Driving assistance method and driving assistance device

Abstract

This invention provides a means to ensure safety when occupants get on and off a vehicle, even if the sensors that detect the area around the vehicle malfunction. [Solution] In the driving support method, it is determined whether any of the multiple sensors mounted on the vehicle that detect the surrounding conditions of the vehicle have malfunctioned (S4). If any of the sensors have malfunctioned, it is determined, based on the non-malfunctioning sensors among the multiple sensors or the map database, whether the planned boarding / alighting location, where the occupants are scheduled to get on and off the vehicle, is a verifiable location where the safety of the occupants getting on and off the vehicle can be confirmed when any of the sensors have malfunctioned (S5). If the planned boarding / alighting location is not a verifiable location, a verifiable location located near the planned boarding / alighting location is obtained from the map database (S7), and the vehicle is supported in driving to the obtained verifiable location (S8, S9).

Description

Technical Field

[0003]

[0001] The present invention relates to a driving support method and a driving support device.

Background Art

[0002] In Patent Document 1, a vehicle is driven in an autonomous driving mode based on sensor data received from a plurality of sensors that detect information related to the environment around the vehicle. When an error state occurs in any of the plurality of sensors, a technology for driving the vehicle in a fallback driving mode has been proposed.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Sensors for detecting the surroundings of a vehicle can be used for safety confirmation when a passenger gets on and off the vehicle. If such a sensor fails, there is a risk that the safety confirmation by the sensor when the passenger gets on and off will be insufficient. An object of the present invention is to provide means that enables safety confirmation when a passenger gets on and off even when a sensor for detecting the surroundings of the vehicle fails.

Means for Solving the Problems

[0005] In a driving assistance method according to one aspect of the present invention, it is determined whether any of the multiple sensors mounted on the vehicle to detect the surrounding conditions of the vehicle have malfunctioned. If any of the sensors have malfunctioned, it is determined, based on the non-malfunctioning sensors among the multiple sensors or a map database, whether the planned drop-off location where the vehicle occupants are scheduled to alight from the vehicle, or the planned boarding location where the occupants are scheduled to board the vehicle, is a verifiable location where the safety of the occupants alighting from or boarding the vehicle can be confirmed in the event that any of the sensors have malfunctioned. If the planned drop-off location or planned boarding location is not a verifiable location, a verifiable location located near the planned drop-off location or planned boarding location is obtained from the map database, and the driving of the vehicle to the obtained verifiable location is supported. [Effects of the Invention]

[0006] According to the present invention, even if the sensors that detect the surroundings of the vehicle malfunction, a means is provided that enables safety checks when occupants get on and off the vehicle. [Brief explanation of the drawing]

[0007] [Figure 1] This is a schematic diagram of an example of a vehicle dispatch system according to an embodiment. [Figure 2] This is a schematic diagram of the detection range by the surrounding environment sensor. [Figure 3] (a) and (b) are explanatory diagrams of the driving assistance method according to the embodiment. [Figure 4] This is a block diagram of an example of the functional configuration of the dispatch system in the embodiment. [Figure 5] This is a flowchart of an example of a driving assistance method according to the first embodiment. [Figure 6] This is a flowchart of an example of a driving assistance method according to the second embodiment. [Figure 7] This is a flowchart of an example of a driving assistance method according to the third embodiment. [Modes for carrying out the invention]

[0008] Embodiments of the present invention will be described below with reference to the drawings. Note that the drawings are schematic and may differ from actual ones. Furthermore, the embodiments of the present invention described below are illustrative examples of devices and methods for realizing the technical concept of the present invention, and the technical concept of the present invention is not limited to the structure, arrangement, etc., of the components described below. The technical concept of the present invention can be modified in various ways within the technical scope defined by the claims described in the patent claims.

[0009] (First Embodiment) (composition) Figure 1 is a schematic diagram of an example of a dispatch system according to the embodiment. Dispatch system 1 of the embodiment is a system that dispatches vehicles (hereinafter sometimes referred to as "service vehicles") to be used for passenger transport services (transportation services) that transport users in response to dispatch requests from users requesting the dispatch of a vehicle. Dispatch system 1 comprises a server device 2 and a plurality of service vehicles 3a, 3b, etc. Hereinafter, the passenger transport service provided by dispatch system 1 may be simply referred to as "passenger transport service". In the following description, the plurality of service vehicles 3a, 3b, etc. may be collectively referred to as "service vehicle 3".

[0010] Server device 2 comprises a communication device 20, a map database (map DB) 21, a verifiable location database (verifiable location DB) 22, and a calculation processing unit 23. The communication device 20 provides communication functionality between the server device 2 and external devices. The communication method used by the communication device 20 may be, for example, wireless communication over a public mobile network, satellite communication, or vehicle-to-infrastructure communication with the service vehicle 3. The server device 2 transmits and receives data with the service vehicle 3 using the communication device 20.

[0011] Map DB21 stores map information that includes information about roads in the area where passenger transport services are provided. For example, the map information may be a navigation map that can be used to calculate the route that the service vehicle 3 will take with the user. Map DB21 may include information about structures (e.g., curbs, guardrail chain poles, ditches, walls, etc.) installed at road boundaries to prevent moving objects on the ground (i.e., moving objects that maintain contact with the ground while moving) from entering the roadway, as well as information about facilities where spaces for parking vehicles are provided. The verifiable locations DB22 will be described later.

[0012] The arithmetic processing unit 23 performs information processing in the server device 2. The arithmetic processing unit 23 may include a processor 23a and peripheral components such as a storage device 23b. The processor 23a may be, for example, a CPU (Central Processing Unit) or an MPU (Micro-Processing Unit). The same applies to the processor 36a described later. The storage device 23b may include any of semiconductor storage devices, magnetic storage devices, or optical storage devices. The storage device 23b may include memory such as ROM and RAM used as main memory, registers, and cache memory. The same applies to the storage device 36b described later. The functions of the server device 2 described below are realized, for example, by the processor 23a executing a computer program stored in the storage device 23b.

[0013] Service vehicle 3 is a vehicle that operates in response to the requests of users of passenger transport services (a so-called on-demand transport vehicle), and may be, for example, a shared taxi or a robot taxi. Service vehicle 3 may also be an autonomous vehicle that is driven automatically by the controller 36 according to route information transmitted from the server device 2 or route information generated by the controller 36, without the involvement of a driver. In other words, the controller 36 may support the operation of service vehicle 3 by autonomously driving it.

[0014] The service vehicle 3 may be a manually driven vehicle driven by a driver (human). In this case, the controller 36 may support the driving of the service vehicle 3 driven by the driver according to the route information by presenting the route information transmitted from the server device 2 or the route information generated by the controller 36 to the driver. In this specification, examples in the case of an autonomous driving vehicle will be described unless otherwise specified.

[0015] The service vehicle 3 includes an in-vehicle device 30 for supporting the driving of the service vehicle 3 by driving the service vehicle 3 under autonomous driving control. The in-vehicle device 30 includes a surrounding environment sensor 31, a vehicle sensor 32, a positioning device 33, a map database (map DB) 34, a communication device 35, a controller 36, and an actuator 37. The in-vehicle device 30 is an example of the "driving support device" described in the claims.

[0016] The surrounding environment sensor 31 detects, as the surrounding situation of the service vehicle 3, the relative position between an object existing around the service vehicle 3 and the service vehicle 3, the distance between the service vehicle 3 and the object, the direction in which the object exists, and the like. The surrounding environment sensor 31 may include a plurality of sensors that respectively detect the surrounding situations in a plurality of different ranges around the service vehicle 3.

[0017] FIG. 2 is a schematic diagram of the detection range by the surrounding environment sensor 31. For example, the surrounding environment sensor 31 may include a front sensor, a rear sensor, a right-side sensor, and a left-side sensor that respectively detect the surrounding situations in the front detection range Rf, the rear detection range Rb, the right-side detection range Rr, and the left-side detection range Rl of the service vehicle 3.

[0018] For example, the front sensor, the rear sensor, the right-side sensor, and the left-side sensor may include a camera that photographs the surrounding environment of the service vehicle 3, a distance measuring device such as a laser range finder (LRF), a radar, or a LiDAR (Light Detection and Ranging) laser radar. The surrounding environment sensor 31 outputs surrounding environment information, which is information on the surrounding environment of the detected service vehicle 3, to the controller 36.

[0019] Refer to Figure 1. The vehicle sensor 32 detects various information (vehicle status) obtained from the service vehicle 3. For example, the vehicle sensor 32 may include a vehicle speed sensor that detects the driving speed (vehicle speed) of the service vehicle 3, a wheel speed sensor that detects the rotational speed of each tire on the service vehicle 3, a three-axis acceleration sensor (G sensor) that detects the acceleration (including deceleration) of the service vehicle 3 in three axes, a steering angle sensor that detects the steering angle, a gyro sensor that detects the angular velocity occurring in the service vehicle 3, and a yaw rate sensor that detects the yaw rate. The vehicle sensor 32 outputs vehicle status information to the controller 36.

[0020] The positioning device 33 measures the current position and attitude of the service vehicle 3. For example, the positioning device 33 may be equipped with a Global Navigation System (GNSS) receiver. The positioning device 33 may also be equipped with an inertial navigation system. The positioning device 33 outputs the measured current position information to the controller 36. Map DB34 stores map information. The map information may include navigation map data and high-precision map data suitable for autonomous driving (hereinafter simply referred to as "high-precision map").

[0021] The communication device 35 provides communication functionality between the service vehicle 3 and external devices. The communication method used by the communication device 35 may be, for example, wireless communication over a public mobile network, satellite communication, or vehicle-to-infrastructure communication. The service vehicle 3 sends and receives data to and from the server device 2 using the communication device 35. The controller 36 is an electronic control unit (ECU) that controls the service vehicle 3. The controller 36 includes a processor 36a and peripheral components such as a storage device 36b.

[0022] The functions of the in-vehicle device 30 described below are realized, for example, by the processor 36a executing a computer program stored in the storage device 36b. For example, if the service vehicle 3 is an autonomous vehicle, the controller 36 performs autonomous driving control to drive the service vehicle 3 along route information transmitted from the server device 2 or route information generated by the controller 36, based on surrounding environment information from the surrounding environment sensor 31, vehicle status information from the vehicle sensor 32, positioning results from the positioning device 33, and high-precision maps from the map DB 33.

[0023] The actuator 37 automatically drives the service vehicle 3 by operating the steering system, drive system, and braking system of the service vehicle 3 in response to control signals generated by the controller 36, thereby generating vehicle behavior for the service vehicle 3. The actuator 37 comprises a steering actuator, an accelerator opening actuator, and a brake control actuator. Furthermore, the actuator 37 may also include a door actuator for opening and closing the passenger doors of the service vehicle 3 when a user (occupant) boards the service vehicle 3 and when a user alights from the service vehicle 3, as well as a door lock actuator for unlocking and locking the passenger doors.

[0024] In the following explanation, the boarding and alighting of a user from service vehicle 3 will be collectively referred to as "user boarding and alighting," and the boarding and alighting of a user from service vehicle 3 will be collectively referred to as "user boarding and alighting from service vehicle 3" or simply "boarding and alighting." Additionally, the boarding location where a user boards service vehicle 3 and the alighting location where a user alights from service vehicle 3 will be collectively referred to as "boarding and alighting location."

[0025] Next, an overview of the driving assistance method of the embodiment will be described. The surrounding environment sensor 31, which detects the area around the service vehicle 3, can be used to ensure safety when a user gets on or off the service vehicle 3. For example, if the service vehicle 3 is an unmanned vehicle, the onboard device 30 can perform safety checks on users getting on or off the service vehicle 3 in place of the driver, thereby improving the safety of passenger transport services.

[0026] However, if the surrounding environment sensor 31 malfunctions, there is a risk that safety checks when users get on and off the vehicle may become insufficient. For example, consider a scenario where the left-side sensor, which detects the surrounding conditions on the left side of the service vehicle 3, malfunctions, as shown in Figure 3(a). If the left-side sensor malfunctions, the detection range Rl (see Figure 2) on the left side of the service vehicle 3 becomes a blind spot for the surrounding environment sensor 31.

[0027] Therefore, even if a moving object 5 (such as a bicycle) is located within the detection range Rl on the left side and approaches the location where a user gets on or off the service vehicle 3 by passing through the gaps in road boundary structures (such as curbs or walls) 4a and 4b, the in-vehicle device 30 cannot detect the moving object 5. Thus, if a blind spot is created around the service vehicle 3 due to a malfunction of the surrounding environment sensor 31, it becomes difficult to detect moving objects 5 approaching from the direction of the blind spot, making it difficult to ensure the safety of users getting in and out of the service vehicle 3.

[0028] On the other hand, as shown in Figure 3(b), if a structure 4 is installed at the road boundary where the user gets on and off the service vehicle 3 to prevent the moving object 5 from entering the roadway, it can be seen that the moving object 5 cannot reach the user's boarding / alighting location from the blind spot (detection range Rl) caused by the failure of the left-side sensor. In addition, moving objects approaching the user's boarding / alighting location from other directions (for example, a motorcycle on the roadway) can be detected by the remaining sensors that are not malfunctioning (front sensor, rear sensor, right-side sensor).

[0029] Therefore, the in-vehicle device 30 of the embodiment determines whether or not one of the multiple surrounding environment sensors 31 has failed. If one of the sensors has failed, the device determines, based on the non-failed sensor among the multiple surrounding environment sensors 31 or the map database, whether the planned drop-off location, where the user is scheduled to alight from the service vehicle 3, or the planned boarding location, where the user is scheduled to board the service vehicle 3, is a verifiable location where the safety of the user boarding or alighting from the service vehicle 3 can be confirmed while one of the sensors is failed. For example, the in-vehicle device 30 may determine whether or not the planned drop-off location or planned boarding location is a verifiable location based on the non-failed sensor among the multiple surrounding environment sensors 31 and the map database, or it may determine whether or not the planned drop-off location or planned boarding location is a verifiable location based on the map database. In the following description, the planned drop-off location and the planned boarding location may be collectively referred to as "planned boarding / alighting location".

[0030] For example, a verifiable location may be a place where a structure preventing moving objects from entering the roadway is installed at the road boundary, and where the structure does not obstruct the user's boarding or alighting. Such structures may be, for example, a curb or other step that obstructs movement between the sidewalk and the roadway but allows the user to board or alight, or guardrail chain poles, ditches, or walls. For example, the in-vehicle device 30 may obtain information on the locations where such structures are installed from the verifiable location DB 22 of the server device 2, which will be described later.

[0031] If such a structure is installed at the road boundary, for example, even if the left-side sensor malfunctions, it will be clear that the moving object 5 cannot reach the user's boarding / alighting area from the blind spot (detection range Rl) created by the malfunction of the left-side sensor. Moving objects approaching the user's boarding / alighting area from other directions can be detected by the remaining non-malfunctioning sensors (front sensor, rear sensor, right-side sensor), thus ensuring the safety of users boarding and alighting from the service vehicle 3.

[0032] For example, a location where verification is possible may be a facility that has space for vehicles to be parked and personnel to ensure the safety of people around parked vehicles. For example, the in-vehicle device 30 may obtain information about such facilities from the verifiable location DB 22 of the server device 2.

[0033] If the planned pick-up / drop-off location is not a verifiable location, the on-board device 30 obtains information on verifiable locations near the planned pick-up / drop-off location from the map database. For example, the on-board device 30 may obtain information on verifiable locations from the verifiable location DB 22 of the server device 2. When the in-vehicle device 30 obtains information on verifiable locations from the verifiable location DB 22, it changes the user's boarding and alighting location to a verifiable location and generates a target driving route from the service vehicle 3's current location to the verifiable location.

[0034] The on-board device 30 assists the service vehicle 3 in traveling along the target route to a location where it can be monitored. For example, the on-board device 30 may use autonomous driving control to drive the service vehicle 3 to the location where it can be monitored, and then open or unlock the passenger doors at the location. If the service vehicle 3 is a manually operated vehicle, the device may assist the driver in driving the service vehicle 3 to the location where it can be monitored by presenting the generated route information to the driver.

[0035] Next, the details of the dispatch system of the embodiment will be described. Figure 4 is a block diagram of an example of the functional configuration of the dispatch system of the embodiment. The server device 2 includes a map DB 21 and a verifiable location DB 22, as well as a reservation dispatch unit 40. The functions of the reservation dispatch unit 40 are realized, for example, by the processor 23a executing a computer program stored in the storage device 23b.

[0036] In addition to the surrounding environment sensor 31 and actuator 37, the in-vehicle device 30 includes a route generation unit 50, a driving support unit 51, a fault detection unit 52, a boarding / alighting range determination unit 53, and a boarding / alighting location determination unit 54. The functions of the route generation unit 50, the driving support unit 51, the fault detection unit 52, the boarding / alighting range determination unit 53, and the boarding / alighting location determination unit 54 are realized, for example, by the processor 36a executing a computer program stored in the storage device 36b.

[0037] The reservation and dispatch unit 40 of the server device 2 receives dispatch requests from users requesting the dispatch of a service vehicle 3. For example, a user may send a dispatch request to the server device 2 from a mobile device or computer. For example, a dispatch request may include information such as the user's identification information, desired pick-up location, destination, and number of passengers. The reservation and dispatch unit 40 selects one of the service vehicles 3a, 3b, etc. to be used by the user. The reservation and dispatch unit 40 transmits the desired pick-up location and destination information to the selected service vehicle 3.

[0038] The route generation unit 50 of the in-vehicle device 30 selects the locations where the user is expected to board and alight from the service vehicle 3 as the planned boarding location and planned alighting location, respectively, based on the information of the desired boarding location and destination received from the reservation dispatch unit 40. For example, the route generation unit 50 may select locations near the desired boarding location and destination received from the reservation dispatch unit 40 where the service vehicle 3 can stop as the planned boarding location and planned alighting location, respectively. The route generation unit 50 generates a target route for the service vehicle 3 based on the planned pick-up location and planned drop-off location.

[0039] For example, the route generation unit 50 may generate a route for the service vehicle 3 to travel from its current location to the scheduled pick-up point to meet the user, and a route for the service vehicle 3 to travel from the scheduled pick-up point to the scheduled drop-off point after the user has boarded the service vehicle 3. The driving support unit 51 assists the service vehicle 3 in traveling along the target driving path generated by the route generation unit 50. For example, the driving support unit 51 may drive the actuator 37 by autonomous driving control to make the service vehicle 3 travel along the target driving path. If the service vehicle 3 is a manually operated vehicle, the generated target path information may be presented to the driver.

[0040] The fault determination unit 52 determines whether any of the multiple sensors included in the surrounding environment sensor 31 have failed. For example, the fault determination unit 52 may determine whether a sensor failed while the user was riding in the service vehicle 3. The fault determination unit 52 transmits information about the failed sensor to the boarding / alighting range determination unit 53 and the verifiable location DB 22 of the server device 2.

[0041] The verifiable location DB22 is a database that stores the "candidate verifiable location" which is a candidate for the verifiable location mentioned above. For example, the verifiable location DB22 may store, for each faulty sensor, a list of candidate verifiable locations where the safety of a user getting in and out of the service vehicle 3 can be confirmed while that sensor is malfunctioning. In other words, it may be a database that stores which location allows for user safety confirmation when a user gets in and out of the vehicle, given that one of the multiple sensors included in the surrounding environment sensor 31 has malfunctioned.

[0042] In the following description, the range or direction in which the surrounding conditions cannot be detected due to a failure of any of the sensors included in the surrounding environment sensor 31 may be referred to as the "undetectable range" or "undetectable direction," respectively. For example, if the left-side sensor fails, the undetectable range may be the detection range Rl, and the undetectable direction may be the left side of the service vehicle 3 (for example, the direction covered by the detection range Rl).

[0043] If the right-side sensor fails, the undetectable range may be the detection range Rr, and the direction of undetectable movement may be to the right of the service vehicle 3 (for example, the direction covered by the detection range Rr). If the front sensor fails, the undetectable range may be the detection range Rf, and the direction of undetectable movement may be in front of the service vehicle 3 (for example, the direction covered by the detection range Rf). If the rear sensor fails, the undetectable range may be the detection range Rr, and the direction of undetectable movement may be behind the service vehicle 3 (for example, the direction covered by the detection range Rr).

[0044] For example, the verifiable location DB22 may store, for each malfunctioning sensor, a location where the service vehicle 3 can be parked while a structure that can prevent a moving object from entering the area where a user gets on or off from an undetectable range or direction is present near the service vehicle, as a candidate for a verifiable location.

[0045] For example, as a candidate location for verification in the event of a failure of the left-side sensor, a location where the service vehicle 3 can be stopped with a structure that can prevent moving objects from entering the area where users get on and off the service vehicle 3 located near the left side of the service vehicle 3 may be stored. For example, as a candidate location for verification in the event of a failure of the left-side sensor, a location where a structure that prevents moving objects from entering the roadway is provided at the road boundary, and where the structure does not obstruct users getting on and off the vehicle, may be stored.

[0046] For example, as a possible location for checking in the event of a malfunction of the right-side sensor, the system may store a location where the service vehicle 3 can be stopped while a structure that can obstruct a moving object entering the area where a user gets on or off the service vehicle 3 is located near the right side of the service vehicle 3. Furthermore, as a possible location for checking in the event of a malfunction of the front sensor, the system may store locations where the service vehicle 3 can be stopped while a structure capable of obstructing a moving object entering the area where a user gets on or off the service vehicle 3 is located near the front of the service vehicle 3.

[0047] Furthermore, as a possible location for checking in the event of a rear sensor failure, the system may store locations where the service vehicle 3 can be stopped while a structure capable of obstructing a moving object entering the area where a user gets on or off the service vehicle 3 is located near the rear of the service vehicle 3. For example, the verifiable location DB22 may also store as candidate verifiable locations a space where a vehicle can be parked and a facility that has personnel to ensure the safety of people around a vehicle parked in that space. For example, the verifiable location DB22 may store as candidates for verifiable locations facilities that have a space where a vehicle can be parked and a facility-side sensor that detects the surrounding conditions of the space.

[0048] The boarding / alighting range determination unit 53 determines the direction in which the safety of a user boarding or alighting from the service vehicle 3 can be confirmed, as well as the range around the service vehicle 3, based on the sensors among the multiple sensors included in the surrounding environment sensor 31 that are not malfunctioning. For example, if the left-side sensor is not malfunctioning, it may be determined that the detection range Rl of the left-side sensor and the direction covered by the detection range Rl are within the range and direction that can confirm the safety of users getting on and off the service vehicle 3. For example, if the right-side sensor is not malfunctioning, it may be determined that the detection range Rr of the right-side sensor and the direction covered by the detection range Rr are within the range and direction that can confirm the safety of users getting on and off the service vehicle 3.

[0049] For example, if the forward sensor is not malfunctioning, it may be determined that the detection range Rf of the forward sensor and the directions covered by the detection range Rf are within a range and direction that allows for the confirmation of the safety of users getting on and off the service vehicle 3. For example, if the rear sensor is not malfunctioning, it may be determined that the detection range Rb of the rear sensor and the directions covered by the detection range Rb are within a range and direction that allows for the confirmation of the safety of users getting in and out of the service vehicle 3. The boarding / alighting area determination unit 53 outputs the determination result to the boarding / alighting location determination unit 54.

[0050] The boarding / alighting location determination unit 54 obtains information from the checkable location DB 22 regarding candidate checkable locations corresponding to the malfunctioning sensor. Based on the information obtained from the checkable location DB 22 regarding candidate checkable locations and the determination result of the boarding / alighting range determination unit 53, the boarding / alighting location determination unit 54 determines whether the safety of users boarding and alighting from the service vehicle 3 at the planned boarding / alighting location can be confirmed even with the sensor malfunctioning. In other words, it determines whether the planned boarding / alighting location is a checkable location. In the following explanation, confirming the safety of users boarding and alighting from the service vehicle 3 with the sensor malfunctioning may be referred to as "safety confirmation with a malfunctioning sensor."

[0051] For example, the boarding / alighting location determination unit 54 may transmit location information of the planned boarding / alighting location or the current location information of the service vehicle 3 to the verifiable location DB 22, and receive information from the verifiable location DB 22 regarding verifiable location candidates corresponding to the malfunctioning sensor, from among the verifiable location candidates that are within a predetermined distance range from the planned boarding / alighting location or the current location of the service vehicle 3.

[0052] Information regarding potential verifiable locations may include at least location information of the potential verifiable locations. If none of the potential verifiable locations received from the verifiable location DB22 are planned boarding / alighting locations, the boarding / alighting location determination unit 54 determines that safety confirmation cannot be performed at the planned boarding / alighting locations in the event of a sensor malfunction (determining that the planned boarding / alighting locations are not verifiable locations).

[0053] If information is received regarding a candidate verifiable location at the same position as the planned boarding / alighting location, the boarding / alighting location determination unit 54 may determine whether safety can be confirmed at the planned boarding / alighting location even if the sensor is malfunctioning, as follows: If the received candidate for a verifiable location is a facility that has personnel to check the safety of people around a vehicle parked in a parking space, or a facility-side sensor that detects the surrounding conditions of a parking space, the boarding / alighting location determination unit 54 determines that safety can be checked at the planned boarding / alighting location even if the sensor is malfunctioning (determining that the planned boarding / alighting location is a verifiable location).

[0054] In the case of a candidate verifiable location that has a structure that can obstruct a moving object entering the area where a user gets on or off, the information regarding the candidate verifiable location may include, for example, information indicating the range and direction to which the structure can obstruct a moving object when the service vehicle 3 is parked at the candidate verifiable location.

[0055] The boarding / alighting location determination unit 54 determines whether all possible ranges or directions in which a moving object could enter the location where an occupant boards or alights from the service vehicle 3 are covered by considering the range or direction in which a moving object could be obstructed by a structure and the range or direction in which safety can be confirmed by a non-malfunctioning sensor. If the entire range or direction in which a moving object that can enter the place where the occupants board or alight may exist is covered, the boarding / alighting location determination unit 54 may determine that safety can be confirmed at the planned boarding / alighting location even if the sensor is malfunctioning (the planned boarding / alighting location is a verifiable location). If the range is not covered, the unit may determine that safety cannot be confirmed (the planned boarding / alighting location is not a verifiable location).

[0056] For example, if only the left-side sensor is malfunctioning, and there is a structure on the left side that could be an obstacle to a moving object, it can be determined that there is no moving object entering the area where the user gets on or off, and that the safety of the user getting on or off the service vehicle 3 can be confirmed.

[0057] Furthermore, for example, if only the right-side sensor is malfunctioning, and there is a structure on the right side that would be an obstacle to a moving object, it can be determined that there is no moving object entering the area where the user gets on or off, and that the safety of the user getting on or off the service vehicle 3 can be confirmed.

[0058] If only the forward sensor is malfunctioning, and there is a structure in front that acts as an obstacle to the moving object, it is acceptable to assume that there is no moving object entering the area where the user gets on or off, and to determine that the safety of the user getting on or off the service vehicle 3 can be confirmed. If only the rear sensor is malfunctioning, and there is a structure behind the vehicle that could be an obstacle to a moving object, it is reasonable to conclude that there is no moving object entering the area where the user gets on or off, and that the safety of the user getting on or off the service vehicle 3 can be confirmed.

[0059] If the driving support unit 51 determines that safety can be confirmed even with a sensor malfunction at the scheduled boarding / alighting location, it will continue to support the driving of the service vehicle 3 to the scheduled boarding / alighting location. When the service vehicle 3 arrives at the scheduled boarding / alighting location, the driving support unit 51 may drive the door actuator to open the boarding / alighting door or drive the door lock actuator to unlock the boarding / alighting door.

[0060] If the planned boarding / alighting location is a facility with personnel to ensure the safety of people around a vehicle parked in a designated parking space, the driving support unit 51 may send a notification or signal to call the facility's personnel when the user boards or alights. Furthermore, if the planned pick-up / drop-off location is a facility equipped with facility-side sensors that detect the surrounding conditions of the parking space, the safety of users getting on and off the service vehicle 3 may be confirmed using the facility-side sensors.

[0061] For example, a safety confirmation device installed at the facility may perform a safety check on users getting on or off the service vehicle 3 based on the detection results of facility-side sensors, and transmit the safety confirmation results to the service vehicle 3. If safety is confirmed by the facility's safety confirmation device, the driving support unit 51 may drive the door actuator to open the boarding / alighting door, or drive the door lock actuator to unlock the boarding / alighting door.

[0062] Alternatively, the driving support unit 51 may receive detection results (e.g., captured images) from facility-side sensors and perform safety checks for users getting on and off the service vehicle 3 based on the received detection results. If safety is confirmed, the driving support unit 51 may drive the door actuator to open the entry / exit door or drive the door lock actuator to unlock the entry / exit door.

[0063] Furthermore, when performing safety checks for users getting on and off the service vehicle 3 using facility-side sensors, the driving support unit 51 may perform safety checks for users getting on and off the service vehicle 3 by combining the detection results of the remaining non-faulty sensors among the multiple sensors included in the surrounding environment sensor 31 with the detection results of the facility-side sensors that detect the status of undetectable ranges and directions.

[0064] On the other hand, if it is determined that safety cannot be confirmed at the planned boarding / alighting location due to a sensor malfunction (i.e., if it is determined that the planned boarding / alighting location is not a verifiable location), the boarding / alighting location determination unit 54 receives information from the verifiable location DB 22 regarding verifiable location candidates corresponding to the malfunctioning sensor, from among the verifiable location candidates that exist around the current location of the service vehicle 3 or along the target travel route from the current location of the service vehicle 3 to the planned boarding / alighting location.

[0065] The boarding / alighting location determination unit 54 determines, for each of the verifiable location candidates received from the verifiable location DB 22, whether or not safety checks can be performed in the event of a sensor malfunction at each verifiable location candidate, and selects the verifiable location candidates in which safety checks can be performed in the event of a sensor malfunction as verifiable locations. The method for determining whether or not safety checks can be performed in the event of a sensor malfunction at a verifiable location candidate (i.e., the method for selecting a verifiable location from the verifiable location candidates) may be the same as the method for determining whether or not safety checks can be performed in the event of a sensor malfunction at a planned boarding / alighting location (the method for determining whether a planned boarding / alighting location is a verifiable location).

[0066] The boarding / alighting location determination unit 54 outputs the selected verifiable location to the route generation unit 50. The route generation unit 50 changes the user's boarding / alighting location to a verifiable location and regenerates the target driving route from the service vehicle 3's current location to the verifiable location (the changed boarding / alighting location). In other words, it changes the target driving route of the service vehicle 3 to a route that travels from its current location to the verifiable location. The driving support unit 51 assists the service vehicle 3 in driving along the modified target driving route regenerated by the route generation unit 50.

[0067] When the service vehicle 3 arrives at the modified boarding / alighting location, the driving support unit 51 may drive the door actuator to open the boarding / alighting door or drive the door lock actuator to unlock the boarding / alighting door. If the boarding / alighting location is a facility with personnel to ensure the safety of people around a vehicle parked in a parking space, the driving support unit 51 may send a notification or signal to call facility personnel when a user boards or alights. If the boarding / alighting location is a facility with facility-side sensors that detect the surrounding conditions of the parking space, the facility-side sensors may be used to perform safety checks on users boarding or alighting from the service vehicle 3.

[0068] In the above description, the boarding / alighting location determination unit 54 obtained information about verifiable locations from the verifiable location DB 22. However, the boarding / alighting location determination unit 54 may also determine whether safety can be confirmed at the planned alighting location in the event of a sensor malfunction, or select verifiable locations, based on the map information in the map DB 21.

[0069] For example, the boarding / alighting location determination unit 54 may determine whether safety can be confirmed in the event of a sensor malfunction at the planned boarding / alighting location, or select a location where confirmation is possible, based on the location information of structures (e.g., curbs, guardrail chain poles, ditches, walls, etc.) included in the map DB 21 and the determination result of the boarding / alighting possible range determination unit 53. The boarding / alighting location determination unit 54 may also obtain information from the map DB 21 about facilities that have personnel to confirm the safety of people around a vehicle parked in a parking space, or facilities that have facility-side sensors to detect the surrounding conditions of a parking space.

[0070] (operation) Figure 5 is a flowchart of an example of a driving assistance method according to the first embodiment. In step S1, the route generation unit 50 selects planned pick-up and drop-off locations (planned pick-up location and planned drop-off location) based on the information of the desired pick-up location and destination specified by the user. In step S2, the route generation unit 50 generates a route from the current location to the planned boarding location and a route from the planned boarding location to the planned alighting location as the target travel route. In step S3, the driving support unit 51 assists the service vehicle 3 in driving along the target driving route.

[0071] In step S4, the fault detection unit 52 determines whether a fault has occurred in any of the surrounding environment sensors 31. If no fault occurs (step S4:N), the process returns to step S4. In this case, the driving support unit 51 continues to provide assistance for driving to the planned boarding / alighting location.

[0072] If a failure occurs (step S4:Y), the process proceeds to step S5. In step S5, the boarding / alighting location determination unit 54 determines whether safety can be confirmed at the planned boarding / alighting location in the event of a sensor malfunction. That is, the boarding / alighting location determination unit 54 determines whether the planned boarding / alighting location is a verifiable location. If the planned boarding / alighting location is not a verifiable location (step S5:N), the process proceeds to step S7. If the planned boarding / alighting location is a verifiable location (step S5:Y), the process proceeds to step S6. In step S6, the driving support unit 51 continues to provide assistance for driving to the planned boarding / alighting location.

[0073] In step S7, the boarding / alighting location determination unit 54 selects a verifiable location located in the vicinity of the current position of the service vehicle 3 or on the target travel route from the current position of the service vehicle 3 to the planned boarding / alighting location. In step S8, the route generation unit 50 changes the user's boarding and alighting location to a verifiable location and changes the target route of the service vehicle 3 to a route that travels from the current location to the verifiable location (the changed boarding and alighting location). In step S9, the driving support unit 51 assists in driving to the verifiable location (the changed boarding / alighting location).

[0074] (Second Embodiment) For example, a malfunction in any of the surrounding environment sensors 31 may make it difficult to assist in driving to the planned drop-off location. For instance, if there is a left turn on the target driving route from the current location to the planned drop-off location, and the left-side sensor malfunctions, autonomous driving control to the planned drop-off location may become impossible. In such cases, the in-vehicle device 30 of the second embodiment may obtain information on verifiable locations near the current location from the verifiable location DB 22. Alternatively, it may select verifiable locations based on the map information in the map DB 21 and the determination result of the boarding / alighting range determination unit 53.

[0075] If the verifiable location obtained from the verifiable location DB22 or map DB21 is far from the planned drop-off location, the server device 2 selects another service vehicle 3 for the user to transfer to from the service vehicle 3 that the user is currently riding in (i.e., the service vehicle in which the surrounding environment sensor 31 has malfunctioned). In the following explanation, the service vehicle 3 in which the user is riding at the time the surrounding environment sensor 31 malfunctions will be referred to as "service vehicle 3a," and other service vehicles 3 other than service vehicle 3a will be referred to as "other service vehicles 3b."

[0076] The onboard device 30 of the service vehicle 3a assists in the driving of the service vehicle 3a from its current location to a location where it can be confirmed, and performs safety checks on users who disembark at the location where it can be confirmed. The onboard device 30 of the other service vehicle 3b assists in the driving of the other service vehicle 3b from its current location to a verifiable location. When the user transfers from service vehicle 3a to the other service vehicle 3b at the verifiable location, the onboard device 30 of the other service vehicle 3b assists in the driving of the other service vehicle 3b from the verifiable location to the planned drop-off location.

[0077] Figure 6 is a flowchart of an example of a driving assistance method according to the second embodiment. The processing from step S10 to step S13 is the same as the processing from step S1 to S4 in Figure 5. If a malfunction of the surrounding environment sensor 31 of the service vehicle 3a is detected in step S13 (step S13:Y), the process proceeds to step S14. In step S14, the driving support unit 51 of the service vehicle 3a determines whether it is possible to continue driving the service vehicle 3a to the planned drop-off location even if the surrounding environment sensor 31 fails. If it is possible to continue driving (step S14:Y), the subsequent processing is the same as in steps S5 to S9 of Figure 5. However, "planned boarding / drop-off location" in steps S5 to S7 and "boarding / drop-off location" in steps S8 and S9 are read as "planned drop-off location" and "drop-off location," respectively. If it is not possible to continue driving (step S14:N), the process proceeds to step S15.

[0078] In step S15, the boarding / alighting location determination unit 54 for the service vehicle 3a selects the closest verifiable location to the service vehicle 3a's current location from among the verifiable locations that exist on the target travel route from the service vehicle 3a's current location to the planned alighting location. In step S16, the route generation unit 50 of the service vehicle 3a changes the drop-off location where the user will disembark from the service vehicle 3a to a verifiable location, and changes the target driving route of the service vehicle 3a to a route that travels from its current location to the verifiable location. The driving support unit 51 of the service vehicle 3a assists the service vehicle 3a in driving to the verifiable location (the changed drop-off location).

[0079] In step S17, the driving support unit 51 of the service vehicle 3a requests the reservation dispatch unit 40 of the server device 2 to arrange a replacement vehicle to take the user to the originally scheduled drop-off location. The reservation dispatch unit 40 selects another service vehicle 3b as the replacement vehicle to take the user to the scheduled drop-off location. The reservation dispatch unit 40 of the server device 2 transmits location information of the verifiable location (i.e., the changed drop-off location of service vehicle 3a) and the planned drop-off location to other service vehicles 3b.

[0080] The route generation unit 50 of the other service vehicle 3b generates a target route for the other service vehicle 3b to travel from its current location to a verifiable location to pick up the user, and a target route for the user to travel from the verifiable location to the planned drop-off location. The driving support unit 51 of the other service vehicle 3b assists in traveling along the target route to the verifiable location.

[0081] In step S18, when the user switches from service vehicle 3a to another service vehicle 3b, the driving support unit 51 of the other service vehicle 3b assists the driving of the other service vehicle 3b from the verifiable location to the planned drop-off location in step S19.

[0082] (Third embodiment) In the third embodiment, if the surrounding environment sensor 31 of the service vehicle 3a malfunctions, and the planned boarding / alighting location is not a verifiable location, and information on verifiable locations cannot be obtained from the verifiable location DB 22 (or a verifiable location cannot be selected based on the map information in the map DB 21 and the determination result of the boarding / alighting range determination unit 53), the onboard device 30 of the service vehicle 3a will have another service vehicle 3b follow the service vehicle 3a, and the surrounding environment sensor 31 of the other service vehicle 3b will detect the surrounding conditions of the service vehicle 3a on which the user will be riding, thereby performing a safety check for passengers boarding or alighting from the service vehicle 3a.

[0083] Furthermore, if safety checks are performed using the surrounding environment sensors 31 of other service vehicles 3b and it is determined that the location where the user disembarks from service vehicle 3a is far from the planned disembarkation location, the system will permit the user to board the other service vehicle 3b and assist the user in getting from the location where they disembarked from service vehicle 3a to the planned disembarkation location.

[0084] Figure 7 is a flowchart of an example of a driving assistance method according to the third embodiment. The processing from step S20 to step S23 is the same as the processing from steps S1 to S4 in Figure 5. If a malfunction of the surrounding environment sensor 31 of the service vehicle 3a is detected in step S23 (step S23:Y), the process proceeds to step S24.

[0085] In step S24, the boarding / alighting location determination unit 54 determines whether or not it can obtain information on verifiable locations from the verifiable location DB 22 (or whether or not it can select a verifiable location based on the map information in the map DB 21 and the determination result of the boarding / alighting range determination unit 53). If information about a verifiable location cannot be obtained (or a verifiable location cannot be selected) (step S24:N), the process proceeds to step S27. If information about a verifiable location can be obtained (or a verifiable location can be selected) (step S24:Y), the process proceeds to step S25.

[0086] The processing in steps S25 and S26 is the same as the processing in steps S8 and S9 in Figure 5. If the verifiable location is far from the planned drop-off location, the user may be transported to the planned drop-off location by another service vehicle 3b, as in the second embodiment. In step S27, the boarding / alighting location determination unit 54 requests the reservation dispatch unit 40 of the server device 2 to arrange for another service vehicle 3b to assist in ensuring the safety of passengers boarding and alighting from the service vehicle 3a.

[0087] In step S28, the reservation dispatch unit 40 of the server device 2 transmits the current location information of service vehicle 3a to the other service vehicle 3b. The route generation unit 50 of the other service vehicle 3b generates a route that travels from the current location of the other service vehicle 3b to the current location of service vehicle 3a, and follows service vehicle 3a, as the target travel route for the other service vehicle 3b. Alternatively, the route generation unit 50 of the other service vehicle 3b may obtain information on the target travel route of service vehicle 3a from service vehicle 3a via the server device 2 and generate the target travel route that follows service vehicle 3a.

[0088] When the other service vehicle 3b catches up with service vehicle 3a, the driving support units 51 of service vehicle 3a and the other service vehicle 3b will stop service vehicle 3a and the other service vehicle 3b respectively at a position where users can get on and off. In step S29, the surrounding environment sensor 31 of another service vehicle 3b detects the surrounding conditions of the service vehicle 3a in which the user is riding, thereby performing a safety check for passengers getting on and off the service vehicle 3a.

[0089] For example, the onboard device 30 of another service vehicle 3b may use the surrounding environment sensor 31 of the other service vehicle 3b to perform a safety check on passengers getting on and off the service vehicle 3a, and transmit the results of the safety check to the service vehicle 3a. Alternatively, for example, the driving support unit 51 of the service vehicle 3a may receive detection results (e.g., captured images) from the surrounding environment sensor 31 of the service vehicle 3b, and perform safety checks for users getting on and off the service vehicle 3a based on the received detection results.

[0090] Furthermore, the driving support unit 51 of the service vehicle 3a may perform safety checks for users getting on and off the service vehicle 3 by combining the detection results of the remaining non-faulty sensors among the multiple sensors included in the surrounding environment sensor 31 with the detection results of sensors of other service vehicles 3b that detect conditions in undetectable ranges and directions.

[0091] If, as a result of the safety check in step S29, the location where the user disembarks from service vehicle 3a is far from the planned disembarkation location, the user will transfer from service vehicle 3a to another service vehicle 3b in step S30, thereby continuing the passenger transport service by the other service vehicle 3b. In step S31, the reservation dispatch unit 40 of the server device 2 transmits location information of the planned drop-off location to the other service vehicle 3b. The route generation unit 50 of the other service vehicle 3b generates a target route from the current location of the other service vehicle 3b to the planned drop-off location. The driving support unit 51 of the other service vehicle 3b assists in driving to the planned drop-off location along the target route.

[0092] In the third embodiment, infrastructure sensors installed along the road as infrastructure equipment may be used to detect the surrounding conditions of the service vehicle 3a in which the user is riding, thereby ensuring the safety of passengers getting on and off the service vehicle 3a. For example, the driving support unit 51 of the service vehicle 3a may receive detection results (e.g., captured images) from the infrastructure sensors of the service vehicle 3b and perform safety checks for users getting on and off the service vehicle 3a based on the received detection results.

[0093] In this case, the driving support unit 51 of the service vehicle 3a may perform a safety check for users getting on and off the service vehicle 3 by combining the detection results of the remaining non-faulty sensors among the multiple sensors included in the surrounding environment sensor 31 with the detection results of the infrastructure sensor that detects the status of undetectable ranges and directions.

[0094] (Effects of the embodiment) (1) In the driving assistance method, it is determined whether any of the multiple sensors mounted on the vehicle that detect the surrounding conditions of the vehicle have malfunctioned. If any of the sensors have malfunctioned, it is determined, based on the non-malfunctioning sensors or the map database, whether the planned drop-off location where the vehicle occupants are scheduled to get out of the vehicle, or the planned boarding location where the vehicle occupants are scheduled to board, is a verifiable location where the safety of the occupants getting out of or boarding the vehicle can be confirmed in the event that any of the sensors have malfunctioned. If the planned drop-off location or planned boarding location is not a verifiable location, a verifiable location near the planned drop-off location or planned boarding location is obtained from the map database, and the vehicle is assisted in driving to the obtained verifiable location. This ensures that even if the sensors that detect the surrounding conditions of the vehicle malfunction, the occupants can still disembark after safety checks have been performed.

[0095] (2) The locations where confirmation is possible may be any locations where a moving object cannot enter the area where an occupant gets off or on the vehicle from an area or direction where the surrounding conditions cannot be detected due to a malfunction of any sensor. This ensures that even if an area or direction where the surrounding conditions cannot be detected occurs due to a sensor malfunction, the safety of occupants getting on or off the vehicle can be confirmed by guaranteeing that no moving object will enter from such an area or direction.

[0096] (3) The locations where confirmation is possible may be any location where a structure is provided at the road boundary to prevent moving objects from entering the roadway, and where the structure does not obstruct the boarding or alighting of occupants. This makes it possible to select a location where moving objects cannot enter the area where occupants board or alight from the vehicle from a range or direction in which the surrounding conditions cannot be detected.

[0097] (4) The location where confirmation is possible may be a facility that has a space where a vehicle can be parked and personnel to confirm the safety of people around the parked vehicle. For example, personnel may be called in when passengers get on or off the vehicle. This ensures that the safety of passengers getting on or off the vehicle can be confirmed even if the sensors that detect the surrounding conditions of the vehicle are malfunctioning.

[0098] (5) The location where confirmation is possible may be a facility having a space where a vehicle can be parked and a facility-side sensor that detects the surrounding conditions of the space. Based on the detection results from the facility-side sensor, safety confirmation of occupants getting on and off the vehicle may be performed, and the safety confirmation results may be transmitted from the facility to the vehicle. Alternatively, the detection results from the facility-side sensor may be received by the vehicle, and based on the received detection results, safety confirmation of occupants getting on and off the vehicle may be performed on the vehicle side. This ensures that safety confirmation of occupants getting on and off the vehicle can be performed even if the sensor that detects the surrounding conditions of the vehicle is malfunctioning.

[0099] (6) If any sensor malfunctions while an occupant is in the vehicle, the system may obtain a verifiable location near the vehicle's current position from a map database. If the verifiable location obtained from the map database is far from the planned drop-off location, the system may assist the occupant in transferring to another vehicle, and assist the other vehicle in traveling to the verifiable location and then from the verifiable location to the planned drop-off location. This ensures that even if assistance is not possible for the vehicle to travel to the planned drop-off location due to a malfunction of multiple sensors that detect the vehicle's surroundings, the occupant can still be transported to the planned drop-off location by another vehicle.

[0100] (7) If the planned boarding / alighting location is not a verifiable location and a verifiable location cannot be obtained from the map database, the vehicle may be supported by another vehicle following behind it, and the surrounding conditions of the vehicle may be detected by sensors mounted on the other vehicle to ensure the safety of passengers boarding or alighting from the vehicle. This ensures the safety of passengers boarding or alighting from the vehicle even if a verifiable location cannot be obtained from the map database.

[0101] (8) If safety checks are performed using sensors mounted on other vehicles and the location where the occupant disembarks from the vehicle is far from the planned disembarkation location, the occupant may be permitted to board the other vehicle and assistance may be provided for the other vehicle to travel from the location where the occupant disembarked to the planned disembarkation location. This prevents the convenience of the occupant from traveling from the disembarkation location to their destination from being compromised, even if the location where the occupant disembarks after safety checks using sensors on other vehicles is far from the planned disembarkation location.

[0102] (9) If any sensor malfunctions, the system may determine an undetectable range or direction in which the surrounding conditions cannot be detected, and use the detection results of infrastructure sensors, sensors on other vehicles, or sensors on facilities where the vehicle can stop to perform safety checks for occupants getting on and off the vehicle. This ensures that safety checks for occupants getting on and off the vehicle can be performed even if the sensors that detect the surrounding conditions of the vehicle malfunction.

[0103] (10) Multiple sensors may be sensors capable of detecting moving objects that may enter the area where occupants get on and off the vehicle. This allows for safety checks of occupants getting on and off the vehicle using sensors mounted on the vehicle that detect the surrounding conditions. [Explanation of Symbols]

[0104] 1... Dispatch system, 2... Server device, 3a... Service vehicle, 3b... Service vehicle, 5... Moving object, 20, 35... Communication device, 21, 34... Map database, 22... Confirmable location database, 23... Calculation processing unit, 23a, 36a... Processor, 23b, 36b... Storage device, 30... In-vehicle device, 31... Surrounding environment sensor, 32... Vehicle sensor, 33... Positioning device, 36... Controller, 37... Actuator, 40... Reservation dispatch unit, 50... Route generation unit, 51... Driving support unit, 52... Fault detection unit, 53... Boarding / alighting range determination unit, 54... Boarding / alighting location determination unit

Claims

1. It is determined whether any of the multiple sensors mounted on the vehicle that detect the surrounding conditions of the vehicle have malfunctioned. If any of the aforementioned sensors fail, the system will determine, based on the non-faulty sensors among the multiple sensors or the map database, whether the planned disembarking location (where the vehicle's occupants are scheduled to alight from the vehicle) or the planned boarding location (where the vehicle's occupants are scheduled to board) is a verifiable location where the safety of the occupants disembarking from or boarding the vehicle can be confirmed in the event of a sensor failure. If the aforementioned planned drop-off location or planned pick-up location is not a verifiable location, the verifiable location located near the aforementioned planned drop-off location or pick-up location is obtained from the map database. Supporting the vehicle's journey to the acquired verifiable location, A driving assistance method characterized by the following.

2. The driving assistance method according to claim 1, characterized in that the verifiable location is a location from which a moving object cannot enter the place where the occupant disembarks from or boards the vehicle, from a range or direction in which the surrounding conditions cannot be detected due to a malfunction of any of the sensors.

3. The driving assistance method according to claim 2, characterized in that the aforementioned verifiable location is a location where a structure preventing the entry of moving objects onto the roadway is provided at the road boundary, and the structure does not obstruct the disembarking or boarding of the occupants.

4. The driving support method according to claim 1, characterized in that the location where confirmation is possible is a facility having a space where the vehicle can be parked and personnel to confirm the safety of people around the vehicle parked in the space.

5. The driving support method according to claim 4, characterized in that the personnel are called when the occupant disembarks or boards the vehicle.

6. The aforementioned location where verification is possible is a facility having a space where the vehicle can be parked and a facility-side sensor that detects the surrounding conditions of the space. Based on the detection results from the facility's sensors, the facility performs a safety check on the occupants disembarking from or boarding the vehicle, and transmits the results of the safety check from the facility to the vehicle. The driving assistance method according to feature 1.

7. The aforementioned location where verification is possible is a facility having a space where the vehicle can be parked and a facility-side sensor that detects the surrounding conditions of the space. The vehicle receives the detection result from the facility-side sensor, and based on the received detection result, the vehicle performs a safety check of the occupant getting off or on the vehicle. The driving assistance method according to feature 1.

8. If any of the sensors malfunction while an occupant is in the vehicle, the verifiable locations near the vehicle's current position are obtained from the map database. If the verifiable location obtained from the map database is far from the planned disembarkation location, the passenger will select another vehicle to transfer to from the vehicle. The driving assistance method according to claim 1, characterized in that it assists the driving of the other vehicle to the location where confirmation is possible, and the driving of the other vehicle from the location where confirmation is possible to the planned disembarking location.

9. If the aforementioned planned drop-off location or planned pick-up location is not a verifiable location and the verifiable location cannot be obtained from the map database, the vehicle shall assist other vehicles in following the vehicle. By detecting the surrounding conditions of the vehicle using sensors mounted on the other vehicle, the system performs safety checks on the occupants disembarking from or boarding the vehicle. The driving assistance method according to feature 1.

10. The driving support method according to claim 9, characterized in that, by performing a safety check using sensors mounted on the other vehicle, if the place where the occupant disembarked from the vehicle is far from the planned disembarkation location, the method permits the occupant to board the other vehicle and supports the other vehicle's journey from the place where the occupant disembarked to the planned disembarkation location.

11. If any of the aforementioned sensors fail, determine the undetectable range or direction in which the surrounding conditions cannot be detected. Using the detection results from infrastructure sensors, sensors of other vehicles, or sensors of facilities where the vehicle can stop, which are capable of detecting conditions in the undetectable range or direction, the safety of the occupants disembarking from or boarding the vehicle is confirmed. The driving assistance method according to feature 1.

12. The driving assistance method according to claim 1, characterized in that the plurality of sensors are sensors capable of detecting moving objects that may enter the area where the occupant disembarks from or gets into the vehicle.

13. Multiple sensors mounted on the vehicle to detect the surrounding conditions of the vehicle, The system determines whether any of the multiple sensors have failed, and if any of the sensors have failed, it determines, based on the non-failed sensors or the map database, whether the planned disembarking location where the vehicle's occupants are scheduled to alight from the vehicle, or the planned boarding location where the occupants are scheduled to board the vehicle, is a verifiable location where the safety of the occupants alighting from or boarding the vehicle can be confirmed in the event of a sensor failure, or whether the planned disembarking location is a verifiable location. If the planned disembarking location is not a verifiable location, the system obtains a verifiable location near the planned disembarking location or boarding location from the map database and provides a controller to assist the vehicle in traveling to the obtained verifiable location. A driving assistance device characterized by being equipped with the following features.

Images