 40A.

[0055] In the vehicle 1, automatic driving is performed when an autonomous mode (automated driving mode) is selected by, for example, a user's operation on the HMI 112. As described above, during automatic driving, the ADS 11 first creates a driving plan. Examples of driving plans include a plan to continue driving straight, a plan to turn left / right at a predetermined intersection along a predetermined driving route, and a plan to change driving lanes. The ADS 11 calculates control physical quantities (acceleration, deceleration, tire turning angle, etc.) required for the vehicle 1 to operate according to the created driving plan. The ADS 11 divides the physical quantities for each execution cycle of the API. The ADS 11 uses the API to output a control request representing the divided physical quantities to the VCIB 40. Furthermore, the ADS 11 acquires the vehicle state (the actual moving direction of the vehicle 1, the state of immobilization of the vehicle, etc.) from the VP 20 and recreates a driving plan that reflects the acquired vehicle state. In this way, ADS11 enables vehicle 1 to drive autonomously.

[0056] If a fault exists in the base vehicle 30, the ADS 11 preferably determines the fault and transmits a control request to the VP 20. The fault is the location of the fault. If the autonomous driving system cannot determine the fault, it may not be able to properly transmit a control request to the VP 20. For example, if a fault exists on the communication path to an on-board system related to autonomous driving (e.g., the wheel lock control system 340, the direction control system 344, or the propulsion system 345), a control command based on the control request may be lost on the communication path and may not reach the on-board system. As a result, autonomous driving may not be properly performed in accordance with the control request from the autonomous driving system. To avoid this situation, the ADS 11 preferably determines whether to transmit a control request to the VP 20 via the communication bus 43 or the communication bus 44 based on the location of the fault when a fault occurs.

[0057] The VCIB 40 and the ADS 11 according to the embodiment have a configuration for avoiding the above situation. Specifically, each of the VCIB 40A and the VCIB 40B outputs a signal S1 and a signal S2 to the ADS 11 based on whether or not a fault exists in the VP 20. The computer 111 (more specifically, the processor 111P) is programmed to receive the signal S1 and the signal S2 of the VCIB 40A from the VCIB 40A via the communication module 111A, and to receive the signal S1 and the signal S2 of the VCIB 40B from the VCIB 40B via the communication module 111B.

[0058] The signal S1 indicates a status (first status) of whether or not a fault has occurred in the VP 20 related to the functionality of the autonomous mode. The signal S2 indicates a status (second status) of the in-vehicle system depending on the fault point in the VP 20. The signals S1 and S2 of the VCIB 40A are also referred to as signals S1A and S2A, respectively. The signals S1 and S2 of the VCIB 40B are also referred to as signals S1B and S2B, respectively. The first status changes depending on the location of the fault point and whether it is indicated by the signal S1A or S1B. The second status changes depending on the location of the fault point and whether it is indicated by the signal S2A or S2B.

[0059] When VCIBs 40A and 40B output signals S1 and S2, signals S1A and S2A and signals S1B and S2B are input to ADS11. This notifies ADS11 of the first and second statuses indicated by signals S1A and S2A, respectively, and the first and second statuses indicated by signals S1B and S2B, respectively. As a result, ADS11 can determine the location of the fault point according to these four statuses. Based on the location of the fault point, ADS11 can then appropriately determine whether to send a control request to VP20 via communication bus 43 or communication bus 44, thereby appropriately sending the control request to VP20. Therefore, automatic operation can be appropriately performed even if a fault point exists in VP20.

[0060] In the following description, it is assumed that a fault exists on the communication path between the VCIB 40 and an on-board system, or in the on-board system itself. Hereinafter, this on-board system is assumed to be the wheel lock control system 340, the directional control system 344, or the propulsion system 345. In this embodiment, an example is described in which the on-board system related to the fault is the wheel lock control system 340.

[0061] 3 is a diagram illustrating the flow of signals related to wheel locking control. Referring to FIG. 3, the motion control unit 60 corresponds to the integrated control manager 31 (FIG. 1) and controls the wheel locking control system 340. The motion control unit 60 controls the VCIB 40A, the VCIB 40B, the EPB system 34, 1, and P-Lock system 342.

[0062] The VCIB 40A is configured to be able to communicate with each of the EPB system 341 and the P-Lock system 342 through the motion control unit 60. Similarly, the VCIB 40B is configured to be able to communicate with each of the EPB system 341 and the P-Lock system 342 through the motion control unit 60. The VCIB 40A, VCIB 40B, and the motion control unit 60 are each configured to be able to communicate with one another.

[0063] In this embodiment, it is assumed that a failure in VP20 occurs on communication path CP1, CP2, CP3 or CP4, or in motion control unit 60, EPB system 341 or P-Lock system 342.

[0064] Communication path CP1 is formed to establish communication between the VCIB 40A and the motion control unit 60. Communication path CP2 is formed to establish communication between the VCIB 40B and the P-Lock system 342. Communication path CP3 is formed to establish communication between the VCIB 40B and the motion control unit 60. Communication path CP4 is formed to establish communication between the motion control unit 60 and the P-Lock system 342. Each of communication paths CP1 to CP4 is formed by, for example, CAN communication.

[0065] If a fault occurs in the control system (control line), the VCIB 40A can determine the location of the fault. This control system consists of communication paths CP1 and CP4, the motion control unit 60, the EPB system 341, and the P-Lock system 342. Below, we will explain an example of the method by which the VCIB 40A determines the location of the fault.

[0066] If the VCIB 40A does not receive a response from the motion control unit 60 corresponding to a control command within a predetermined time after sending the control command to the motion control unit 60, the VCIB 40A determines that communication with the motion control unit 60 has been interrupted. As a result, the VCIB 40A determines that the fault point is on the communication path CP1 or in the motion control unit 60. Information indicating the predetermined time is stored in the memory 41A.

[0067] When communication with the motion control unit 60 is established, the VCIB 40A determines that there is a fault on the communication path CP4 or in the P-Lock system 342 based on a first fault signal from the motion control unit 60. The first fault signal indicates that there is a fault on the communication path CP4 or in the P-Lock system 342. If the motion control unit 60 does not receive a response corresponding to this control command from the P-Lock system 342 within a predetermined time after sending a control command to the P-Lock system 342, the motion control unit 60 determines that communication with the P-Lock system 342 has been interrupted. As a result, the VCIB 40B determines that the fault is on the communication path CP4 or in the P-Lock system 342, and transmits a first fault signal to the VCIB 40A.

[0068] When communication with the motion control unit 60 is established, the VCIB 40A determines that there is a fault in the EPB system 341 based on a second fault signal from the motion control unit 60. The second fault signal indicates that the fault is in the EPB system 341. When the motion control unit 60 does not receive a response corresponding to a control command from the EPB system 341 within a predetermined time after sending the control command to the EPB system 341, the motion control unit 60 determines that communication with the EPB system 341 has been interrupted. As a result, the VCIB 40B determines that the fault is in the EPB system 341, and transmits a second fault signal to the VCIB 40A.

[0069] The VCIB 40A determines whether there is a fault point based on the state of communication (established / disconnected) with the motion control unit 60 and the presence or absence of the first fault signal and the second fault signal. For example, if communication with the motion control unit 60 is established and either the first fault signal or the second fault signal is present, the VCIB 40A determines whether there is a fault point based on the state of communication (established / disconnected) with the motion control unit 60 and the presence or absence of the first fault signal and the second fault signal. If neither of these signals is received, it is determined that there is no fault in the VP 20 (more specifically, the control system of the VCIB 40A). If the VCIB 40A has lost communication with the motion control unit 60 or has received at least one of the first fault signal and the second fault signal, it is determined that there is a fault.

[0070] If a fault occurs in the control system (control line), the VCIB 40B can determine the location of the fault. This control system consists of communication paths CP2, CP3, and CP4, the motion control unit 60, the EPB system 341, and the P-Lock system 342. Below, we will explain an example of a method by which the VCIB 40B determines the location of the fault.

[0071] If the VCIB 40B does not receive a response from the P-Lock system 342 corresponding to a control command within a predetermined time after transmitting the control command to the P-Lock system 342, the VCIB 40B determines that communication with the P-Lock system 342 has been interrupted. As a result, the VCIB 40B determines that the fault point is on the communication path CP2 or in the P-Lock system 342. Information indicating the predetermined time is stored in the memory 41B.

[0072] If the VCIB 40B does not receive a response from the motion control unit 60 corresponding to the control command within a predetermined time after sending the control command to the motion control unit 60, the VCIB 40B determines that communication with the motion control unit 60 has been interrupted. As a result, the VCIB 40B determines that the fault point is on the communication path CP3 or in the motion control unit 60.

[0073] When communication with the motion control unit 60 is established, the VCIB 40B determines that there is a fault in the EPB system 341 based on a third fault signal from the motion control unit 60. The third fault signal indicates that there is a fault in the EPB system 341. If the motion control unit 60 does not receive a response corresponding to this control command from the EPB system 341 within a predetermined time after sending a control command to the EPB system 341, it determines that communication with the EPB system 341 has been interrupted. As a result, the motion control unit 60 determines that there is a fault in the EPB system 341, and sends a third fault signal to the VCIB 40B.

[0074] The VCIB 40B determines whether there is a fault point according to the communication status (established / disconnected) with the motion control unit 60 or the P-Lock system 342 and whether there is a third fault signal. For example, if the VCIB 40B has established communication with the motion control unit 60 and the P-Lock system 342 and has not received the third fault signal, it determines that there is no fault point in the VP 20 (more specifically, the control system of the VCIB 40B). If the communication with the motion control unit 60 or the P-Lock system 342 has been disconnected or if the VCIB 40B has received the third fault signal, it determines that there is a fault point.

[0075] 4 is a diagram illustrating data stored in memory 41A of VCIB 40A according to an embodiment. Referring to FIG. 4, data 410 is used by VCIB 40A to set a value V1 of signal S1 and a value V2 of signal S2 according to the location of the fault point.

[0076] The "fault points" correspond to the circled numbers and reference characters in FIG. "VP_Autonomy_Fault" corresponds to the value V1 of the signal S1 and indicates the autonomous mode in VP20. For example, "VP_Autonomy_Fault" (value V1) indicates the status of whether or not a fault related to the functionality of the VCIB 40 has occurred in the control system of the VCIB 40. "VP_Autonomy_Fault" indicates that there is a fault when it is 1.

[0077] In this example, "VP_Autonomy_Fault" corresponds to the value V1A of the signal S1. , 0, 1 respectively indicate that there is no fault and that there is a fault in the control system of the VCIB 40A.

[0078] "WheelLock_Control_Degradation_Modes" corresponds to the value V2 of the signal S2, VP20 3 represents the status of the wheel lock control system 340 depending on the fault point in the wheel lock control system 340. As explained below, this status includes loss of function of the wheel lock control system 340, degraded operation of the EPB system 341, and degraded operation of the P-Lock system 342.

[0079] For example, if "WheelLock_Control_Degradation_Modes" (value V2) is 0, the vehicle When "WheelLock_Control_Degradation_Modes" is 1, it indicates that the status of the wheel lock control system 340 is normal. When the function is lost, the wheel lock control system 340 may not operate. When "WheelLock_Control_Degradation_Modes" is 2, it indicates that the status of the wheel lock control system 340 is in the EPB system 3 state. This indicates that the EPB system 341 is in degraded performance operation. During this degraded performance operation, the EPB system 341 may not operate. If "WheelLock_Control_Degradation_Modes" is 3, This indicates that the status of the wheel lock control system 340 is in degraded operation of the P-Lock system 342. In this degraded operation, the P-Lock system 342 may not operate.

[0080] In this example, "WheelLock_Control_Degradation_Modes" is set to the value V2A of the signal S2A. The status of the wheel lock control system 340 indicated by signal S2A (value V2A) is loss of function (V2A=1) if the fault is on communication path CP1 or in the motion control unit 60. If the fault is on communication path CP4 or in the P-Lock system 342, the status of the wheel lock control system 340 is degraded operation of the P-Lock system 342 (V2A=3). If the fault is in the EPB system 341, the status of the wheel lock control system 340 is degraded operation of the EPB system 341 (V2A=2).

[0081] The VCIB 40A sets the values ​​V1A and V2A according to the data 410 and the location of the fault point. For example, if the fault point is on the communication path CP1, the VCIB 40A sets both the values ​​V1A and V2A to 1. On the other hand, if the VCIB 40A determines that there is no fault point, it sets both the values ​​V1A and V2A to 0 (not shown).

[0082] 5 is a diagram schematically illustrating data stored in memory 41B of VCIB 40B according to an embodiment. Referring to FIG. 5, data 420 is used by VCIB 40B to set value V1 of signal S1 and value V2 of signal S2 according to the location of the fault point.

[0083] In this example, "VP_Autonomy_Fault" corresponds to the value V1B of the signal S1B. When it is 0, it indicates that there is no fault in the control system of the VCIB 40B, and when it is 1, it indicates that there is a fault.

[0084] Similarly, "WheelLock_Control_Degradation_Modes" corresponds to the value V2B of the signal S2B. The status of the wheel lock control system 340 indicated by signal S2B (value V2B) is degraded operation of the EPB system 341 (V2B=2) if the fault point is in the motion control unit 60, on communication path CP3, or in the EPB system 341. If the fault point is in the P-Lock system 342 or on communication path CP2, the status of the wheel lock control system 340 is degraded operation of the P-Lock system 342 (V2B=3).

[0085] The VCIB 40B sets the values ​​V1B and V2B according to the data 410 and the location of the fault point. For example, if the fault point is in the motion control unit 60, the VCIB 40B sets the value V1B to 1 and the value V2B to 2. On the other hand, if the VCIB 40B determines that there is no fault point, If so, both values ​​V1B and V2B are set to 0 (not shown).

[0086] 6 is a diagram schematically illustrating data stored in memory 111M of ADS 11 according to an embodiment. Referring to FIG. 6, data 430 represents the relationship between a combination of values ​​V1A, V2A, V1B, and V2B and the location of a fault point. Data 430 is based on data 410 and 420 (FIGS. 4 and 5).

[0087] The ADS11 determines whether there is a fault point in the VP20, and if there is a fault point, what the fault point is, according to the values ​​V1A, V2A, V1B, and V2B and the data 430. For example, if the combination of the values ​​V1A, V2A, V1B, and V2B is different from the combination in Fig. 6 (for example, 0,0,0,0), the ADS11 determines that there is no fault.

[0088] On the other hand, if the combination of the values ​​V1A, V2A, V1B, and V2B matches the combination in FIG. 6, the ADS11 determines that a fault exists. For example, if the values ​​V1A, V2A, V1B, and V2B are 1, 1, 0, and 0, respectively, the ADS11 determines that the fault point is on the communication path CP1. In this case, if the ADS11 transmits a control request to the VP20 via the communication bus 43, the control command based on the control request may be lost on the communication path CP1 and may not reach the wheel fixation control system 340. Therefore, in this example, when a fault occurs on the communication path CP1, the ADS11 determines to transmit the control request to the VP20 via the communication bus 44 (selecting the communication bus 44 as the communication bus to be used for transmitting the control request). This allows the control command based on the control request to reach the wheel fixation control system 340 via the VCIB 40B and the communication path CP2 or CP3. In this way, when a failure occurs in the VP 20, the ADS 11 can appropriately determine whether to send a control command to the VP 20 through the communication bus 43 or the communication bus 44 based on the location of the failure point.

[0089] 7 is a flowchart illustrating the procedure of a process executed in association with fault point determination in an embodiment. This flowchart is executed at predetermined time intervals. Hereinafter, steps are abbreviated as "S."

[0090] 7, VCIB 40A sets values ​​V1A and V2A in accordance with the presence or absence of a fault point in its control system and data 410 (S105), and thereby outputs signals S1A and S2A to ADS11 (S110). Similarly, VCIB 40B sets values ​​V1B and V2B in accordance with the presence or absence of a fault point in its control system and data 420 (S205), and thereby outputs signals S1B and S2B to ADS11 (S210).

[0091] The ADS11 determines the combination of values ​​V1A, V2A, V1B, and V2B based on the signals S1A, S2A, S1B, and S2B, and determines whether or not there is a fault point in the VP 20 according to the result of this determination (S315). If there is no fault point (NO in S315), for example, if all of the values ​​V1A, V2A, V1B, and V2 are 0, the process proceeds to S325.

[0092] If a fault point exists (YES in S315), the ADS11 determines the fault point according to the combination of values ​​V1A, V2A, V1B, and V2B and data 430 (S320). Based on the result of this determination, the ADS11 selects a communication bus (communication bus 43 or communication bus 44) to be used to transmit the control request (S325). For example, if the fault point exists on communication path CP1, the ADS11 selects communication bus 44. If no fault point exists (NO in S315), the ADS11 may select either communication bus 43 or communication bus 44 based on the vehicle state. After S325, the ADS11 transmits the control request to VP20 through the selected communication bus (S330).

[0093] As described above, according to the embodiment, automatic driving can be properly performed even if a fault point exists in the VP 20.

[0094] [Variation 1] In the first modification, an example will be described in which the in-vehicle system related to the fault point is the direction control system 344. The overall configuration and processing procedure in the first modification are basically the same as those in the embodiment.

[0095] 8 is a diagram illustrating the flow of signals related to vehicle direction control. Referring to FIG. 8, it is assumed that a failure in VP20 occurs on communication path CP1 or CP3, or in motion control unit 60 or direction control system 344.

[0096] The control system of the VCIB 40A consists of the communication path CP1, the motion control unit 60, and the direction control system 344. The method by which the VCIB 40A determines that a fault exists on the communication path CP1 or in the motion control unit 60 is the same as in the embodiment. When communication with the motion control unit 60 is established, the VCIB 40A determines that a fault exists in the direction control system 344 based on a fourth fault signal from the motion control unit 60. The fourth fault signal indicates that a fault exists in the direction control system 344. The VCIB 40A determines the presence or absence of a fault according to the communication status (established / disconnected) with the motion control unit 60 and the presence or absence of the fourth fault signal.

[0097] The control system of the VCIB 40B consists of the communication path CP3, the motion control unit 60, and the direction control system 344. The method by which the VCIB 40B determines that a fault exists on the communication path CP3 or in the motion control unit 60 is the same as that in the embodiment. When communication with the motion control unit 60 is established, the VCIB 40B determines that a fault exists in the direction control system 344 based on a fifth fault signal from the motion control unit 60. The fifth fault signal indicates that a fault exists in the direction control system 344. The VCIB 40B determines the presence or absence of a fault according to the communication status (established / disconnected) with the motion control unit 60 and the presence or absence of the fifth fault signal.

[0098] 9 is a diagram schematically illustrating data stored in memory 41A of VCIB 40A in Modification 1. Referring to FIG. 9, data 510 is used by VCIB 40A to set value V1 of signal S1 and value V2 of signal S2 according to the location of the fault point.

[0099] "Direction_Control_Degradation_Modes" corresponds to the value V2 of the signal S2, VP20 "Direction_Control_Degradation_Modes" (value V2) represents the status of the directional control system 344 depending on the fault point in the "Direction_Control_Degradation_Modes" is set to 1, indicating that the status is normal. If so, it indicates that the status of the directional control system 344 is loss of function (LOSS_OF_FUNCTION). In the case of loss of function, the directional control system 344 may not operate.

[0100] The VCIB 40A sets the values ​​V1A and V2A according to the data 510 and the location of the fault point. For example, if the fault point is in the directional control system 344, the VCIB 40A sets both the values ​​V1A and V2A to 1.

[0101] Fig. 10 is a diagram schematically showing data stored in memory 41B of VCIB 40B in Modification 1. Referring to Fig. 10, data 520 is used by VCIB 40B to set value V1 of signal S1 and value V2 of signal S2 according to the location of the fault point.

[0102] The VCIB 40B sets the values ​​V1B and V2B according to the data 520 and the location of the fault point. For example, if the fault point is in the directional control system 344, the VCIB 40B sets both the values ​​V1B and V2B to 1.

[0103] FIG. 11 is a diagram schematically illustrating data stored in the memory 111M of the ADS11 in the first modification. Referring to FIG. 11, data 530 represents the relationship between the combination of values ​​V1A, V2A, V1B, and V2B and the location of the failure point. Data 530 is based on data 510 and 520 (FIGS. 9 and 10). The ADS11 determines whether or not there is a failure point in VP20, and if there is a failure point, the failure point, according to the values ​​V1A, V2A, V1B, and V2B and data 530. For example, if the values ​​V1A, V2A, V1B, and V2B are 1, 1, 0, and 0, respectively, the ADS11 determines that the failure point is on the communication path CP1.

[0104] [Variation 2] In the second modification, an example will be described in which the on-board system related to the fault point is the propulsion system 345. The overall configuration and processing procedure in the second modification are basically the same as those in the embodiment.

[0105] 12 is a diagram illustrating the flow of signals related to propulsion force control. Referring to FIG. 12, it is assumed that a failure in VP20 occurs on communication path CP1 or CP3, or in motion control unit 60 or propulsion force system 345.

[0106] The control system of the VCIB 40A consists of the communication path CP1, the motion control unit 60, and the propulsion system 345. The method by which the VCIB 40A determines that a fault exists on the communication path CP1 or in the motion control unit 60 is the same as in the embodiment. When communication with the motion control unit 60 is established, the VCIB 40A determines that a fault exists in the propulsion system 345 based on a sixth fault signal from the motion control unit 60. The sixth fault signal indicates that a fault exists in the propulsion system 345. The VCIB 40A determines whether a fault exists based on the communication status (established / disconnected) with the motion control unit 60 and the presence or absence of the sixth fault signal.

[0107] The control system of the VCIB 40B consists of the communication path CP3, the motion control unit 60, and the propulsion system 345. The method by which the VCIB 40B determines that a fault exists on the communication path CP3 or in the motion control unit 60 is the same as in the embodiment. When communication with the motion control unit 60 is established, the VCIB 40B determines that a fault exists in the propulsion system 345 based on a seventh fault signal from the motion control unit 60. The seventh fault signal indicates that a fault exists in the propulsion system 345. The VCIB 40B determines the presence or absence of a fault according to the communication status (established / disconnected) with the motion control unit 60 and the presence or absence of the seventh fault signal.

[0108] Fig. 13 is a diagram schematically showing data stored in memory 41A of VCIB 40A in Modification 2. Referring to Fig. 13, data 610 is used by VCIB 40A to set value V1 of signal S1 and value V2 of signal S2 according to the location of the fault point.

[0109] "Propulsive_System_Degradation_Modes" corresponds to the value V2 of the signal S2, VP20 "Propulsive_System_Degradation_Modes" (value V2) represents the status of the propulsion system 345 depending on the fault point in the Indicates that the status is normal. "Propulsive_System_Degradation_Modes" is 1. If this flag is set, it indicates that the status of the propulsion system 345 is loss of function (LOSS_OF_FUNCTION). In the case of loss of function, the propulsion system 345 may not be operational.

[0110] The VCIB 40A sets the values ​​V1A and V2A according to the data 610 and the location of the fault. For example, if the fault is in the propulsion system 345, the VCIB 40A sets both the values ​​V1A and V2A to 1.

[0111] FIG. 14 is a diagram showing data stored in the memory 41B of the VCIB 40B in the second modification. 14, data 620 is used by VCIB 40B to set the value V1 of signal S1 and the value V2 of signal S2 depending on the location of the fault point.

[0112] The VCIB 40B sets the values ​​V1B and V2B according to the data 620 and the location of the fault point. For example, if the fault point is in the propulsion system 345, the VCIB 40B sets both the values ​​V1B and V2B to 1.

[0113] FIG. 15 is a diagram schematically illustrating data stored in memory 111M of ADS11 in Modification 2. Referring to FIG. 15, data 630 represents the relationship between a combination of values ​​V1A, V2A, V1B, and V2B and the location of a fault point. Data 530 is based on data 510 and 520 (FIGS. 13 and 14). ADS11 determines whether or not there is a fault point in VP20, and if there is a fault point, the fault point, according to values ​​V1A, V2A, V1B, and V2B and data 530. For example, if values ​​V1A, V2A, V1B, and V2B are 0, 0, 1, and 1, respectively, ADS11 determines that the fault point is on communication path CP3. [Industrial Applicability]

[0114] The embodiments disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0115] [Example] TIFF2026015368000002.tif208144

[0116] TIFF2026015368000003.tif208147

[0117] TIFF2026015368000004.tif208144

[0118] TIFF2026015368000005.tif208144

[0119] TIFF2026015368000006.tif208147

[0120] TIFF2026015368000007.tif208147

[0121] TIFF2026015368000008.tif208144

[0122] TIFF2026015368000009.tif208144

[0123] TIFF2026015368000010.tif208144

[0124] TIFF2026015368000011.tif208144

[0125] TIFF2026015368000012.tif208144

[0126] TIFF2026015368000013.tif208144

[0127] TIFF2026015368000014.tif208144

[0128] TIFF2026015368000015.tif208144

[0129] TIFF2026015368000016.tif208144

[0130] TIFF2026015368000017.tif208144

[0131] TIFF2026015368000018.tif208144

[0132] TIFF2026015368000019.tif208144

[0133] TIFF2026015368000020.tif208144

[0134] TIFF2026015368000021.tif208144

[0135] TIFF2026015368000022.tif208144

[0136] TIFF2026015368000023.tif208144

[0137] TIFF2026015368000024.tif208144

[0138] TIFF2026015368000025.tif208146

[0139] TIFF2026015368000026.tif208144

[0140] TIFF2026015368000027.tif208146

[0141] TIFF2026015368000028.tif208144

[0142] TIFF2026015368000029.tif208144

[0143] TIFF2026015368000030.tif208144

[0144] TIFF2026015368000031.tif208144

[0145] TIFF2026015368000032.tif208146

[0146] TIFF2026015368000033.tif208146

[0147] TIFF2026015368000034.tif208144

[0148] TIFF2026015368000035.tif208144

[0149] TIFF2026015368000036.tif208144

[0150] TIFF2026015368000037.tif208144

[0151] TIFF2026015368000038.tif208144

[0152] TIFF2026015368000039.tif208144

[0153] TIFF2026015368000040.tif208144

[0154] TIFF2026015368000041.tif208144

[0155] TIFF2026015368000042.tif208144

[0156] TIFF2026015368000043.tif208144

[0157] TIFF2026015368000044.tif208144

[0158] TIFF2026015368000045.tif208144

[0159] TIFF2026015368000046.tif208144

[0160] TIFF2026015368000047.tif208144

[0161] TIFF2026015368000048.tif208144

[0162] TIFF2026015368000049.tif208144

[0163] TIFF2026015368000050.tif208144

[0164] TIFF2026015368000051.tif208144

[0165] TIFF2026015368000052.tif208144

[0166] TIFF2026015368000053.tif208144

[0167] TIFF2026015368000054.tif208144

[0168] TIFF2026015368000055.tif208144

[0169] TIFF2026015368000056.tif208144

[0170] TIFF2026015368000057.tif208144

[0171] TIFF2026015368000058.tif208144

[0172] TIFF2026015368000059.tif208144

[0173] TIFF2026015368000060.tif208144

[0174] TIFF2026015368000061.tif208144

[0175] TIFF2026015368000062.tif208144

[0176] TIFF2026015368000063.tif208144

[0177] TIFF2026015368000064.tif208144

[0178] TIFF2026015368000065.tif208144

[0179] TIFF2026015368000066.tif208144

[0180] TIFF2026015368000067.tif208144

[0181] TIFF2026015368000068.tif208144

[0182] TIFF2026015368000069.tif208144

[0183] TIFF2026015368000070.tif208144

[0184] TIFF2026015368000071.tif208144

[0185] TIFF2026015368000072.tif208144

[0186] TIFF2026015368000073.tif208144

[0187] TIFF2026015368000074.tif208144

[0188] TIFF2026015368000075.tif208144

[0189] TIFF2026015368000076.tif208144

[0190] TIFF2026015368000077.tif208144

[0191] TIFF2026015368000078.tif208144

[0192] TIFF2026015368000079.tif208147

[0193] TIFF2026015368000080.tif208144

[0194] TIFF2026015368000081.tif208144

[0195] TIFF2026015368000082.tif208144

[0196] TIFF2026015368000083.tif208144 [Explanation of symbols]

[0197] 1 Vehicle, 30 Base vehicle, 31 Integrated control manager, 34 Powertrain system, 41, 41A, 41B, 111M Memory, 43, 44 Communication bus, 60 Motion control unit, 111 Computer, 111A, 111B Communication module, 340 Wheel lock control system, 341 EPB system, 342 P-Lock system, 343 Propulsion system, 344 Directional control system, 345 Propulsion system.

Claims

1. A vehicle platform configured to be able to mount an autonomous driving system, Vehicles and a vehicle control interface box that interfaces between the vehicle and the automated driving system via a main bus and a sub-bus; the vehicle includes an on-board system connected to the vehicle control interface box; The vehicle control interface box includes: a main vehicle control interface box that interfaces between the vehicle and the automated driving system through the main bus; a sub-vehicle control interface box that interfaces between the vehicle and the automated driving system through the sub-bus; each of the main vehicle control interface box and the sub vehicle control interface box outputs a first signal and a second signal; the first signal indicates a status of whether a fault has occurred with respect to functionality of an autonomous mode in the vehicle platform; the second signal indicates a status of the on-board system as a function of a fault point in the vehicle platform; The vehicle platform, wherein the on-board system is a wheel lock control system, a directional control system, or a propulsion system of the vehicle.

2. the on-board system is the wheel lock control system; the wheel immobilization control system includes an electric parking brake system and a parking lock system of the vehicle; the parking lock system is connected to the sub-vehicle control interface box; 2. The vehicle platform of claim 1, wherein the status of the wheel immobilization control system indicated by the second signal includes a loss of function of the wheel immobilization control system, a degraded operation of the electric parking brake system, and a degraded operation of the parking lock system.

3. the vehicle further includes a motion control unit that communicates with each of the main vehicle control interface box, the sub-vehicle control interface box, the electric parking brake system, and the parking lock system; the main vehicle control interface box is configured to be able to communicate with each of the electric parking brake system and the parking lock system through the motion control unit; The status of the wheel lock control system, as indicated by the second signal output by the main vehicle control interface box, is: If the fault point is on the communication path between the main vehicle control interface box and the motion control unit or in the motion control unit, the function is lost; If the fault point is on a communication path between the motion control unit and the parking lock system or in the parking lock system, the performance of the parking lock system is degraded; The vehicle platform of claim 2 , wherein if the fault point is in the electric parking brake system, it is a degraded operation of the electric parking brake system.

4. The vehicle includes the main vehicle control interface box, the sub vehicle control interface box, the electric parking brake system, and the parking lock a motion controller in communication with each of the motion systems; the sub-vehicle control interface box is configured to be able to communicate with each of the electric parking brake system and the parking lock system through the motion control unit, The status of the wheel lock control system indicated by the second signal output by the sub-vehicle control interface box is: If the fault point is in the movement control unit, on the communication path between the sub-vehicle control interface box and the movement control unit, or in the electric parking brake system, the electric parking brake system is in a performance degradation operation; 3. The vehicle platform of claim 2, wherein the fault point is a degraded operation of the parking lock system if the fault point is on the parking lock system or on a communication path between the sub-vehicle control interface box and the parking lock system.

5. a vehicle control interface box that interfaces between a vehicle included in a vehicle platform configured to be able to mount an automated driving system and the automated driving system via a main bus and a sub-bus, the vehicle including an on-board system connected to the vehicle control interface box; a main vehicle control interface box that interfaces between the vehicle and the automated driving system through the main bus; a sub-vehicle control interface box that interfaces between the vehicle and the automated driving system through the sub-bus; each of the main vehicle control interface box and the sub vehicle control interface box outputs a first signal and a second signal; the first signal indicates a status of whether a fault has occurred with respect to functionality of an autonomous mode in the vehicle platform; the second signal indicates a status of the on-board system as a function of a fault point in the vehicle platform; The vehicle control interface box, wherein the on-board system is a wheel lock control system, a direction control system, or a propulsion system of the vehicle.

6. An automated driving system configured to be mountable on a vehicle platform, The vehicle platform includes: Vehicles and a vehicle control interface box that interfaces between the vehicle and the automated driving system via a main bus and a sub-bus; the vehicle includes an on-board system connected to the vehicle control interface box; The vehicle control interface box includes: a main vehicle control interface box that interfaces between the vehicle and the automated driving system through the main bus; a sub-vehicle control interface box that interfaces between the vehicle and the automated driving system through the sub-bus; each of the main vehicle control interface box and the sub vehicle control interface box outputs a first signal and a second signal; the first signal indicates a status of whether a fault has occurred with respect to functionality of an autonomous mode in the vehicle platform; the second signal indicates a status of the on-board system as a function of a fault point in the vehicle platform; The on-board system may be a wheel lock control system, a directional control system, or a propulsion system of the vehicle. It is a driving force system, The automated driving system includes: A computer, a first communication module in communication with the main vehicle control interface box; a second communication module that communicates with the sub-vehicle control interface box; The computer receiving the first signal and the second signal of the main vehicle control interface box from the main vehicle control interface box through the first communication module; and receiving the first signal and the second signal of the sub-vehicle control interface box from the sub-vehicle control interface box through the second communication module; An autonomous driving system that is programmed to:

Images