Control specification definition method, vehicle control device, and control specification definition device

Abstract

A vehicle control device (10) comprises: environment acquisition units (30, 31, 32) that each acquire the environment of a position at which a first vehicle is located; and a vehicle control unit (22) that controls automated driving of the first vehicle on the basis of control specifications defined on the basis of a two-dimensional chart having disposed therein a first model element representing the position and action of the first vehicle and a second model element representing the position and action of a second vehicle, and the environments acquired by the environment acquisition units (30, 31, 32). Accordingly, it is possible to define control specifications appropriately. In addition, since the vehicle control device is provided with a definition unit (3) that defines control specifications on the basis of a two-dimensional chart having disposed therein the first model element and the second model element and that further defines control specifications on the basis of a safety analysis, the control specifications can be defined appropriately.

Description

[Technical field]

[0001] The present disclosure relates to a vehicle control specification definition method, a vehicle control device, and a control specification definition device in an autonomous driving system. [Background technology]

[0002] A wide variety of electronic devices are installed in vehicles as in-vehicle systems. In recent years, as vehicles have become more multifunctional and complex, the number of control devices that control these electronic devices is increasing. In particular, in the field of autonomous driving systems, research and development of which has accelerated in recent years, systems have been proposed that realize highly autonomous driving by linking the vehicle's engine control, brake control, and steering control.

[0003] In an autonomous driving system, as the application area expands and the autonomous driving level increases, control is required to realize functions including recognition, judgment, and operation in complex situations. For this reason, the expression of use cases and control specifications is also becoming more complex. By using semi-formal descriptions such as UML (Unified Modeling Language), which uses natural language descriptions, sequence diagrams, state transition diagrams, and flowcharts, as a method for defining control specifications, omissions in control specifications are suppressed. For example, in the technology of Patent Document 1, the control specifications of a vehicle are described in a flowchart.

[0004] In addition, safety considerations are important when considering vehicle control specifications, and the functional safety standard (ISO26262) requires the extraction of anticipated risks and the development of countermeasures against those risks through hazard analysis and risk assessment. ISO stands for International Organization for Standardization.

[0005] Non-Patent Document 1 lists a method called System Theoretic Process Analysis (STPA) as a safety analysis methodology. STPA was established as a safety analysis methodology based on systems theory, STAMP (Systems-Theoretic Accident Model and Processes), and is an analysis method that focuses on the interactions between the subsystems that make up a system. The procedure is as follows: the first step is to identify accidents, hazards, and safety constraints of the system; the second step is to clarify the interactions between elements by constructing a control structure; the third step is to extract unsafe control actions (UCA), which are unsafe interactions; and finally, the fourth step is to identify the causes of accidents and consider countermeasures. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2019-153028 A [Non-patent literature]

[0007] [Non-Patent Document 1] STPA HANDBOOK Summary of the Invention [Problem to be solved by the invention]

[0008] Depending on the physical positional relationship between the first vehicle and the second vehicle, the operation of one of the first vehicle and the second vehicle may pose a danger to the other vehicle. For this reason, the positions and operations of the first vehicle and the second vehicle must be taken into consideration when defining the vehicle control specifications. However, with a flow chart such as that described in Patent Document 1, it is difficult to grasp the positions and operations of the first vehicle and the second vehicle in the actual environment, and it is difficult to define the control specifications without any omissions.

[0009] Therefore, the present disclosure has been made in consideration of the above-mentioned problems, and aims to provide a technique that makes it possible to appropriately define control specifications. [Means for solving the problem]

[0010] A control specification definition method according to the present disclosure is a control specification definition method for defining a control specification used for controlling an autonomous driving of a first vehicle, the control specification definition method comprising the steps of: acquiring an operation for arranging a first model element representing a position and a motion of the first vehicle and a second model element representing a position and a motion of a second vehicle in a two-dimensional diagram; and defining the control specification based on the two-dimensional diagram in which the first model element and the second model element are arranged. The two-dimensional map includes a positional relationship between the first vehicle and the second vehicle at both a start point and a point after a certain time has elapsed. .

[0011] In addition, the vehicle control device according to the present disclosure includes an environment acquisition unit that acquires an environment in which a first vehicle is located, and a control unit that controls autonomous driving of the first vehicle based on a control specification defined based on a two-dimensional diagram in which a first model element representing the position and motion of the first vehicle and a second model element representing the position and motion of a second vehicle are arranged, and on the environment acquired by the environment acquisition unit. The two-dimensional diagram includes a positional relationship between the first vehicle and the second vehicle at both a start point and a point after a certain time has elapsed. .

[0012] Further, a control specification definition device according to the present disclosure is a control specification definition device that defines a control specification used for controlling the autonomous driving of a first vehicle, and includes an operation acquisition unit that acquires an operation for arranging a first model element representing a position and a motion of the first vehicle and a second model element representing a position and a motion of a second vehicle in a two-dimensional diagram, and a definition unit that defines the control specification based on the two-dimensional diagram in which the first model element and the second model element are arranged. The two-dimensional diagram includes a positional relationship between the first vehicle and the second vehicle at both a start point and a point after a certain time has elapsed. . Effect of the Invention

[0013] With this configuration, the control specifications can be appropriately defined. [Brief description of the drawings]

[0014] [Figure 1] 1 is a block diagram showing a configuration of a control specification definition device according to a first embodiment. [Diagram 2]FIG. 2 is a diagram showing model elements according to the first embodiment. [Diagram 3] 4 is a flowchart showing an operation of the control specifications definition device according to the first embodiment. [Figure 4] 1 is a block diagram showing a configuration of a vehicle control device according to a first embodiment. [Diagram 5] FIG. 11 is a diagram for explaining an example of a definition of a control specification according to the second embodiment. [Figure 6] FIG. 11 is a diagram for explaining an example of a definition of a control specification according to the second embodiment. [Figure 7] FIG. 11 is a diagram for explaining an example of a definition of a control specification according to the second embodiment. [Figure 8] FIG. 11 is a diagram for explaining an example of a definition of a control specification according to the second embodiment. [Figure 9] FIG. 11 is a diagram for explaining an example of a definition of a control specification according to the second embodiment. [Figure 10] FIG. 11 is a diagram for explaining an example of a definition of a control specification according to the third embodiment. [Figure 11] 11 is a flowchart showing an operation of the host vehicle according to the third embodiment. [Figure 12] FIG. 13 is a diagram for explaining an example of a definition of a control specification according to the fourth embodiment. [Figure 13] 13 is a flowchart showing an operation of the host vehicle according to the fourth embodiment. [Figure 14] FIG. 13 is a diagram comprehensively illustrating the behavior of a host vehicle according to a fifth embodiment. [Figure 15] FIG. 13 is a diagram comprehensively illustrating the behavior of a host vehicle according to a fifth embodiment. [Figure 16] FIG. 13 is a diagram comprehensively illustrating the behavior of a host vehicle according to a fifth embodiment. [Figure 17] FIG. 13 is a diagram comprehensively illustrating transition patterns of a host vehicle according to the fifth embodiment. [Figure 18] FIG. 13 is a diagram comprehensively illustrating transition patterns of other vehicles according to the fifth embodiment. [Figure 19] FIG. 13 is a diagram comprehensively illustrating combinations of a transition pattern of a host vehicle and a transition pattern of other vehicles according to the fifth embodiment. [Figure 20] FIG. 13 is a diagram showing an analysis result of a set of transition patterns according to the fifth embodiment. [Figure 21] FIG. 13 is a block diagram showing a configuration of a control specification definition device according to a sixth embodiment. [Figure 22] FIG. 23 is a diagram showing a flow of a safety analysis according to the sixth embodiment. [Figure 23] FIG. 23 is a diagram showing accidents, hazards, and safety constraints according to the sixth embodiment. [Figure 24] FIG. 23 is a diagram showing an example of a scenario that serves as an input for a safety analysis in accordance with the sixth embodiment. [Diagram 25] FIG. 23 is a diagram showing a control structure of a safety analysis in accordance with the sixth embodiment. [Figure 26] FIG. 23 is a diagram showing the results of analyzing UCA in a safety analysis according to the sixth embodiment. [Figure 27] FIG. 23 is a diagram showing a scenario leading to an accident by utilizing model elements for UCA of a safety analysis in accordance with the sixth embodiment. [Figure 28] FIG. 23 is a diagram showing a scenario that is not a UCA in the safety analysis according to the sixth embodiment. [Figure 29] FIG. 13 is a block diagram showing a hardware configuration of a control specification definition device according to a modified example. [Diagram 30] FIG. 13 is a block diagram showing a hardware configuration of a control specification definition device according to a modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Embodiment 1 FIG. 1 is a block diagram showing a configuration of a control specification definition device 1 according to the first embodiment. The control specification definition device 1 is a device that defines a control specification (also called a functional specification) used to control the autonomous driving of a first vehicle. Hereinafter, the first vehicle is described as a "host vehicle", a second vehicle other than the first vehicle is described as a "other vehicle", and when there is no distinction between the two, they are sometimes described as "vehicles". In addition, the host vehicle is sometimes described as X, and other vehicles other than the host vehicle X are mainly described as Y, A, B, etc. Note that the control specification definition device 1 may be mounted on the host vehicle, or may be configured to be capable of communicating with the host vehicle without being mounted on the host vehicle.

[0016] The control specification definition device 1 includes an operation acquisition unit 2 and a definition unit 3. The operation acquisition unit 2 acquires an operation to arrange a host vehicle model element, which is a first model element representing the position and operation of the host vehicle, and an other vehicle model element, which is a second model element representing the position and operation of the other vehicle, in a two-dimensional diagram (plan view) that is two-dimensional information. Since the host vehicle model element and the other vehicle model element are substantially the same, hereinafter, when there is no need to distinguish between the two, they may be described as "model elements". For the two-dimensional diagram in which the model elements are arranged, for example, a two-dimensional diagram that shows a schematic representation of a place where the control specification should be defined is used.

[0017] 2 is a diagram showing model elements. Note that the model elements described below are examples, and other model elements may be added to express various situations, and other expression methods may also be used as model elements.

[0018] The rectangular model elements are object nodes that represent the vehicle itself, other vehicles, and other objects. The object node contains the name of the object and its state. The same object may be placed multiple times before and after a behavior. Therefore, for the same object, an object node at one point in time and an object node at another point in time may be placed in the same 2D diagram.

[0019] Model elements with solid arrows represent vehicle behavior. Vehicle behavior is the operation of the vehicle that is related to the running of the vehicle. The behavior of one object at different times is represented by connecting multiple identical object nodes with model elements with solid arrows.

[0020] A diamond-shaped model element represents a branch. By combining a diamond-shaped model element representing a branch with a model element representing an operation such as a behavior, it is possible to provide a branch for either or both of the operation of the host vehicle and the operation of the other vehicle, and as a result, it is possible to define a scenario including various operation patterns.

[0021] The model elements with dashed arrows represent confirmation of the vehicle's position, speed, etc., which are behaviors other than the vehicle's operation. The model elements with dashed arrows can represent, for example, that the automatic control device of the vehicle itself has confirmed an object such as another vehicle, and that the automatic control device of the other vehicle has confirmed an object such as the vehicle itself. Note that confirmation here corresponds to recognition and awareness.

[0022] A model element with a thick line represents synchronization. A model element with a thick line is used to clarify the positional relationship of multiple objects at a certain point in time. This model element with a thick line synchronizes at least a part of the operation of the host vehicle with at least a part of the operation of another vehicle. The time of synchronization can be identified by writing a number (number, symbol) or the like next to the thick line. For example, if the time of synchronization is the same, the same or a related number is written next to the thick line of the synchronization, and if the time of synchronization is different, a different number is written next to the thick line of the synchronization.

[0023] The operation acquisition unit 2 in Fig. 1 acquires an operation for combining and arranging these model elements in a two-dimensional drawing (plan view), thereby acquiring an operation for arranging the host vehicle model elements and the other vehicle model elements in the two-dimensional drawing. Details of the model elements will be described in the second embodiment and onwards. Note that the operation acquisition unit 2 may be configured to read the above operation from a two-dimensional drawing drawn by hand or the like on paper, or may be configured as an input device of a design support tool that assists in drawing.

[0024] The definition unit 3 in Figure 1 defines the control specifications used to control the autonomous driving of the host vehicle based on the two-dimensional diagram (plan view) after the above operation, i.e., the two-dimensional diagram in which the host vehicle model elements and other vehicle model elements are arranged.

[0025] FIG. 3 is a flowchart showing the operation of the control specifications definition device 1 according to the first embodiment.

[0026] In step S1, the operation acquisition unit 2 acquires an operation for arranging, in a two-dimensional diagram, an own vehicle model element representing the position and motion of the own vehicle and another vehicle model element representing the position and motion of another vehicle.

[0027] In step S2, the definition unit 3 defines the control specifications used for controlling the autonomous driving of the host vehicle based on the two-dimensional diagram in which the host vehicle model elements and the other vehicle model elements are arranged. After that, the operation in FIG. 3 ends.

[0028] 4 is a block diagram showing a configuration of the vehicle control device 10 mounted on the host vehicle according to the present embodiment 1. Although details will be described later, the vehicle control device 10 is configured to use the control specifications defined by the control specifications definition device 1.

[0029] The vehicle control device 10 includes environment acquisition units 30, 31, and 32, which are multiple environment acquisition units mounted on the vehicle itself, an autonomous driving ECU (Electronic Control Unit) 20, an engine ECU 40, a brake ECU 41, a steering ECU 42, and in-vehicle networks 51 and 52. The autonomous driving ECU 20 is connected to the environment acquisition units 30, 31, and 32 via the in-vehicle network 51, and is connected to the engine ECU 40, the brake ECU 41, and the steering ECU 42 via the in-vehicle network 52.

[0030] The environment acquisition units 30 to 32 acquire environmental information, which is information on the environment in which the vehicle is located, such as information on the surrounding environment of the vehicle. Each of the environment acquisition units 30, 31, and 32 uses various sensors, such as a camera, a millimeter wave radar, and a sonar, as well as a vehicle-to-vehicle communication module and a road-to-vehicle communication module. The number of environment acquisition units is not limited to three as shown in FIG. 4.

[0031] The autonomous driving ECU 20 includes a recognition unit 21 and a control unit, that is, a vehicle control unit 22. The autonomous driving ECU 20 stores the above-described control specifications, that is, the control specifications defined by the control specifications definition device 1 based on a two-dimensional diagram in which the host vehicle model elements and the other vehicle model elements are arranged.

[0032] The recognition unit 21 aggregates the environmental information acquired by the environment acquisition units 30 to 32. The vehicle control unit 22 controls the autonomous driving of the vehicle based on the control specifications and the environmental information aggregated by the recognition unit 21. For example, the vehicle control unit 22 generates a driving route along which the vehicle should autonomously drive based on the position and destination of the vehicle, and calculates a control amount based on the control specifications and the environmental information aggregated by the recognition unit 21 when the control specifications are defined for the driving route. The control amount here includes, for example, a target steering angle, a target engine drive amount, and a target brake drive amount. The vehicle control unit 22 outputs the calculation results such as the control amount to the engine ECU 40, the brake ECU 41, and the steering ECU 42 via the in-vehicle network 52.

[0033] The engine ECU 40, the brake ECU 41, and the steering ECU 42 each perform actuator control based on the calculation result. The vehicle control device 10 configured as described above realizes autonomous driving of the vehicle. Note that the autonomous driving may be autonomous driving under AD (Autonomous Driving) control or autonomous driving under ADAS (Advanced Driver Assistance System) control.

[0034] As described above, this is a control specification definition method that defines the control specifications used to control the autonomous driving of a first vehicle, and acquires an operation to arrange a first model element representing the position and movement of the first vehicle and a second model element representing the position and movement of the second vehicle in a two-dimensional diagram, and defines the control specifications based on the two-dimensional diagram in which the first model element and the second model element are arranged, so that the control specifications can be appropriately defined.

[0035] In addition, since the vehicle control device is equipped with an environment acquisition unit that acquires the environment in which the first vehicle is located, control specifications defined based on a two-dimensional diagram in which a first model element representing the position and movement of the first vehicle and a second model element representing the position and movement of the second vehicle are arranged, and a control unit that controls the automatic driving of the first vehicle based on the environment acquired by the environment acquisition unit, the control specifications can be appropriately defined.

[0036] Furthermore, the control specification definition device defines the control specifications used to control the autonomous driving of the first vehicle, and includes an operation acquisition unit that acquires an operation to arrange a first model element representing the position and movement of the first vehicle and a second model element representing the position and movement of the second vehicle on a two-dimensional drawing, and a definition unit that defines the control specifications based on the two-dimensional drawing on which the first model element and the second model element are arranged, so that the control specifications can be appropriately defined.

[0037] Embodiment 2 In the present embodiment 2, an example will be described in which the control specifications of a vehicle control device 10 are defined using the model elements described in the embodiment 1. Note that the configurations of a control specifications definition device 1 and a vehicle control device 10 according to the embodiment 2 are similar to the configurations of Fig. 1 and Fig. 4 described in the embodiment 1.

[0038] Fig. 5 is a diagram showing an example of a scenario in which the host vehicle X overtakes another vehicle Y. Fig. 5 shows the positional relationship between the host vehicle X and the other vehicle Y represented without using the model elements in Fig. 2, and the positional relationship between the host vehicle X and the other vehicle Y represented using the model elements in Fig. 2.

[0039] In the example of Fig. 5, a straight road with three lanes on each side is assumed. In addition, a scenario is assumed in which, at the start of the road, the host vehicle X traveling in the center lane is located to the right rear of the other vehicle Y traveling in the left lane, and as the host vehicle X accelerates, the host vehicle X will overtake the other vehicle Y in the left lane at a certain time after the start of the road.

[0040] When the model elements of FIG. 2 are not used, the positional relationship between the host vehicle X and the other vehicle Y in this scenario is represented by two diagrams, one above the other, on the left side of FIG. 5. On the other hand, when the model elements of FIG. 2 are used, the positional relationship between the host vehicle X and the other vehicle Y in this scenario is represented by one diagram on the right side of FIG. 5. In the diagram on the right side of FIG. 5, object nodes of the host vehicle X and the other vehicle Y are arranged for both the start time and a time point after a certain time has elapsed from the start time, and the object nodes of the same vehicle are connected by arrows. In the example of FIG. 5, the other vehicle Y in the left lane runs at a constant speed, and the host vehicle X in the center lane runs at an accelerated speed. As a result, the host vehicle X accelerates to overtake the other vehicle Y running at a constant speed, which is represented by making the arrow representing the behavior relatively long. By using the model elements in this way, it is possible to represent the positions and behaviors of the host vehicle X and the other vehicle Y in one diagram.

[0041] FIG. 6 is a diagram showing an example in which a branch is provided for the behavior of the vehicle using the model elements in FIG. 2. In the example in FIG. 6, a straight road with three lanes on each side is also assumed. When the vehicle is traveling in the center lane, the relationship of the vehicle's position when one of "change lanes to the left lane," "continue traveling in the center lane," and "change lanes to the right lane" is selected and executed is comprehensively shown. In the example in FIG. 6, the state during lane changing can be expressed as an intermediate state by providing a frame for "on lane" in the two-dimensional diagram (plan view).

[0042] In the example of FIG. 6, the selection condition is not specified, but the selection condition may be added to the behavior after the branch, that is, to the arrow. For example, the selection condition may be added as "If there is another vehicle ahead in the center lane, change lanes to the right lane." By using the branch as shown in FIG. 6, it becomes possible to express a scenario including a plurality of operation patterns in one drawing. Since a branch is provided in at least one of the operation of the first vehicle of the first model element and the operation of the second vehicle of the second model element, the control specification can be appropriately defined.

[0043] Fig. 7 is a diagram showing an example in which synchronization is provided using the model elements of Fig. 2. Fig. 7 shows the positional relationship between the host vehicle X and another vehicle Y represented without using the model elements of Fig. 2, and the positional relationship between the host vehicle X and another vehicle Y represented using the model elements of Fig. 2.

[0044] As the synchronization at time (1), the positional relationship of the host vehicle X traveling in the center lane and the other vehicle Y traveling in the left lane running side by side in the traveling direction is shown. From time (1), the host vehicle X runs at a speed of 60 km / h, and the other vehicle Y runs at a speed of 40 km / h. As the synchronization at time (2) after a certain time has elapsed from time (1), the positional relationship of the host vehicle X overtaking the other vehicle Y is shown. Although such a positional relationship can be expressed to some extent by only object nodes and arrows as in FIG. 5, the positional relationship at the same time can be clarified by using the synchronization as in FIG. 7. Therefore, for example, it is possible to clearly express the positional relationship between the host vehicle and the other vehicle after the branch in FIG. 6. Since at least a part of the operation of the first vehicle in the first model element and at least a part of the operation of the second vehicle in the second model element are synchronized, the control specification can be appropriately defined.

[0045] Figure 8 is a diagram showing an example of a scenario in which an operation other than vehicle behavior is performed using the model elements in Figure 2. The example in Figure 8 shows that a vehicle traveling in the center lane on a straight road with three lanes on each side checks (recognizes) the position and operation of another vehicle traveling in the left lane.

[0046] Since the operation of the first vehicle includes at least one of the position and operation of the first vehicle and recognition of objects from the first vehicle, and the operation of the second vehicle includes at least one of the position and operation of the second vehicle and recognition of objects from the second vehicle, the control specifications can be appropriately defined.

[0047] FIG. 9 is a diagram showing an example of a scenario in which the host vehicle and another vehicle change lanes using the model elements in FIG. 2. In the example in FIG. 9, the host vehicle changes lanes from the center lane to the left lane, and the other vehicle changes lanes from the left lane to the center lane. In "on lane," the host vehicle and the other vehicle are located in the same position, so there is a possibility of collision. By using the model elements as described above, it is possible to express the possibility of collision between the host vehicle and the other vehicle during lane change, which could not be expressed by a flow chart or the like. Note that the right lane is omitted in FIG. 9.

[0048] As described above, in addition to the contents of the first embodiment, the control specifications can be appropriately defined by branching, synchronization, and acknowledgment (confirmation).

[0049] Embodiment 3 In this embodiment 3, an example will be described in which the control specifications of a vehicle control device 10 are defined by combining the model elements described in the embodiment 1. Note that the configurations of a control specifications definition device 1 and a vehicle control device 10 according to the embodiment 3 are similar to the configurations of Fig. 1 and Fig. 4 described in the embodiment 1.

[0050] Fig. 10 is a diagram showing an example of a scenario in which the host vehicle X overtakes another vehicle Y ahead of the host vehicle X. Fig. 10 shows the positional relationship between the host vehicle X and the other vehicle Y represented without using the model elements in Fig. 2, and the positional relationship between the host vehicle X and the other vehicle Y represented using the model elements in Fig. 2.

[0051] At time (1), which is the start time, the host vehicle X is traveling in the left lane, and another vehicle Y is traveling ahead of the host vehicle X. The host vehicle X first checks the speed of the other vehicle Y, and determines whether the speed of the other vehicle Y is equal to or lower than a threshold value and whether the host vehicle X is allowed to change lanes.

[0052] If the speed of the other vehicle Y is equal to or lower than the threshold value and it is not determined that the host vehicle X can change lanes (if at least one of these is denied), the host vehicle X at time (3)-1 continues traveling in the left lane and follows the other vehicle Y at time (3) which is synchronized with time (3)-1.

[0053] When the speed of the other vehicle X is equal to or lower than the threshold value and it is determined that the host vehicle Y can change lanes, the host vehicle X changes lanes to the center lane and accelerates after the lane change to transition to the host vehicle X at time (2). Then, the host vehicle X at time (2) checks the position of the other vehicle Y at time (2) and determines whether the other vehicle Y is located a certain distance or more behind the host vehicle X.

[0054] When it is determined that the other vehicle Y is located at a certain distance or more behind the subject vehicle X, the subject vehicle X changes lanes to the left lane in order to transition to the subject vehicle X at time (3)-2. As a result, the subject vehicle X at time (3)-2 will be traveling ahead of the other vehicle Y at time (3) which is synchronized with time (3)-2, and the overtaking will be completed.

[0055] If it is determined that the other vehicle Y is not located rearward of the host vehicle X by a distance greater than a certain distance, the host vehicle X at time (3)-3 continues traveling in the center lane and increases the distance between the host vehicle X and the other vehicle Y at time (3) which is synchronized with time (3)-3.

[0056] In the above-described scenario, information for performing operations of the host vehicle X, such as “checking the speed of the other vehicle Y” and “checking the position of the other vehicle Y”, is collected by the recognition unit 21, and the control of the vehicle control device 10, i.e., the operation of the host vehicle X, is determined by the vehicle control unit 22.

[0057] Fig. 11 is a flowchart showing the control of the vehicle control device 10, i.e., the operation of the host vehicle X, using the control specifications based on the two-dimensional diagram shown in Fig. 10. For convenience of explanation, the operation explained in Fig. 10 is slightly different from the operation in Fig. 11 explained below, but it is possible to make it completely the same as the operation in Fig. 11.

[0058] First, in step S11, the host vehicle detects and confirms the speed of another vehicle traveling ahead of the host vehicle. This operation corresponds to the operation at time (1) in FIG.

[0059] Next, in step S12, the host vehicle judges whether or not to overtake and whether or not it is possible to change lanes. The judgment of whether or not to overtake is made, for example, based on whether or not the speed of the other vehicle is equal to or lower than a threshold. The judgment of whether or not it is possible to change lanes is made, for example, based on whether or not there is another vehicle in the lane change destination.

[0060] If it is determined that overtaking will not be performed, or if it is determined that a lane change is not possible, the operation in Fig. 11 ends. The operation at this time corresponds to the operation at time point (3)-1 in Fig. 10. On the other hand, if it is determined that overtaking will be performed and that a lane change is possible, the process proceeds to step S13.

[0061] In step S13, the host vehicle changes lanes, and in step S14, the host vehicle accelerates to overtake another vehicle in the left lane.

[0062] Next, in step S15, the host vehicle judges whether or not the other vehicle is located behind the host vehicle at a distance greater than a certain distance. If it is judged that the other vehicle is located behind the host vehicle at a distance greater than a certain distance, the process proceeds to step S16. On the other hand, if it is judged that the other vehicle is not located behind the host vehicle at a distance greater than a certain distance, the operation in FIG. 11 ends. The operation at this time corresponds to the operation at time point (3)-3 in FIG. 10.

[0063] In step S16, the host vehicle changes lanes into the lane in which the other vehicle is traveling, completing the overtaking. The operation at this time corresponds to the operation at time (3)-2 in FIG.

[0064] As described above, in addition to the contents of the first embodiment, the control specifications can be appropriately defined by branching, synchronization, and recognition (confirmation). According to the third embodiment, by combining the model elements of Fig. 2, a plurality of scenarios that take into account the positions and operations of the vehicle itself and other vehicles can be defined as control specifications. Note that, in the third embodiment, the explanation has been given using a scenario assuming overtaking, but applicable scenarios are not limited to these and can be applied to a wide variety of scenarios.

[0065] Embodiment 4 In the fourth embodiment, another example will be described in which the control specifications of the vehicle control device 10 are defined by combining the model elements described in the first embodiment. Note that the configurations of the control specifications definition device 1 and the vehicle control device 10 according to the fourth embodiment are similar to the configurations of Fig. 1 and Fig. 4 described in the first embodiment.

[0066] Fig. 12 is a diagram showing an example of a scenario in which a vehicle X traveling in a lane before a merging road such as a side road merges into a lane to be merging such as a main road. Fig. 12 shows the positional relationship between the vehicle X and another vehicle Y represented without using the model elements in Fig. 2, and the positional relationship between the vehicle X and another vehicle Y represented using the model elements in Fig. 2.

[0067] At time (1), which is the start time, the host vehicle X is traveling in the lane ahead of the merging lane that disappears after merging, and the other vehicle Y is traveling in the lane to which the merging is to occur. The host vehicle X checks the speed and position of the other vehicle Y and determines whether the host vehicle X can change lanes to the lane to which the merging is to occur. If it is determined that the host vehicle X can change lanes to the lane to which the merging is to occur, the host vehicle X changes lanes to the lane to which the merging is to occur, and accelerates after the lane change, in order to transition to the host vehicle X at time (2). As a result, the host vehicle X at time (2) travels behind the other vehicle Y at time (2)-1, which is synchronized with time (2), or travels ahead of the other vehicle Y at time (2)-2, which is synchronized with time (2).

[0068] If it is not determined that the host vehicle X can change lanes to the merging lane, the host vehicle X travels in the lane ahead of the merging lane while decelerating, and confirms that the other vehicle Y will overtake the host vehicle X. Next, the host vehicle X confirms the position and speed of another vehicle Z (not shown) following the other vehicle Y, and determines whether the host vehicle X can change lanes to the merging lane. If it is determined that the host vehicle X can change lanes to the merging lane, the host vehicle X changes lanes to the merging lane and accelerates after the lane change, in order to transition to the host vehicle X at time point (3). As a result, the host vehicle X at time point (3) travels behind the other vehicle Y at time point (3).

[0069] If it is not determined that the vehicle X can change lanes to the merging lane and if it is determined that the vehicle X has reached the point just before the disappearance point of the preceding lane, the vehicle X stops traveling and checks whether other vehicles, including the other vehicle Y, will overtake the vehicle X. After stopping, the vehicle X determines whether it can change lanes to the merging lane in the same manner as above, and if it is determined that the vehicle X can change lanes to the merging lane, the vehicle X changes lanes to the merging lane and accelerates to move to the vehicle X at time (4). As a result, the vehicle X at time (4) travels behind the other vehicle Z (not shown) at time (4) that is located in front of the vehicle X at time (4).

[0070] In the above scenario, information for performing operations of the host vehicle X, such as “checking the position and speed of other vehicles,” is collected by the recognition unit 21, and the control of the vehicle control device 10, i.e., the operation of the host vehicle X, is determined by the vehicle control unit 22.

[0071] Fig. 13 is a flowchart showing the control of the vehicle control device 10, i.e., the operation of the host vehicle X, using the control specifications based on the two-dimensional diagram shown in Fig. 12. For convenience of explanation, the operation explained in Fig. 12 is slightly different from the operation in Fig. 13 explained below, but it is possible to make it completely identical to the operation in Fig. 13.

[0072] First, in step S21, the vehicle checks for other vehicles in the merging lane. Next, in step S22, the vehicle determines whether or not it is possible to change lanes to the merging lane. For example, if the vehicle determines that the distance to the other vehicle is equal to or greater than a threshold and that the speed of the other vehicle is equal to or less than a threshold, the vehicle determines that it is possible to change lanes to the merging lane, and if the vehicle determines that the distance to the other vehicle is equal to or greater than a threshold and that the speed of the other vehicle is equal to or less than a threshold (if at least one of the conditions is not met), the vehicle determines that it is not possible to change lanes to the merging lane.

[0073] If it is determined that a lane change to the merging lane is possible, the process proceeds to step S23. On the other hand, if it is not determined that a lane change to the merging lane is possible, the process proceeds to step S26.

[0074] In step S23, the vehicle decelerates, and in step S24, it is determined whether the vehicle has reached the vanishing point of the preceding lane before merging. If it is determined that the vehicle has reached the vanishing point of the preceding lane before merging, the process proceeds to step S25, and if it is determined that the vehicle has not reached the vanishing point, the process returns to step S21.

[0075] In step S25, the host vehicle stops, and then the process returns to step S21.

[0076] In step S26, the vehicle changes lanes to the merging lane, and in step S27, the vehicle accelerates. After that, the operation in FIG. 13 ends.

[0077] As described above, in addition to the contents of the first embodiment, the control specifications can be appropriately defined by branching, synchronization, and recognition (confirmation). According to the fourth embodiment, by combining the model elements of Fig. 2, a plurality of scenarios that take into account the positions and operations of the vehicle itself and other vehicles can be defined as control specifications. Note that, in the fourth embodiment, a scenario assuming merging has been described, but applicable scenarios are not limited to these and can be applied to a wide variety of scenarios.

[0078] Embodiment 5. In the fifth embodiment, an example will be described in which the operations of the host vehicle and other vehicles are comprehensively expressed using the model elements described in the first embodiment. Note that the configurations of a control specifications definition device 1 and a vehicle control device 10 according to the fifth embodiment are similar to the configurations of Fig. 1 and Fig. 4 described in the first embodiment.

[0079] Figures 14 to 16 are diagrams comprehensively illustrating the behavior of a host vehicle traveling on a straight road with three lanes on each side, using the model elements of Figure 2. In Figure 14, the possibility of changing the speed and the possibility of changing the lane from the current position of the host vehicle are illustrated as the comprehensive behavior of the host vehicle. Similarly, Figure 15 illustrates the comprehensive behavior of the host vehicle when the initial position of the host vehicle is in the center lane, and Figure 16 illustrates the comprehensive behavior of the host vehicle when the initial position of the host vehicle is in the right lane.

[0080] As shown in FIG. 14, when the initial position of the host vehicle is in the left lane, the host vehicle may first select one of three behaviors: accelerating, maintaining speed, and decelerating. As the next branch of selection, the host vehicle may select one of two behaviors: keeping in lane and changing lanes. In FIG. 15 and FIG. 16, the host vehicle may also select one of the behaviors similar to that in FIG. 14. The numerical values ​​shown in FIG. 14 to FIG. 16 represent the number of possible behaviors.

[0081] Fig. 17 is a diagram comprehensively showing the transition patterns of the host vehicle, Fig. 18 is a diagram comprehensively showing the transition patterns of other vehicles, and Fig. 19 is a diagram comprehensively showing combinations of the transition patterns of the host vehicle and the transition patterns of other vehicles.

[0082] When the host vehicle is initially located in the left lane (A0 in FIG. 17) and the other vehicle is initially located in the center lane (B0 in FIG. 18), the host vehicle transitions from A0 to A1 to A2 to A3 as shown in FIG. 17, and the other vehicle transitions from B0 to B1 to B2 to B3 as shown in FIG. 18. Since the host vehicle and the other vehicle may accelerate or decelerate during the transition, they may not run side by side, but the transition patterns of the host vehicle and the other vehicle shown in FIG. 19 make it possible to grasp the possibility of the host vehicle and the other vehicle running side by side. Specifically, in "A1B1", "A2B2", and "A3B3", the host vehicle and the other vehicle are running side by side, and therefore there is a possibility of a collision if the host vehicle and the other vehicle are in the same lane.

[0083] FIG. 20 is a diagram showing an analysis result of the possibility of collision in "A1B1" among the transition patterns shown in FIG. 19. As shown in FIG. 17, in A1, the host vehicle may be in the left lane or the center lane. On the other hand, as shown in FIG. 18, in B1, the other vehicle may be in the left lane, the center lane, or the right lane. Among states No. 1 to No. 6 in FIG. 20, there is a possibility of collision in state No. 1 and state No. 5 where the host vehicle and the other vehicle are in the same lane. In addition, as the final state of "A1B1", the positions of the host vehicle and the other vehicle are different, but considering the transition from "A0B0" to "A1B1", there is also a possibility of collision in state No. 4 where there is a possibility of intersecting at the time of the transition. On the other hand, there is no possibility of collision in any of states No. 2, 3, and 6.

[0084] As described above, according to the fifth embodiment in which the positional relationship between the host vehicle and other vehicles is comprehensively expressed using the elements in Fig. 2, it becomes possible to check the possibility of collision, which could not be checked using a flowchart, etc. The control specifications definition device 1 may generate an analysis result of the possibility of collision between the host vehicle and other vehicles as shown in Fig. 20, based on the control specifications defined by the definition unit 3.

[0085] Embodiment 6 In the sixth embodiment, the model elements described in any one of the first to fifth embodiments are used to carry out STPA, which is a safety analysis, on the behavior of the host vehicle and other vehicles.

[0086] Fig. 21 is a block diagram showing a configuration of a control specification definition device 1 according to the sixth embodiment. The difference from the control specification definition device 1 in Fig. 1 is that a safety analysis unit 4 is provided. The safety analysis unit 4 performs a safety analysis based on a two-dimensional diagram (plan view) in which model elements of the host vehicle and model elements of other vehicles defined by the operation acquisition unit 2 are arranged, and a definition unit 3 defines a control specification used for controlling the autonomous driving of the host vehicle using the analysis result.

[0087] Fig. 22 shows the flow of the safety analysis performed by the safety analysis unit 4. First, in step S31, accidents, hazards, and safety constraints of the system are identified. These are the same as the 1st step of the STPA procedure.

[0088] Next, in step S32, a scenario expressing the behavior of the automated driving system to be analyzed is acquired from the operation acquisition unit 2. In conventional simple STPA, the characters in the system and their interactions are identified in order to build a control structure in the next step S33. However, in the present disclosure, in addition to the characters, their behaviors are input as an organized scenario using model elements in the step S32, which makes it possible to prevent elements and interactions in the control structure from being overlooked.

[0089] Next, in step S33, a control structure is constructed in the same way as in the 2nd step of the STPA procedure. The control structure is constructed according to the conventional STPA procedure. By aligning it with the scenario defined in step S32, the behavior can also be clarified.

[0090] Next, in step S34, similar to the 3rd step of the STPA procedure, guide words are applied to the control actions defined in the control structure to extract unsafe interactions (UCAs: Unsafe Control Actions).

[0091] Next, in step S35, the UCA scenario extracted in step S34 is expressed as a scenario using model elements. By showing the UCA in a diagram using model elements, the series of scenarios leading up to an accident can be clarified. Also, for areas that were not extracted as UCA, it is possible to clearly indicate that there is no UCA.

[0092] Next, in step S36, the cause of the accident is identified as the fourth step of the STPA procedure, and measures to prevent the accident are considered. Note that although this flow assumes STPA, the method of safety analysis is not limited to STPA.

[0093] FIG. 23 is a diagram of an example in which accidents, hazards, and safety constraints of the system are defined for an example of a function for recognizing a vehicle ahead, assuming a use case in which the automated driving system follows a vehicle ahead on a highway in accordance with step S31. The definitions are as follows: An accident is colliding with or being collided with another vehicle or surroundings. A hazard is not being able to recognize (check) the vehicle ahead. A safety constraint is being able to recognize (check) the vehicle ahead.

[0094] FIG. 24 is a diagram showing a model representation of an example of a scenario that serves as an input for safety analysis. The scenario shows a case where the vehicle in front changes lanes while the vehicle in front is following a vehicle in a driving lane two lanes above during a traffic jam. The vehicle in front continues to drive in the driving lane. At the time of synchronization (1), the vehicle in front A is driving in front of the vehicle ...

[0095] FIG. 25 is a diagram of an example of a control structure constructed in step S33. In the diagram, solid lines indicate control actions, and dotted lines indicate feedback data. The control structure organizes the systems to be analyzed and the surrounding actors (the vehicle itself, the vehicle ahead, other vehicles, the driver, the traffic environment, etc.) and creates "operation status," "traffic environment information," etc., taking into account the interactions between them. By referring to FIG. 24, behaviors such as "running" and "recognizing" shown in FIG. 24 can also be shown as control actions in FIG. 25, thereby enriching the control structure.

[0096] Figure 26 shows the results of UCA analysis of the control action "recognize a vehicle ahead" shown in Figures 24 and 25. CA is the target recognition content, and provision conditions are the conditions (situations) of other vehicles by CA. In conventional UCA extraction, analysis is performed by applying four guide words, "Not Providing," "Providing causes hazard," "Too early / Too late," and "Stop too soon / Applying too long," to the target control action. In particular, since recognition is the target of analysis in Figure 26, "Providing causes hazard" is subdivided and analyzed into "correct recognition" and "misrecognition." In addition, "misrecognition" is further subdivided into "misrecognition where the recognition target itself is mistaken" and "misrecognition where the label of the recognition target is mistaken."

[0097] By further subdividing the original UCA, when the control action is recognition, the impact on subsequent vehicle operation may differ depending on whether the recognition is correct or incorrect, and in the case of incorrect recognition, whether the recognition target itself is incorrect or the label of the recognition target is incorrect. Therefore, by performing a subdividing analysis, the different impacts can be comprehensively taken into consideration.

[0098] In the scenario in Figure 24, there are four scenes in which a vehicle ahead is recognized, so an analysis is performed for each scene. In Figure 24, "recognition of 2 and 3" have the same timing, so they are mutually related UCAs. For example, in the case of "Not providing" where "recognition of 2" is not provided, providing "recognition of 3" becomes a UCA, and the reverse pattern (recognition of 2 is provided, but recognition of 3 is not provided) also applies.

[0099] Figure 27 shows an example of expressing a scenario leading up to an accident by utilizing model elements for the UCA "(A) Not recognizing the vehicle ahead and colliding with it" in "Not Providing" of the analyzed UCA (Figure 26). Because "Recognizing vehicle A ahead" is not provided, the scenario is expressed in which the vehicle X accelerates and collides with vehicle A ahead that is changing lanes.

[0100] Figure 28 is an example of a scenario expressed by utilizing model elements for "(B) The vehicle ahead is correctly recognized, no problem" of "Correct recognition" which was not a UCA in the analyzed UCA (Figure 26). The scenario is expressed in which the provision of "Recognize vehicle A ahead" prevents an accident. In "Recognize 1" in Figure 28, vehicle A ahead has not started changing lanes at this stage, so there is no problem for vehicle X as long as it correctly recognizes vehicle A ahead.

[0101] By utilizing scenario diagrams that utilize model elements in STPA, a safety analysis, it is possible to take into account the dynamic behavior of the vehicle itself and other vehicles, making it possible to clarify the interactions between the vehicle itself and its surroundings when creating the control structure.

[0102] In addition, the scenarios to be analyzed can be limited. Conventional STPA analysis only considered the use case of "following the vehicle ahead in a traffic jam on a highway with an autonomous driving system at level 3," but analysis using a road position relationship map makes it possible to limit the analysis to the scenario of "lane change by the vehicle ahead."

[0103] Furthermore, a detailed UCA analysis is possible for one control action.In conventional STPA methods, an analysis is performed for one control action, "recognize the vehicle ahead," without limiting the scene, so the analysis ends with one UCA evoked by each guide word being recorded, which is likely to result in a shallower analysis than the analysis results in Figure 26.

[0104] In addition, after extracting the UCA, the scenario can be clarified by expressing it using the UCA scenario as a model element, so that it is possible to clarify that there is no UCA even for parts of the scenario that are not included in the UCA.

[0105] As described above, the control specification definition method defines the control specifications used to control the autonomous driving of a first vehicle, and acquires an operation of arranging a first model element representing the position and movement of the first vehicle and a second model element representing the position and movement of a second vehicle in a two-dimensional diagram, acquires a safety analysis result based on the plan view in which the first model element and the second model element are arranged, and defines the control specifications based on the two-dimensional diagram in which the first model element and the second model element are arranged and the safety analysis result, thereby enabling the control specifications to be appropriately defined.

[0106] In addition, since the safety analysis result is a control specification definition method in which a control structure is created using a two-dimensional diagram in which the first model elements and the second model elements are arranged, and a scenario leading up to an accident is created using a two-dimensional diagram in which the first model elements and the second model elements are arranged, and which is an analysis result by STPA, the control specification can be appropriately defined.

[0107] Furthermore, the control specification definition device defines the control specifications used to control the autonomous driving of the first vehicle, and includes an operation acquisition unit that acquires an operation to arrange a first model element representing the position and movement of the first vehicle and a second model element representing the position and movement of the second vehicle in a two-dimensional diagram, a safety analysis unit that acquires a safety analysis result based on the two-dimensional diagram in which the first model elements and the second model elements are arranged, and a definition unit that defines the control specifications based on the two-dimensional diagram in which the first model elements and the second model elements are arranged, and defines the control specifications based on the safety analysis result, thereby enabling the control specifications to be appropriately defined.

[0108] Variation 1. 29 and 30 are block diagrams showing hardware configurations of a control specification definition device and a vehicle control device according to the modifications of the first to sixth embodiments. The operation acquisition unit 2 and the definition unit 3 in FIG. 1 and the operation acquisition unit 2, the definition unit 3, and the safety analysis unit 4 in FIG. 21 are collectively referred to as the "operation acquisition unit 2, etc." The operation acquisition unit 2, etc. are realized by a processing circuit 81 shown in FIG. 29. That is, the processing circuit 81 includes an operation acquisition unit 2 that acquires an operation for arranging a model element of a vehicle in a two-dimensional drawing (plan view), a definition unit 3 that defines a control specification based on the two-dimensional drawing, and a safety analysis unit 4 that performs a safety analysis. Dedicated hardware may be applied to the processing circuit 81, or a processor 82 that executes a program stored in a memory 83 may be applied. The processor 82 may be, for example, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, a DSP (Digital Signal Processor), or the like.

[0109] When the processing circuit 81 is a dedicated hardware, the processing circuit 81 corresponds to, for example, a single circuit, a composite circuit, a programmed processor 82, a parallel programmed processor 82, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination of these. Each function of the operation acquisition unit 2 and the like may be realized by a circuit in which the processing circuit 81 is distributed, or the functions of each unit may be realized by a single processing circuit 81.

[0110] When the processing circuit 81 is a processor 82, the functions of the operation acquisition unit 2 and the like are realized by a combination with software and the like. The software and the like includes, for example, software and firmware. The software and the like is written as a program and stored in the memory 83. As shown in FIG. 22, the processor 82 applied to the processing circuit 81 realizes the functions of each unit by reading and executing the program stored in the memory 83. That is, the control specification definition device 1 includes a memory 83 for storing a program that, when executed by the processing circuit 81, results in the execution of a step of acquiring an operation for arranging a first model element representing the position and operation of a first vehicle and a second model element representing the position and operation of a second vehicle in a two-dimensional diagram, and a step of defining a control specification based on the two-dimensional diagram in which the first model element and the second model element are arranged. In other words, this program can be said to cause a computer to execute a procedure or method of the operation acquisition unit 2 and the like. Here, the memory 83 may be, for example, a non-volatile or volatile semiconductor memory such as a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory, an EPROM (Erasable Programmable Read Only Memory), an EEPROM (Electrically Erasable Programmable Read Only Memory), an HDD (Hard Disk Drive), a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, a DVD (Digital Versatile Disc), a drive device thereof, or any storage medium to be used in the future.

[0111] The above describes a configuration in which each function of the operation acquisition unit 2, etc. is realized by either hardware or software, etc. The present disclosure is not limited to this, and may be configured in such a way that a part of the operation acquisition unit 2, etc. is realized by dedicated hardware, and another part is realized by software, etc. For example, the operation acquisition unit 2, etc. may be realized by a processing circuit 81, an interface, a receiver, etc. as dedicated hardware, and the remaining functions may be realized by the processing circuit 81 as a processor 82 reading and executing a program stored in a memory 83.

[0112] As described above, the processing circuitry 81 can realize each of the above-mentioned functions by hardware, software, or a combination of these.

[0113] The above-described control specification definition device 1 can also be applied to a control specification definition system constructed as a system by appropriately combining devices and servers. In this case, each function or each component of the above-described control specification definition device 1 may be distributed among the devices that construct the system, or may be concentrated in one of the devices.

[0114] It is possible to freely combine the embodiments and the modifications, and to modify or omit the embodiments and the modifications as appropriate. In the drawings, the same reference numerals are used to denote the same or equivalent parts, and this is common throughout the entire specification and all the drawings. Furthermore, the forms of the components shown in the entire specification are merely examples and are not limited to these descriptions. [Explanation of symbols]

[0115] 1 control specification definition device, 2 operation acquisition unit, 3 definition unit, 4 safety analysis unit, 10 vehicle control device, 20 autonomous driving ECU, 21 recognition unit, 22 vehicle control unit, 30, 31, 32 environment acquisition unit, 40 engine ECU, 41 brake ECU, 42 steering ECU, 51, 52 in-vehicle network, 81 processing circuit, 82 processor, 83 memory.

Claims

1. A control specification definition method for defining a control specification used for controlling an autonomous driving of a first vehicle, obtaining an operation of arranging a first model element representing a position and a motion of the first vehicle and a second model element representing a position and a motion of a second vehicle on a two-dimensional diagram; defining the control specification based on the two-dimensional diagram in which the first model element and the second model element are arranged; A control specification definition method, wherein the two-dimensional diagram includes a positional relationship between the first vehicle and the second vehicle both at a start point and at a point after a certain time has elapsed.

2. A control specification definition method for defining a control specification used for controlling an autonomous driving of a first vehicle, obtaining an operation of arranging a first model element representing a position and a motion of the first vehicle and a second model element representing a position and a motion of a second vehicle on a two-dimensional diagram; obtaining a safety analysis result based on the two-dimensional diagram in which the first model element and the second model element are arranged; defining the control specification based on the two-dimensional diagram in which the first model element and the second model element are arranged and the safety analysis result; A control specification definition method, wherein the two-dimensional diagram includes a positional relationship between the first vehicle and the second vehicle both at a start point and at a point after a certain time has elapsed.

3. A control specification definition method for defining a control specification used for controlling an autonomous driving of a first vehicle, obtaining an operation of arranging a first model element representing a position and a motion of the first vehicle and a second model element representing a position and a motion of a second vehicle on a two-dimensional diagram; obtaining a safety analysis result based on the two-dimensional diagram in which the first model element and the second model element are arranged; defining the control specification based on the two-dimensional diagram in which the first model element and the second model element are arranged and the safety analysis result; a control specification definition method in which the safety analysis result is an analysis result by STPA (System Theoretic Process Analysis), in which a control structure is created using the two-dimensional diagram in which the first model elements and the second model elements are arranged, and a scenario leading up to an accident is created using the two-dimensional diagram in which the first model elements and the second model elements are arranged.

4. 3. The control specification definition method according to claim 2, a control specification definition method in which the safety analysis result is an analysis result by STPA (System Theoretic Process Analysis), in which a control structure is created using the two-dimensional diagram in which the first model elements and the second model elements are arranged, and a scenario leading up to an accident is created using the two-dimensional diagram in which the first model elements and the second model elements are arranged.

5. A method for defining control specifications according to any one of claims 1 to 3, comprising the steps of: A control specification definition method, in which a branch is provided for at least one of the operation of the first vehicle of the first model element and the operation of the second vehicle of the second model element.

6. A method for defining control specifications according to any one of claims 1 to 3, comprising the steps of: A method for defining a control specification, wherein at least a portion of the operation of the first vehicle of the first model element and at least a portion of the operation of the second vehicle of the second model element are synchronized.

7. A method for defining control specifications according to any one of claims 1 to 3, comprising the steps of: The operation of the first vehicle includes at least one of a position and an operation of the first vehicle and a recognition of an object from the first vehicle; A control specification definition method, wherein the operation of the second vehicle includes at least one of the position and operation of the second vehicle and recognition of objects from the second vehicle.

8. an environment acquisition unit that acquires an environment in which the first vehicle is located; a control unit that controls autonomous driving of the first vehicle based on a control specification defined based on a two-dimensional diagram in which a first model element representing a position and a motion of the first vehicle and a second model element representing a position and a motion of the second vehicle are arranged, and based on the environment acquired by the environment acquisition unit; A vehicle control device, wherein the two-dimensional map includes the positional relationship between the first vehicle and the second vehicle both at a starting point and at a point after a certain time has elapsed.

9. A control specification definition device that defines a control specification used for controlling an autonomous driving of a first vehicle, an operation acquisition unit that acquires an operation for arranging a first model element representing a position and a motion of the first vehicle and a second model element representing a position and a motion of a second vehicle on a two-dimensional diagram; a definition unit that defines the control specification based on the two-dimensional diagram in which the first model element and the second model element are arranged, A control specification definition device, wherein the two-dimensional diagram includes the positional relationship between the first vehicle and the second vehicle both at a start point and at a point after a certain time has elapsed.

10. The control specification definition device according to claim 9, a safety analysis unit that acquires a safety analysis result based on the two-dimensional diagram in which the first model element and the second model element are arranged; The definition unit is a control specification definition device that defines the control specification based on the safety analysis result.

Images