Vehicle Control Systems

Abstract

[Problem] To enable the handling of malfunctions of a server device in a control system for a vehicle that uses the server device to control traveling of the vehicle. [Solution] A control system 1 includes: a plurality of vehicles 2 that each include a travel control unit 12 capable of generating control values for controlling the traveling of a vehicle that is a host vehicle; and a server device 3 that generates and sends an individual remote control value for each of the plurality of vehicles 2. Each travel control unit 12 uses the individual remote control value, received from the server device 3 and designated for the host vehicle, to generate control values for controlling the traveling of the host vehicle. The travel control units 12 each determine the presence / absence of a malfunction of the server device 3 and, if there is no malfunction in the server device 3, execute back-up travel control for generating control values by using the individual remote control value received from the server device 3. If there is a malfunction in the server device 3, the travel control units 12 each execute autonomous travel control for generating control values by using information from a sensor of the host vehicle or information from manual operations.

Description

[Technical field]

[0001] The present invention relates to a vehicle control system. [Background technology]

[0002] It has been proposed to use a server device for driving control of a vehicle such as an automobile (Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2021 / 038741 Summary of the Invention [Problem to be solved by the invention]

[0004] Incidentally, when attempting to control vehicle travel using a server device in this manner, the traffic control system basically executes the following control. The server device acquires driving information about the plurality of vehicles, generates individual control information for each of the plurality of vehicles based on the acquired information, and transmits each individual control information to each of the plurality of vehicles. When each automobile receives the individual control information addressed to its own automobile, it uses the individual control information to generate control values ​​to be actually used for driving control of its own automobile, and executes driving control using the generated control values. It is expected that by repeatedly executing the control of the server device and the control of each of the multiple vehicles, each vehicle will be able to drive with improved safety, etc. under the control of the server device.

[0005] However, it is difficult to deny that there is a possibility that a malfunction may occur in the server device while a plurality of vehicles are controlling their respective driving under the control of such a server device. For example, in a server device, it is generally considered that there is a non-zero possibility that inconsistencies will occur in the programs used on the server device. For example, there is a non-zero possibility that inconsistencies between programs will occur on the server device due to program bugs or program updates. In addition, the server device must be connected to a communication network. As a result, the server device may be subject to unauthorized access from outside. There is also a possibility that the server device may be hijacked and programs may be rewritten. Even if such a problem occurs in the server device, vehicles that are actually traveling on the road are required to travel safely. Also, each vehicle is required to travel in a manner that does not impede the travel of other vehicles.

[0006] In a vehicle control system that uses a server device for vehicle driving control in this way, it is required to be able to respond to malfunctions of the server device for each vehicle that can run under the control of the server device. [Means for solving the problem]

[0007] A vehicle control system according to one aspect of the present invention includes a plurality of vehicles each having a driving control unit capable of generating a control value for controlling driving of the vehicle itself, and a server device that generates individual remote control values ​​for each of the plurality of vehicles based on driving information about the plurality of vehicles and transmits the individual remote control values ​​to the plurality of vehicles, wherein the driving control unit of each of the plurality of vehicles generates a control value for driving control of the vehicle itself using the individual remote control value addressed to the vehicle itself received from the server device, and the driving control unit of each of the plurality of vehicles: By comparing the individual remote control value received from the server device with the control value generated by the autonomous driving control in the vehicle,The device determines whether or not there is a malfunction in the server device, and if it is determined that there is no malfunction in the server device, it executes a secondary driving control that generates the control value using the individual remote control value received from the server device together with information from the vehicle's sensors, and if it is determined that there is a malfunction in the server device, it executes an autonomous driving control that generates the control value using information from the vehicle's sensors or information from manual operation, without using the individual remote control value received from the server device. A vehicle control system according to one embodiment of the present invention includes a plurality of vehicles each having a driving control unit capable of generating a control value for controlling the driving of the vehicle itself, and a server device that generates an individual remote control value for each of the plurality of vehicles based on driving information for the plurality of vehicles and transmits the individual remote control value to the plurality of vehicles, wherein the driving control unit of each of the plurality of vehicles generates a control value for driving control of the vehicle itself using the individual remote control value addressed to the vehicle itself received from the server device. The vehicle control system includes a driving control unit for each of the plurality of vehicles that determines whether or not there is a malfunction with the server device, and if it is determined that there is no malfunction with the server device, performs a secondary driving control that generates the control value using the individual remote control value received from the server device together with information from the vehicle's sensor, and if it is determined that there is a malfunction with the server device, performs a driving control that generates the control value using information from the vehicle's sensor or information obtained by manual operation without using the individual remote control value received from the server device, and the driving control generates the control value that suppresses changes in driving compared to the case where the individual remote control value received from the server device is used as the control value as is. A vehicle according to one embodiment of the present invention includes a plurality of Car The vehicle communication device communicates with a server device that generates individual remote control values ​​for each of the plurality of vehicles based on driving information for the vehicles and transmits the individual remote control values ​​to the plurality of vehicles, a vehicle sensor provided in the vehicle, and a driving control unit that is capable of generating a control value for controlling driving of the vehicle that is the vehicle itself, using the individual remote control value addressed to the vehicle that the vehicle communication device receives from the server device, and the driving control unit is By comparing the individual remote control value received from the server device with the control value generated by the autonomous driving control in the vehicle, The device determines whether or not there is a malfunction in the server device, and if it is determined that there is no malfunction in the server device, it executes a secondary driving control that generates the control value using the individual remote control value received from the server device together with information from the vehicle's sensors, and if it is determined that there is a malfunction in the server device, it executes an autonomous driving control that generates the control value using information from the vehicle's sensors or information from manual operation, without using the individual remote control value received from the server device. A vehicle according to one embodiment of the present invention has a vehicle communication device that communicates with a server device that generates individual remote control values ​​for each of a plurality of vehicles based on driving information for the plurality of vehicles and transmits the individual remote control values ​​to the plurality of vehicles, a vehicle sensor provided in the vehicle, and a driving control unit that is capable of generating a control value for controlling driving of the vehicle that is the vehicle itself using the individual remote control value addressed to the vehicle that the vehicle communication device receives from the server device. The driving control unit determines whether or not there is a malfunction in the server device, and if it is determined that there is no malfunction in the server device, performs a secondary driving control that generates the control value using the individual remote control value received from the server device together with information from the vehicle sensor, and if it is determined that there is a malfunction in the server device, performs driving control that generates the control value using information from the vehicle sensor or information generated by manual operation without using the individual remote control value received from the server device, and the driving control generates the control value that suppresses changes in driving compared to a case in which the individual remote control value received from the server device is used as the control value as is. A server device according to one aspect of the present invention includes a server communication device that communicates with a plurality of vehicles, each of which has a driving control unit capable of generating a control value for controlling the driving of the vehicle, and a server control unit that generates individual remote control values ​​for each of the plurality of vehicles based on driving information about the plurality of vehicles received by the server communication device, and transmits the individual remote control values ​​from the server communication device to each of the plurality of vehicles. The server control unit transmits the individual remote control values ​​to a malfunction determination vehicle among the plurality of vehicles. ,saWhen a determination result indicating a malfunction of the server device is received, the information for driving control to be transmitted to the vehicle determined to have a malfunction is switched from the individual remote control value which can be used as is for driving control of the vehicle determined to have a malfunction to individual control information including a request for driving control of the vehicle. Effect of the Invention

[0008] In the present invention, in each of a plurality of vehicles, a driving control unit capable of generating a control value for controlling the driving of the vehicle judges whether or not there is a malfunction in the server device. If it is not judged that there is a malfunction in the server device, the driving control unit executes a subordinate driving control to generate a control value using information from the vehicle sensor and an individual remote control value received from the server device. This allows each vehicle to drive according to the individual remote control value of the server device that is not judged to have a malfunction. Moreover, when the driving control unit determines that the server device is defective, the driving control unit executes autonomous driving control to generate a control value using information from the vehicle's own sensor or information from manual operation. At this time, the driving control unit generates the control value without using the individual remote control value received from the server device determined to be defective. This allows each vehicle to not drive according to the individual remote control value of the server device determined to be defective.

[0009] Thus, in the present invention, each vehicle in a vehicle control system that uses a server device for vehicle driving control can deal with any malfunction of the server device. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a configuration diagram of an automobile control system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is an explanatory diagram of the control system of the automobile of FIG. [Diagram 3] FIG. 3 is an explanatory diagram of a basic hardware configuration of the vehicle driving control device of FIG. [Figure 4] FIG. 4 is a basic flowchart of autonomous driving control by the vehicle driving control device of FIG. [Diagram 5] FIG. 5 is a hardware configuration diagram of the server device of FIG. [Figure 6] FIG. 6 is a basic timing chart for individual control of a plurality of automobiles in the control system of FIG. [Figure 7] FIG. 7 is a basic flow chart of the control selection control by the vehicle driving control device of FIG. [Figure 8] FIG. 8 is a flowchart of the control of determining whether or not there is a malfunction in the server device, which is performed by the vehicle driving control device of FIG. [Figure 9] FIG. 9 is a flowchart showing basic remote control information transmission control by the server device of FIG. [Figure 10] FIG. 10 is an explanatory diagram of a method for determining whether a server device has a malfunction, using a driving control device for an automobile. [Figure 11] FIG. 11 is an explanatory diagram of a method for determining whether a server device has a malfunction, using a driving control device for an automobile. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0012] FIG. 1 is a configuration diagram of a control system 1 for an automobile 2 according to an embodiment of the present invention. The control system 1 in FIG. 1 includes a plurality of automobiles 2 traveling on a road 90, and a server device 3 that transmits and receives information to and from the plurality of automobiles 2 via a communication system 6.

[0013] Here, the automobile 2 is an example of a vehicle. Other examples of vehicles include trucks, buses, motorcycles, and personal mobility vehicles. In Fig. 1, a plurality of automobiles 2 are traveling in sequence on a road 90. Some of the automobiles 2 are parked in a parking lot 95 facing the road 90.

[0014] The communication system 6 includes a plurality of base stations 7 arranged along a road 90, and a communication network 8 to which the plurality of base stations 7 are connected. The base stations 7 may be, for example, for commercial 5G use or for advanced transportation systems such as ADAS (Advanced Driver Assistance Systems). The communication network 8 may be configured with a carrier communication network that provides base stations for 5G use, the Internet connected to the carrier communication network, or the like.

[0015] The server device 3 has a server body 4 connected to a communication network 8 of the communication system 6, and a server DB 5 connected to the server body 4. The server device 3 may be basically connected to the Internet of the communication system 6, but may also be connected to a carrier communication network. The server device 3 may be configured not by one server body 4, but by multiple server bodies 4 that cooperate with each other to execute distributed control. The multiple server bodies 4 may be hierarchical, for example. The multiple server bodies 4 at the lowest level in the hierarchy may be connected to the carrier communication network in a distributed manner according to their regions, etc. Such a server body 4 may be realized in a control device of a base station for 5G, etc.

[0016] The server device 3 in FIG. 1 executes individual control for a plurality of automobiles 2 that are within the communication range of the communication system 6 that is constituted by the zones of at least three base stations 7 in the figure. 1 also shows a Global Navigation Satellite System (GNSS) satellite 110. The GNSS satellite 110 broadcasts signals including information on its position and time to the ground. The GNSS receiver can obtain information on the position and time at which the GNSS receiver is located by receiving signals from a plurality of GNSS satellites 110. The position and time of each GNSS receiver can be used as reliable information that is unlikely to cause errors compared to the positions and times of other GNSS receivers.

[0017] FIG. 2 is an explanatory diagram of the control system 10 of the automobile 2 of FIG. Each of the multiple automobiles 2 shown in FIG. 1 may be equipped with the control system 10 shown in FIG.

[0018] The control system 10 of the automobile 2 in Fig. 2 has an automobile network 19 and a plurality of control devices connected thereto. In Fig. 2, as examples of the plurality of control devices, a sensor control device 11, a driving control device 12, a drive control device 13, a steering control device 14, a braking control device 15, and an external vehicle communication control device 16 are illustrated. The control system 10 of the automobile 2 may include other control devices, such as an operation control device that acquires information on manual driving operations by the occupants.

[0019] The vehicle network 19 may be, for example, a vehicle network such as a Controller Area Network (CAN) or a Local Interconnect Network (LIN). The vehicle network 19 may also include a commonly used network such as the Institute of Electrical and Electronics Engineers (IEEE) 802.3 or IEEE 802.11. By using such a vehicle network 19, each control device can input and output information to and from other control devices through the vehicle network 19.

[0020] The sensor control device 11 controls the operation of various vehicle sensors provided in the automobile 2, and outputs detection information or processed information of the various vehicle sensors to other control devices through the vehicle network 19. In Fig. 2, a GNSS receiver 21, an outside vehicle camera 22, and an acceleration sensor 23 are connected to the sensor control device 11 as examples of the vehicle sensors. In addition to these, a vehicle speed sensor, a steering sensor, and the like may also be connected to the sensor control device 11.

[0021] The GNSS receiver 21 generates position and time information for the vehicle 2 .

[0022] The exterior camera 22 captures images of the surroundings of the automobile 2 traveling on the road 90 or the like. The exterior camera 22 may be a monocular camera, a compound eye camera, or a 360-degree camera. It is preferable that the exterior camera 22 be capable of capturing images of at least the front side of the traveling automobile 2. The sensor control device 11 may generate information on the relative distance and direction of other automobiles around the host vehicle based on the images captured by the exterior camera 22.

[0023] The acceleration sensor 23 detects the acceleration of the automobile 2. By using a sensor that detects acceleration in three axial directions as the acceleration sensor 23, the sensor control device 11 can generate information on the angular acceleration of the automobile 2 in each of the yaw, pitch, and roll directions.

[0024] The vehicle speed sensor detects the speed of the automobile 2 . The steering sensor detects the steering angle of a steering wheel (not shown) of the automobile 2.

[0025] A vehicle communication device 29 provided in the automobile 2 is connected to the exterior communication control device 16. The vehicle communication device 29 establishes a wireless communication path with a base station 7 with which communication is possible. The exterior communication control device 16 controls the operation of the vehicle communication device 29 and transmits and receives information to and from the server device 3 via the vehicle communication device 29 and the base station 7. For example, the exterior communication control device 16 outputs information that the vehicle communication device 29 receives from the server device 3 or the base station 7 to another control device via the vehicle network 19. The exterior communication control device 16 transmits information input from another control device via the vehicle network 19 to the server device 3 via the vehicle communication device 29 and the base station 7.

[0026] The drive control device 13 is connected to drive system members such as an engine that uses gasoline or hydrogen as fuel to generate drive force, a motor that generates drive force using electricity, and a transmission, which are provided in the automobile 2. The drive control device 13 controls the operation of these drive system members using control values ​​acquired through the vehicle network 19.

[0027] The steering control device 14 is connected to, for example, a steering device provided in the automobile 2. The steering control device 14 controls the operation of the steering device using a control value acquired through the vehicle network 19.

[0028] The braking control device 15 is connected to a braking device provided in the automobile 2. The braking control device 15 controls the operation of the braking device based on a control value acquired via the vehicle network 19.

[0029] The driving control device 12 controls the driving of the automobile 2. When the automobile 2 is driven autonomously without the operation of the passengers, the driving control device 12 obtains information on the driving state of the automobile and information on the surroundings of the automobile from the sensor control device 11, and generates a control value according to the information. When the driving control device 12 determines, for example, based on the latest image captured by the exterior camera 22, that another moving object is approaching in front of the vehicle, it generates a control value for the braking control device 15 to slow down or stop the vehicle. When it is determined based on the latest image captured by the exterior camera 22 that the stopped vehicle is ready to start, the cruise control device 12 generates a control value for the drive control device 13 to accelerate the vehicle. If the latest image captured by the exterior camera 22 indicates that the vehicle is likely to deviate from the lane in which it is traveling, the cruise control device 12 generates a control value for the steering control device 14 to change the direction of travel of the vehicle. In addition, when the position of the GNSS receiver 21 is compared with the high-precision map data and it is determined that the vehicle needs to turn right, turn left, or change lanes, the driving control device 12 generates a control value for the steering control device 14 to change the direction of travel of the vehicle. In this way, the driving control device 12 can cause the automobile 2 to drive autonomously by autonomous decision control based on detection by the vehicle's own sensor.

[0030] FIG. 3 is an explanatory diagram of a basic hardware configuration of the driving control device 12 of the automobile 2 of FIG. 3 includes a vehicle CPU (Central Processing Unit) 73, a vehicle memory 72, an input / output device 71 connected to the vehicle network 19, and a vehicle internal bus 79 to which these are connected. A timer or the like may be further connected to the vehicle internal bus 79.

[0031] The input / output device 71 inputs and outputs information to and from other control devices through the vehicle network 19. This allows the driving control device 12 to obtain information used for its control.

[0032] The vehicle memory 72 records programs, setting values, detection values, and the like for driving control. Fig. 3 illustrates high-precision map data 74 recorded in the vehicle memory 72. The vehicle memory 72 may be composed of, for example, a semiconductor memory, a HDD (Hard Disk Drive), or the like.

[0033] The vehicle CPU 73 reads and executes a program from the vehicle memory 72. In this way, a control unit is realized in the driving control device 12.

[0034] FIG. 4 is a basic flowchart of autonomous driving control by the driving control device 12 of the automobile 2 in FIG. The vehicle CPU 73 of the driving control device 12 repeatedly executes the autonomous driving control of FIG.

[0035] In step ST1, the vehicle CPU 73 of the driving control device 12 collects and acquires vehicle information such as information indicating the driving state of the vehicle and information on the driving environment around the vehicle from the sensor control device 11 of the vehicle. The information acquired from the sensor control device 11 of the vehicle may be acquired in advance and recorded in the vehicle memory 72 of the driving control device 12. Here, the vehicle information may include information such as the position, direction, speed, acceleration, and traveling direction of other automobiles around the vehicle and the vehicle included in the image captured by the in-vehicle camera. The vehicle CPU 73 may process the information acquired from the sensor control device 11 and generate this information. The vehicle information may also include information indicating the operating state, control contents, and control results of the drive control device 13, steering control device 14, braking control device 15, etc. The vehicle information may also include time information generated by the GNSS receiver 21.

[0036] In step ST2, the vehicle CPU 73 of the driving control device 12 generates a control value for autonomously controlling the driving of the host vehicle, based on the information acquired in step ST1. The vehicle CPU 73 generates a control value for controlling the running of the vehicle in response to the vehicle information so as to suppress interference with other automobiles and the like. As a result, the vehicle CPU 73 generates, for example, a control value for accelerating the automobile 2, a control value for maintaining the speed, a control value for decelerating, a control value for stopping, a control value for maintaining the speed, a steering control value for maintaining the lane, and a steering control value for changing the lane.

[0037] In step ST3, the vehicle CPU 73 of the driving control device 12 outputs the control value generated in step ST2 to each control device that executes driving control of the vehicle through the vehicle network 19. As a result, for example, the drive control device 13 executes control to set the drive output to the control value. The steering control device 14 executes control so that the steering angle including the steering direction becomes the control value. The braking control device 15 executes control to set the braking force to the control value. As a result, the automobile 2 can run according to the autonomous driving control by the driving control device 12. Thereafter, the vehicle CPU 73 of the driving control device 12 ends this control.

[0038] In this way, each of the multiple automobiles 2 can generate control values ​​for controlling the driving of its own vehicle through autonomous driving control by its driving control device 12.

[0039] FIG. 5 is a diagram showing a hardware configuration of the server device 3 in FIG. The server apparatus 3 in FIG. 5 includes a server communication device 31, a server GNSS receiver 32, a server DB (server database) 5, a server memory 33, a server CPU 34, and a server internal bus 39 to which these are connected.

[0040] The server communication device 31 is connected to the communication network 8 of the communication system 6. The server communication device 31 transmits and receives information to and from the vehicle communication device 29 provided in the automobile 2. The server communication device 31 may receive driving information from each of the multiple automobiles 2.

[0041] The server GNSS receiver 32 generates information on the position and time of the server device 3. The time generated by the server GNSS receiver 32 can match the time generated by the GNSS receiver 21 of each vehicle 2 with high accuracy.

[0042] The server DB5 accumulates and records various data used by the server device 3 for individual control of the multiple automobiles 2. Such data includes, for example, driving information of each automobile 2. The server DB5 may be provided with, for example, high-precision map data, a road regulation DB (road regulation database), a vehicle position behavior DB (vehicle position behavior database), and the like.

[0043] The server memory 33 stores data such as programs executed by the server CPU 34 .

[0044] The server CPU 34 reads and executes the programs recorded in the server memory 33. This realizes a control unit that controls the operation of the server device 3. The control unit generates individual control information, such as individual remote control values ​​and individual management information used for driving control in each automobile 2, for example, to individually control the driving of each automobile 2, and transmits it to each automobile 2. Here, the individual remote control values ​​are the same type of control values ​​generated by the driving control device 12 of each automobile 2, and may be values ​​that can be directly given to a control device that executes control in each automobile 2, such as the drive control device 13. Such individual remote control values ​​are control values ​​generated in the autonomous driving control of Fig. 4 described above, which are generated by the server device 3 and transmitted to each automobile 2. In this case, each automobile 2 will travel by remote control in accordance with the server device 3. In contrast, the individual control information may indicate requests for the driving control device 12 of each automobile 2 to generate control values. Such individual control information may include information indicating requests regarding acceleration / deceleration, steering, lane changes, etc. In this case, each automobile 2 generates control values ​​in response to requests from the server device 3 and travels under the control of the server device 3.

[0045] The server CPU 34 may switch the individual control information generated for each automobile 2 between the individual remote control value and the individual control information depending on the running state of each automobile 2 and the like. For example, when the automobile 2 continues to travel along the road 90 in FIG. On the other hand, when the automobile 2 travels from the road 90 in FIG. 1 to enter the parking lot 95, the server CPU 34 may generate an individual remote control value as the individual control information for the automobile 2. As a result, when the automobile 2 continues to travel along the road 90 in FIG. 1, the automobile 2 can generate control values ​​suitable for continuing to travel along the road 90 in accordance with the individual control information, while also using detection information from the automobile's own vehicle sensor. In addition, when the automobile 2 travels from the road 90 in FIG. 1 to a parking lot 95, the automobile 2 can generate a control value according to an individual remote control value from a server device that is aware of the status of the parking lot 95, and travel toward the parking lot 95. The automobile 2 is able to travel safely according to instructions from the server device 3 based on information that is beyond the range that can be detected by the automobile's own vehicle sensors.

[0046] Fig. 6 is a basic timing chart of the individual control of a plurality of automobiles 2 in the control system 1 of Fig. 1. For ease of explanation, Fig. 6 shows only one automobile 2. FIG. 6 shows an example in which each automobile 2 travels according to an individual remote control value of the server device 3 under secondary travel control (step ST20). In Figure 6, time flows from top to bottom.

[0047] In the case of the secondary driving control in step ST20, the driving control device 12 of the automobile 2 first collects and acquires vehicle information of the automobile in step ST71, and transmits the driving information of the automobile to the server device 3 (step ST72). In this way, the driving information of a plurality of automobiles 2 is collected in the server device 3. Here, the driving information may basically be composed of information necessary for processing by the server device 3. The driving information may be the vehicle information itself, or a part of the vehicle information. However, it is desirable that the driving information includes at least information indicating the position, speed, etc. of the automobile 2.

[0048] When the server CPU 34 of the server device 3 receives the travel information from the automobile 2, it calculates the position of the automobile 2 (vehicle S position) based on the received travel information (step ST81). Here, the vehicle S position may indicate the lane of the road 90 on which the automobile 2 is traveling and the position on that lane, for example, using high-precision map data. This allows the server device 3 to map each automobile 2 to the high-precision map data or the like. The travel positions and travel conditions of multiple automobiles 2 are mapped onto the high-precision map data or the like.

[0049] Next, the server CPU 34 of the server device 3 judges the possibility of future interference between the multiple automobiles 2 (step ST82). For example, when the speed of the automobile 2 traveling behind is higher than that of the automobile 2 traveling ahead in the same lane, the server CPU 34 of the server device 3 judges that there is a possibility that those automobiles 2 will interfere with each other in the future.

[0050] Next, the server CPU 34 of the server device 3 generates individual control information for each of the automobiles 2 (step ST83) and transmits it to each automobile 2 (step ST84). When remote control is to be performed, the server CPU 34 generates an individual remote control value as the individual control information. When traffic control is to be performed, the server CPU 34 generates individual traffic control information as the individual control information.

[0051] Upon receiving the individual control information from the server device 3, the driving control device 12 of the automobile 2 generates a control value to be output to each control device that executes driving control in the host vehicle based on the individual control information received from the server device 3 (step ST73). After that, the driving control device 12 outputs the generated control value to the drive control device 13, the steering control device 14, or the braking control device 15. As a result, for example, the drive control device 13 executes control to set the drive output to the control value. The steering control device 14 executes control so that the steering angle including the steering direction becomes the control value. The braking control device 15 executes control to set the braking force to the control value. Here, when each of the driving control devices 12 of the multiple automobiles 2 receives an individual remote control value from the server device 3, the individual remote control value can be used as a control value as is. However, the driving control device 12 of this embodiment generates a control value that suppresses changes in driving compared to the individual remote control value received from the server device 3.

[0052] Through such a series of cooperative controls, the automobile 2 can travel under the individual control of the server device 3 and in accordance with the individual control information generated by the server device 3. The server device 3 can generate individual control information, such as individual remote control values ​​for each of the multiple automobiles 2, based on the driving information for the multiple automobiles 2, and transmit the individual control information to the multiple automobiles 2. Furthermore, each driving control device 12 of the multiple automobiles 2 can use the latest individual control information addressed to its own vehicle received from the server device 3 to generate a control value for driving control of its own vehicle. The plurality of automobiles 2 are individually controlled by the server device 3 and basically execute driving control in accordance with instructions from the server device 3, thereby enabling the automobiles 2 to drive safely without interfering with each other.

[0053] Incidentally, while the driving of each of the multiple automobiles 2 is being controlled under the control of such a server device 3, it is difficult to deny the possibility that a malfunction may occur in the server device 3. For example, it is generally considered that there is a non-zero possibility that inconsistencies will occur in the programs used by the server device 3. For example, there is a non-zero possibility that inconsistencies between programs will occur in the server device 3 due to program bugs, program updates, and the like. In addition, the server device 3 needs to be connected to a communication network 8 such as the Internet. As a result, the server device 3 may be subject to unauthorized access from outside. There is also a possibility that the server device 3 may be hijacked and programs may be rewritten. Even if such a malfunction occurs in the server device 3, each automobile 2 that is actually traveling on the road is required to travel safely. Also, each automobile 2 is required to travel in a manner that does not impede the travel of other vehicles.

[0054] FIG. 7 is a basic flow chart of the control selection control by the driving control device 12 of the automobile 2 of FIG. The vehicle CPU 73 of the driving control device 12 repeatedly executes the control for control selection in FIG. 7 in order to dynamically switch the driving control of the vehicle between the autonomous driving control in FIG. 4 described above and the subordinate driving control in FIG. 6.

[0055] Furthermore, as will be described later with reference to FIG. 9, when it is necessary to force each automobile 2 to perform remote control, the server device 3 repeatedly transmits remote control information including significant forcing information to each automobile 2. Furthermore, as will be described later in FIG. 9, when the server device 3 recommends remote control for each automobile 2, it repeatedly transmits remote control information including significant recommended information to each automobile 2. In the remote control information, at most one of the compulsory information and the recommended information can be considered significant. The compulsory information is information by which the server device 3 requests each automobile 2 to follow the individual remote control value. The recommended information is information by which the server device 3 recommends each automobile 2 to follow the individual remote control value. Basically, the server device 3 may make the compulsory information significant when an emergency occurs, and make the recommended information significant when the automobile 2 is traveling in the parking lot 95.

[0056] Furthermore, if the server device 3 determines that there is a malfunction in its own control, it transmits a malfunction notification to each vehicle 2.

[0057] In step S11, the vehicle CPU 73 of the driving control device 12 determines whether or not the vehicle communication device 29 has received a malfunction notification from the server device 3. If a malfunction notification has been received from the server device 3, the vehicle CPU 73 advances the process to step ST16 to execute autonomous driving control. In this case, the vehicle CPU 73 advances the process to step ST16 without determining by itself in step ST15 that there is a malfunction in the server device 3. If a malfunction notification has not been received from the server device 3, the vehicle CPU 73 advances the process to step ST12.

[0058] In step S12, the vehicle CPU 73 of the driving control device 12 diagnoses the operation of its own driving control device 12 and judges for itself whether or not there is a malfunction in its own autonomous driving control. The vehicle CPU 73 may judge that there is a malfunction in its own autonomous driving control when it cannot obtain periodic control values ​​from its own autonomous driving control that is constantly operating. The vehicle CPU 73 may also judge that there is a malfunction in its own driving control when a watchdog timer that is reset in its own autonomous driving control has timed out. When it is judged that there is a malfunction in its own driving control, the vehicle CPU 73 advances the process to step ST20 to execute the subordinate driving control. When it is not judged that there is a malfunction in its own driving control, the vehicle CPU 73 advances the process to step ST13.

[0059] In step S13, the vehicle CPU 73 of the driving control device 12 judges whether or not a collision of the vehicle is predicted based on an image captured by the outside vehicle camera 22, etc. For example, the vehicle CPU 73 may predict the possibility of a collision with another vehicle, etc., based on detection information of the vehicle sensor, for example, an image of the driving direction. If a collision of the vehicle is predicted, the vehicle CPU 73 advances the process to step ST16 to execute autonomous driving control to deal with the collision. If a collision of the vehicle is not predicted, the vehicle CPU 73 advances the process to step ST14.

[0060] In step S14, the vehicle CPU 73 of the driving control device 12 determines whether or not there is a malfunction in the server device 3. The details of the determination will be described later.

[0061] In step S15, the vehicle CPU 73 of the driving control device 12 judges whether or not there is a malfunction in the server device 3 based on the judgment result of step S14. If it is not judged that there is a malfunction in the server device 3, the vehicle CPU 73 advances the process to step ST20 to execute the secondary driving control. If it is judged that there is a malfunction in the server device 3, the vehicle CPU 73 advances the process to step ST16.

[0062] In step S16, the vehicle CPU 73 of the driving control device 12 starts autonomous driving control. The vehicle CPU 73 first acquires the latest remote control information acquired from the server device 3. As described above, in the remote control information, only one of the compulsory information and the recommended information can be set to be significant.

[0063] In step S17, the vehicle CPU 73 of the driving control device 12 judges whether or not the compulsory information is determined to be significant in the remote control information acquired in step S16. If the compulsory information is determined to be significant, the vehicle CPU 73 advances the process to step ST19. If the compulsory information is not determined to be significant, the vehicle CPU 73 advances the process to step ST18.

[0064] In step S18, since the compulsory information is not significant, the vehicle CPU 73 of the driving control device 12 executes autonomous driving control using the detection information of the vehicle sensor so as to continue the current driving. After that, the vehicle CPU 73 ends this control. In this way, the vehicle CPU 73 of the driving control device 12 determines that there is a malfunction in the server device 3, and if the remote control recommendation information in the remote control information received from the server device 3 is significant, it can cause the vehicle to continue driving through autonomous driving control. When the vehicle CPU 73 determines that there is a malfunction in the server device 3, the vehicle CPU 73 executes autonomous driving control to generate a control value using information from the vehicle's own sensor, without using the individual remote control value received as individual control information from the server device 3. In addition, the vehicle CPU 73 may generate a control value using information obtained by manual operation by an occupant of the vehicle.

[0065] In step S19, since the compulsory information is deemed significant, the vehicle CPU 73 of the driving control device 12 executes autonomous driving control using the detection information of the vehicle sensor so as to bring the vehicle to an emergency stop. After that, the vehicle CPU 73 ends this control. In this way, the vehicle CPU 73 of the driving control device 12 determines that there is a malfunction in the server device 3, and if the forced remote control information in the remote control information received from the server device 3 is significant, it can bring the vehicle to an emergency stop through autonomous driving control. When the vehicle CPU 73 determines that there is a malfunction in the server device 3, it performs autonomous driving control in which a control value is generated using information from the vehicle's own vehicle sensors, without using the individual remote control values ​​received as individual control information from the server device 3.

[0066] In step S20, the vehicle CPU 73 of the driving control device 12 executes a secondary driving control for generating a control value using the information of the host vehicle sensor and the individual remote control value received from the server device 3. After that, the vehicle CPU 73 ends this control. In this way, when it is determined that the server device 3 does not have a malfunction, the vehicle CPU 73 of the driving control device 12 can generate a control value using the individual remote control value by the secondary driving control. In addition, when the vehicle CPU 73 of the driving control device 12 determines that there is a malfunction in its own autonomous driving control, it can generate a control value using an individual remote control value through secondary driving control even when it does not determine that there is a malfunction in the server device 3.

[0067] FIG. 8 is a flowchart of the control of determining whether or not there is a malfunction in the server device 3, which is performed by the driving control device 12 of the automobile 2 in FIG. The vehicle CPU 73 of the driving control device 12 executes control for determining whether or not there is a malfunction in the server device 3 of FIG. 8 in step ST14 of FIG.

[0068] The judgment control of Figure 8 judges a malfunction of the server device 3 based on a comparison between the envelope of multiple individual remote control values ​​received from the server device 3 and the envelope of multiple control values ​​generated by the autonomous driving control in the vehicle, as illustrated in Figures 10 and 11 described below. The vehicle CPU 73 may also execute a determination control other than that shown in FIG. 8 in step ST14 of FIG.

[0069] In step S31, the vehicle CPU 73 of the driving control device 12 plots a plurality of individual remote control values ​​received by the vehicle communication device 29 during a predetermined period on a graph such as that shown in Fig. 10 or 11, which will be described later. Each individual remote control value may be plotted on the graph based on its value and time.

[0070] In step S32, the vehicle CPU 73 of the driving control device 12 generates an envelope for each of the individual remote control values ​​and counts the waveform features included in the envelope. Here, the waveform features may be, for example, the number of changes in the waveform slope in the envelope or the number of poles of the waveform included in the envelope.

[0071] In step S33, the vehicle CPU 73 of the driving control device 12 plots a plurality of control values ​​(hereinafter referred to as autonomous control values) that the autonomous driving control generates based only on the detection values ​​of the vehicle's own sensor during the above-mentioned predetermined period on a graph such as that shown in Fig. 10 or 11. Each autonomous control value may be plotted on the graph based on its value and time.

[0072] In step S34, the vehicle CPU 73 of the driving control device 12 generates an envelope for each of the autonomous control values ​​and counts the waveform characteristics contained in the envelope. Here, the waveform characteristics are the same as those used for the individual remote control values.

[0073] In step S35, the vehicle CPU 73 of the driving control device 12 calculates the difference between the count value for the individual remote control value in step ST32 and the count value for the autonomous control value in step ST34.

[0074] In step S36, the vehicle CPU 73 of the driving control device 12 acquires the latest remote control information received from the server device 3. As described above, in the remote control information, only one of the compulsory information and the recommended information can be set to be significant.

[0075] In step S37, the vehicle CPU 73 of the driving control device 12 reads a threshold value corresponding to the remote control information that is significant in the remote control information acquired in step S36. For example, when recommendation information is significant in the remote control information, the vehicle CPU 73 reads the first threshold value corresponding to the recommendation information. On the other hand, when the compulsion information in the remote control information is significant, the vehicle CPU 73 reads the second threshold value corresponding to the compulsion information. Here, the first threshold value and the second threshold value may be recorded in the vehicle memory 72. The second threshold may be a value greater than the first threshold. For example, if the first threshold is 3, the second threshold may be a value greater than 3, such as 5. The first threshold and the second threshold may be natural numbers less than or equal to 10.

[0076] In step S38, the vehicle CPU 73 of the driving control device 12 compares the difference in the count values ​​of the waveform features calculated in step ST35 with the threshold value acquired in step ST37. If the difference between the count values ​​of the waveform features is equal to or greater than the threshold value, the vehicle CPU 73 advances the process to step ST39. On the other hand, if the difference between the count values ​​of the waveform features is smaller than the threshold value, the vehicle CPU 73 advances the process to step ST40. In this case, when the vehicle CPU 73 receives significant forced remote control information from the server device 3, it uses a second threshold value that is greater than the first threshold value when significant recommended remote control information is received from the server device 3 as a threshold value to be compared with the difference in the count values ​​of the waveform features.

[0077] In step S39, since the difference in the count values ​​of the waveform features is equal to or greater than the threshold value, the vehicle CPU 73 of the driving control device 12 determines that there is a malfunction in the server device 3. After that, the vehicle CPU 73 ends this control, and returns the process to FIG.

[0078] In step S40, since the difference between the count values ​​of the waveform features is smaller than the threshold value, the vehicle CPU 73 of the driving control device 12 determines that there is no malfunction in the server device 3. After that, the vehicle CPU 73 ends this control and returns the process to FIG.

[0079] In this way, the vehicle CPU 73 of the driving control device 12 can determine whether or not there is a malfunction in the server device 3 by comparing the individual remote control value received from the server device 3 with the control value generated by the autonomous driving control in the vehicle. If it is determined that there is a malfunction in the server device 3, it can further determine this in step ST15 of Fig. 7 and switch the driving control of the vehicle from the secondary driving control to the autonomous driving control.

[0080] FIG. 9 is a flowchart showing basic remote control information transmission control by the server device 3 of FIG. The server CPU 34 of the server device 3 repeatedly executes the transmission control of the remote control information in FIG. 9 in order to generate the remote control information. Furthermore, as a result of the transmission control of the remote control information in FIG. 9, the server CPU 34 switches the individual control information to be transmitted to each automobile 2 between the individual remote control value and the individual control information.

[0081] In step S51, the server CPU 34 of the server device 3 generates a communication reliability value with the automobile 2 from which the server device 3 is receiving the travel information. The communication reliability value may have an initial value of 100, for example, and be subtracted when there is a loss of communication or a large delay, and be returned to the initial value when there are no more loss of communication or large delays. In this case, every time the server CPU 34 receives travel information from the automobile 2, it judges the communication and updates the communication reliability value.

[0082] In step S52, the server CPU 34 of the server device 3 judges whether the communication reliability value updated in step S51 is equal to or greater than a threshold. If the communication reliability value is equal to or greater than the threshold, the communication state is good. In this case, the server CPU 34 advances the process to step ST53. If the communication reliability value is not equal to or greater than the threshold, the server CPU 34 advances the process to step ST57 since the communication state may not be suitable for continuing to transmit individual remote control values.

[0083] In step S53, the server CPU 34 of the server device 3 judges whether or not a server malfunction determination notice has been received from the automobile 2. After judging that the server device 3 has a malfunction in step ST15 of FIG. 7, for example, the driving control device 12 of the automobile 2 adds information indicating that the server device 3 has been judged to have a malfunction in the own vehicle when transmitting the driving information in step ST72 of FIG. 6 to the server device 3. The server CPU 34 may judge whether or not a server malfunction determination notice has been received based on whether such additional information is included in the driving information. If the server malfunction determination notice has not been received, the server CPU 34 advances the process to step ST54. If the server malfunction determination notice has been received, the server CPU 34 advances the process to step ST57 to generate individual control information instead of individual remote control values.

[0084] In step S54, the server CPU 34 of the server device 3 determines whether or not there is a malfunction in the automobile 2. If a malfunction occurs in the automobile 2, the driving control device 12 of the automobile 2 transmits the information including the malfunction in the driving information. The server CPU 34 may determine whether or not there is a malfunction in the automobile 2 based on whether or not such information is included in the driving information. If there is a malfunction in the automobile 2, the server CPU 34 advances the process to step ST60 to suppress the execution of the autonomous driving control of the automobile 2. If there is no malfunction in the automobile 2, the server CPU 34 advances the process to step ST55.

[0085] In step S55, the server CPU 34 of the server device 3 judges whether or not it is necessary to enforce remote control in the individual control of the automobile 2. The server CPU 34 may judge that it is necessary to enforce remote control when it is necessary to accommodate the passing of an emergency vehicle, for example. If it is necessary to enforce remote control, the server CPU 34 advances the process to step ST60 to inhibit the automobile 2 from executing autonomous driving control. If it is not necessary to enforce remote control, the server CPU 34 advances the process to step ST56.

[0086] In step S56, the server CPU 34 of the server device 3 judges whether or not it is necessary to recommend remote control in the individual control of the automobile 2. The server CPU 34 may judge that it is necessary to recommend remote control, for example, when the automobile 2 is parked in the parking lot 95. If it is necessary to recommend remote control, the server CPU 34 advances the process to step ST62 to suppress the execution of the autonomous driving control of the automobile 2. If it is not necessary to recommend remote control, the server CPU 34 advances the process to step ST57 to cause the automobile 2 to execute subordinate driving control under the individual control information.

[0087] In step S57, the server CPU 34 of the server device 3 makes neither the compulsory information nor the recommended information included in the remote control information significant, so that the remote control information does not include significant information.

[0088] In step S58, the server CPU 34 of the server device 3 generates individual control information.

[0089] In step S59, the server CPU 34 of the server device 3 transmits the information generated for the individual control to the corresponding vehicle 2. When step S58 is being executed, the server CPU 34 transmits the individual control information together with the remote control information that does not include any significant information. After that, the server CPU 34 ends this control.

[0090] In step S60, the server CPU 34 of the server device 3 sets the compulsion information included in the remote control information to be significant and sets the recommendation information to be insignificant. The remote control information includes significant compulsion information.

[0091] In step S61, the server CPU 34 of the server device 3 generates an individual remote control value. In this case, the server CPU 34 transmits the individual remote control value together with the remote control information in which the compulsion information has been set to significant in step S59. After that, the server CPU 34 ends this control.

[0092] In step S62, the server CPU 34 of the server device 3 sets the recommendation information included in the remote control information to be significant and sets the compulsion information to be insignificant. The remote control information includes significant recommendation information.

[0093] In step S63, the server CPU 34 of the server device 3 generates an individual remote control value. In this case, the server CPU 34 transmits the individual remote control value together with the remote control information in which the recommendation information has been made significant in step S59. After that, the server CPU 34 ends this control.

[0094] In this way, the server device 3 determines whether or not an emergency response is necessary for each of the multiple automobiles 2, and for the automobiles 2 for which it determines that an emergency response is necessary, it can transmit remote control information in which the remote control forced information is made significant, in addition to the individual remote control value. In addition, when the server device 3 receives a server malfunction determination result from a malfunction-determined vehicle that the server device 3 has determined to have a malfunction, the server device 3 can switch the information for driving control to be sent to the malfunction-determined vehicle from individual remote control values ​​that can be used directly for driving control in the malfunction-determined vehicle to individual control information that includes a request for driving control of the vehicle 2.

[0095] Next, a specific example of server malfunction determination by the driving control device 12 of the automobile 2 will be described.

[0096] 10 and 11 are explanatory diagrams of a method for determining whether or not there is a malfunction in the server device 3 by the driving control device 12 of the automobile 2. In FIG. Fig. 10 shows an example of a case where it is not determined that there is a malfunction in the server device 3. In contrast to this, Fig. 11 shows an example of a case where it is determined that there is a malfunction in the server device 3. In the graphs shown in these figures, the horizontal axis is time and the vertical axis is value.

[0097] Reference numeral 51 denotes a plurality of individual remote control values ​​transmitted by the server device 3 to each automobile 2. Reference numeral 52 denotes an envelope of the individual remote control values ​​based on the plurality of individual remote control values ​​51. Reference numeral 53 denotes a plurality of autonomous control values ​​generated by the autonomous driving control based on the detection of the vehicle sensor. The driving control device 12 may, for example, constantly and repeatedly execute the autonomous driving control of Fig. 4 to repeatedly generate autonomous control values ​​based on the detection of the vehicle sensor together with control values ​​to be actually used for control. Reference numeral 52 denotes an envelope of the autonomous control values ​​based on the plurality of autonomous control values.

[0098] In the example of FIG. 10 where it is not determined that the server device 3 has a malfunction, the envelope 52 based on the multiple individual remote control values ​​51 has a waveform having three poles. In contrast, the envelope 54 based on the plurality of autonomous control values ​​53 has a waveform with one pole. In this case, the driving control device 12 calculates "2 (=3-1)" as the difference in the number of waveform features in step ST35 of Fig. 8. Also, if the threshold value acquired in step ST37 is, for example, 3, the driving control device 12 determines in step ST38 that the difference in the number of waveform features is smaller than the threshold value, and proceeds to the process in step ST40. Thereafter, the driving control device 12 determines in step ST15 of FIG. 7 that there is no malfunction in the server device 3, and executes the secondary driving control in step ST20.

[0099] In contrast, in the example of FIG. 11 in which it is determined that the server device 3 has a problem, the envelope 52 based on the multiple individual remote control values ​​51 has a waveform having seven poles. In contrast, the envelope 54 of the plurality of autonomous control values ​​53 has a waveform having two poles. In this case, the driving control device 12 calculates "5 (= 7 - 2)" as the difference in the number of waveform features in step ST35 of FIG. 8. Furthermore, if the threshold value acquired in step ST37 is, for example, 3, the driving control device 12 determines in step ST38 that the difference in the number of waveform features is equal to or greater than the threshold value, and proceeds to the process in step ST39. Thereafter, the driving control device 12 determines in step ST15 of FIG. 7 that there is a malfunction in the server device 3, and executes the autonomous driving control in step ST18 or step ST19.

[0100] As described above, in this embodiment, in each of the multiple automobiles 2, the driving control device 12 capable of generating control values ​​for controlling the driving of the host vehicle judges whether or not there is a malfunction in the server device 3. Then, when it is judged that there is no malfunction in the server device 3, the driving control device 12 executes a secondary driving control for generating a control value using information from the host vehicle sensor of the host vehicle as well as the individual remote control value received from the server device 3. This allows each automobile 2 to drive according to the individual remote control value of the server device 3 that is not judged to have a malfunction. Moreover, when the driving control device 12 determines that the server device 3 has a malfunction, it executes autonomous driving control to generate a control value using information from the vehicle's own vehicle sensor or information from manual operation. At this time, the driving control device 12 generates the control value without using the individual remote control value received from the server device 3 determined to have a malfunction. This allows each automobile 2 to not drive according to the individual remote control value of the server device 3 determined to have a malfunction.

[0101] Thus, in this embodiment, each automobile 2 in the control system 1 for automobiles 2 that uses the server device 3 for driving control of the automobiles 2 can deal with any malfunction of the server device 3.

[0102] The above-described embodiment is an example of a preferred embodiment of the present invention, but the present invention is not limited to this, and various modifications and changes are possible without departing from the gist of the invention. [Explanation of symbols]

[0103] 1...control system, 2...automobile (vehicle), 3...server device, 4...server main body, 5...server DB, 6...communication system, 7...base station, 8...communication network, 10...control system, 11...sensor control device, 12...driving control device, 13...drive control device, 14...steering control device, 15...braking control device, 16...external communication control device, 19...vehicle network, 21...GNSS receiver, 22...external camera, 23...acceleration sensor, 29...vehicle communication device, 31...server communication device, 32...server GNSS receiver, 33...server memory, 34...server CPU, 39...server internal bus, 51...individual remote control value, 52...envelope based on multiple individual remote control values, 53...autonomous control value, 54...envelope based on multiple autonomous control values, 71...input / output device, 72...vehicle memory, 73...vehicle CPU, 74...high-precision map data, 79...vehicle internal bus, 90...road, 95...parking lot, 110...GNSS satellite

Claims

1. A plurality of vehicles each having a driving control unit capable of generating a control value for controlling the driving of the vehicle; a server device that generates individual remote control values ​​for each of the plurality of vehicles based on driving information for the plurality of vehicles and transmits the individual remote control values ​​to the plurality of vehicles; A vehicle control system, wherein the driving control unit of each of the plurality of vehicles generates a control value for driving control of the vehicle by using the individual remote control value addressed to the vehicle received from the server device, The driving control unit of each of the plurality of vehicles determining whether or not there is a malfunction in the server device by comparing the individual remote control value received from the server device with the control value generated by the autonomous driving control in the vehicle; When it is determined that the server device does not have a malfunction, a secondary driving control is executed to generate the control value using the individual remote control value received from the server device together with the information from the vehicle sensor. When it is determined that the server device has a malfunction, an autonomous driving control is executed to generate the control value using information from the vehicle's own sensor or information from a manual operation, without using the individual remote control value received from the server device. Vehicle control system.

2. The driving control unit of each of the plurality of vehicles comparing an envelope for a plurality of individual remote control values ​​received from the server device with an envelope for a plurality of the control values ​​generated by the autonomous driving control in the host vehicle; determining whether a difference between the number of waveform features contained in each of the envelopes being compared is equal to or greater than a threshold; If the difference in the number of waveform features is equal to or greater than the threshold, it is determined that the server device has a malfunction. The vehicle control system according to claim 1 .

3. The driving control unit of each of the plurality of vehicles In the slave driving control, which generates the control value using the individual remote control value received from the server device, the control value is generated so as to suppress changes in driving compared to a case where the individual remote control value received from the server device is used as the control value as it is.

3. A vehicle control system according to claim 1 or 2.

4. The driving control unit of each of the plurality of vehicles When a malfunction notification is received from the server device, the autonomous driving control is executed.

4. A vehicle control system according to claim 3.

5. The server device, determining whether an emergency response is required for each of the plurality of vehicles, and for a vehicle for which it is determined that an emergency response is required, transmitting remote control information that can make one of forced information and recommended information of remote control significant in addition to the individual remote control value; The driving control unit of each of the plurality of vehicles when it is determined that there is a malfunction in the server device when the remote control compulsion information in the remote control information received from the server device is significant, the vehicle is brought to an emergency stop by the autonomous driving control; When it is determined that there is a malfunction in the server device in a case where the remote control recommendation information in the remote control information received from the server device is significant, the autonomous driving control is performed to continue driving the host vehicle.

5. A vehicle control system according to claim 4.

6. The driving control unit of each of the plurality of vehicles When significant forced information of the remote control is received from the server device, a second threshold value that is greater than the first threshold value when significant recommended information of the remote control is received from the server device is used as a threshold value for comparison with the difference in the number of waveform features.

6. A vehicle control system according to claim 5.

7. The driving control unit of each of the plurality of vehicles Determine whether or not there is a malfunction in the autonomous driving control of the vehicle itself, When it is determined that there is a problem in the autonomous driving control of the vehicle itself, the control value is generated using the individual remote control value by the secondary driving control.

7. A vehicle control system according to claim 6.

8. The server device, When a determination result indicating a malfunction of the server device is received from the malfunction-determined vehicle in which it has been determined that the server device has a malfunction, information for driving control to be transmitted to the malfunction-determined vehicle is switched from the individual remote control value that can be used as is for driving control in the malfunction-determined vehicle to individual control information including a request for driving control of the vehicle.

8. A vehicle control system according to claim 7.

9. A plurality of vehicles each having a driving control unit capable of generating a control value for controlling driving of the vehicle; a server device that generates individual remote control values ​​for each of the plurality of vehicles based on driving information for the plurality of vehicles and transmits the individual remote control values ​​to the plurality of vehicles; A vehicle control system, wherein the driving control unit of each of the plurality of vehicles generates a control value for driving control of the vehicle by using the individual remote control value addressed to the vehicle received from the server device, The driving control unit of each of the plurality of vehicles determining whether or not there is a malfunction in the server device; When it is determined that the server device does not have a malfunction, a secondary driving control is executed to generate the control value using the individual remote control value received from the server device together with the information from the vehicle sensor. When it is determined that the server device has a malfunction, a driving control is executed to generate the control value using information from the vehicle's own vehicle sensor or information from a manual operation, without using the individual remote control value received from the server device, and the driving control generates the control value that suppresses changes in driving compared to a case where the individual remote control value received from the server device is used as the control value as it is. Vehicle control system.

10. A vehicle communication device that communicates with a server device that generates individual remote control values ​​for each of the plurality of vehicles based on driving information about the plurality of vehicles and transmits the individual remote control values ​​to the plurality of vehicles; A vehicle sensor provided in a vehicle; a driving control unit capable of generating a control value for controlling driving of the vehicle, the vehicle being the vehicle, by using the individual remote control value addressed to the vehicle and received from the server device by the vehicle communication device; having The traveling control unit is determining whether or not there is a malfunction in the server device by comparing the individual remote control value received from the server device with the control value generated by the autonomous driving control in the vehicle; When it is determined that the server device does not have a malfunction, a secondary driving control is executed to generate the control value using the individual remote control value received from the server device together with the information from the vehicle sensor. When it is determined that the server device has a malfunction, an autonomous driving control is executed to generate the control value using information from the vehicle's own sensor or information from a manual operation, without using the individual remote control value received from the server device. vehicle.

11. A vehicle communication device that communicates with a server device that generates individual remote control values ​​for each of a plurality of vehicles based on driving information about the plurality of vehicles and transmits the individual remote control values ​​to the plurality of vehicles; A vehicle sensor provided in a vehicle; a driving control unit capable of generating a control value for controlling driving of the vehicle, the vehicle being the vehicle, by using the individual remote control value addressed to the vehicle and received from the server device by the vehicle communication device; having The traveling control unit is determining whether or not there is a malfunction in the server device; When it is determined that the server device does not have a malfunction, a secondary driving control is executed to generate the control value using the individual remote control value received from the server device together with the information from the vehicle sensor. When it is determined that the server device has a malfunction, a driving control is executed to generate the control value using information from the vehicle's own vehicle sensor or information from a manual operation, without using the individual remote control value received from the server device, and the driving control generates the control value that suppresses changes in driving compared to a case where the individual remote control value received from the server device is used as the control value as it is. vehicle.

12. A server communication device that communicates with a plurality of vehicles, each of which has a driving control unit capable of generating a control value for controlling driving of the vehicle; a server control unit that generates individual remote control values ​​for each of the plurality of vehicles based on driving information for the plurality of vehicles received by the server communication device, and transmits the individual remote control values ​​from the server communication device to each of the plurality of vehicles; The server control unit When a determination result indicating a malfunction of the server device is received from a malfunction-determined vehicle among the plurality of vehicles that transmit the individual remote control values, information for driving control to be transmitted to the malfunction-determined vehicle is switched from the individual remote control value that can be used as is for driving control in the malfunction-determined vehicle to individual control information including a request for driving control of the vehicle. Server device.

Images