Map update system, in-vehicle device, and server

Abstract

A map update system for determining whether it is necessary to update map information stored in a storage unit (30) installed in a vehicle for use by a vehicle control unit (50) that controls the behavior of the vehicle, the map update system comprising a failure determination unit (61) that determines whether there is a failure in vehicle control executed by the vehicle control unit (50), and an update determination unit that determines that the map information needs to be updated on the basis of a determination that the cause of the failure is in the map information. The system makes it possible to determine that the map information does not need to be updated even if the map information is not up-to-date as long as there is no failure in the vehicle control executed by the vehicle control unit. Therefore, unnecessary update of the map information can be prevented.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application is based on Patent Application No. 2021-144044 filed in Japan on September 3, 2021, and the contents of the original application are incorporated by reference in their entirety. [Technical field]

[0002] The present invention relates to a map updating system, and an in-vehicle device and a server that are included in the map updating system. [Background technology]

[0003] The device described in Patent Document 1 compares the position and shape of features detected by an external sensor mounted on the vehicle with feature information stored in a storage unit as map data. If it determines that there has been a change in the features detected by the external sensor, it transmits difference information to a server. The server updates the advanced map database based on the difference information. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] International Publication No. 2017 / 212639 Summary of the Invention

[0005] In Patent Document 1, the advanced map database is updated when feature information included in the advanced map database differs from the map position, shape, etc. detected by a sensor mounted on a vehicle that actually traveled through the area. However, even if the map information does not correctly represent actual roads, features, etc., it is not always necessary to update the map information. When the map information is used to control the behavior of a vehicle, it is not always necessary to update the map information if there is no effect on vehicle control. If the map information is constantly updated even though it is not required, there is a risk that the effort of updating the map information will increase.

[0006] The present disclosure has been made based on this situation, and an object of the present disclosure is to provide a map update system, an in-vehicle device, and a server that are capable of suppressing updates of non-essential map information.

[0007] The above object is achieved by the combination of features recited in the independent claims, and the subclaims define further advantageous specific examples. The reference characters in parentheses in the claims correspond to specific aspects described in the following embodiment as one aspect, and are not intended to limit the disclosed technical scope.

[0008] One disclosure of a map update system for achieving the above object is: A map update system for determining whether or not map information stored in a storage unit mounted on a vehicle and used by a vehicle control unit that controls a behavior of the vehicle needs to be updated, comprising: A defect determination unit that determines whether or not there is a defect in the vehicle control executed by the vehicle control unit. a plurality of on-board devices mounted on a plurality of vehicles, and, an update determining unit that determines that the map information needs to be updated based on the determination that the cause of the defect is in the map information; A server that communicates with the in-vehicle device. and 、 Equipped with The malfunction determination unit transmits malfunction determination result information, which is information indicating whether or not there is a malfunction in vehicle control, from the vehicle-side communication unit to the server; The server an inspection necessity determination unit that determines whether or not to inspect the cause of the malfunction based on the malfunction judgment result information received from the vehicle; an inspection instruction unit that transmits an inspection instruction to one or more in-vehicle devices when the inspection necessity determination unit determines that the cause of the malfunction should be inspected, and The vehicle-mounted device is an inspection unit that, when receiving an inspection instruction, inspects whether the map information stored in the storage unit is correct by comparing the map information stored in the storage unit with recognized map information created from information detected by a surrounding detection sensor mounted on the vehicle, and transmits the inspection result from the vehicle-side communication unit to a server; The update determination unit determines whether or not the map information needs to be updated based on the inspection result transmitted from the vehicle. A map update system.

[0009] This map update system determines that the map information needs to be updated based on the determination that the cause of the malfunction in the vehicle control executed by the vehicle control unit is in the map information. Therefore, if there is no malfunction in the vehicle control executed by the vehicle control unit, it is possible to determine that there is no need to update the map information even if the map information is not the latest. Therefore, it is possible to suppress updates of map information that are not essential.

[0012] The vehicle-mounted device and server that achieve the above object are the vehicle-mounted device and server provided in this map update system.

[0013] That is, the vehicle-mounted device includes a defect determination unit that determines whether or not there is a defect in the vehicle control executed by the vehicle control unit that controls the behavior of the vehicle using map information stored in a storage unit mounted in the vehicle, and transmits defect determination result information indicating the determination result from the vehicle-side communication unit to the server; This is an on-board device equipped with an inspection unit that, when receiving an inspection instruction from the server, inspects whether the map information stored in the memory unit is correct by comparing the map information stored in the memory unit with recognized map information created from information detected by a surrounding detection sensor mounted on the vehicle, and transmits the inspection results from the vehicle-side communication unit to the server.

[0014] The server also includes an inspection necessity determination unit that receives, from the vehicle, malfunction determination result information, which is information that determines whether or not there is a malfunction in vehicle control by a vehicle control unit that controls the behavior of the vehicle using map information stored in a storage unit mounted in the vehicle, and determines whether or not to inspect the cause of the malfunction based on the malfunction determination result information; an inspection instruction unit that transmits an inspection instruction to one or more in-vehicle devices when the inspection necessity determination unit determines that the cause of the malfunction should be inspected; The server is provided with an update judgment unit that, when acquiring malfunction judgment result information from a plurality of vehicles, performs statistical processing on the plurality of malfunction judgment result information to judge whether or not the cause of the malfunction is in the map information, and decides to update the map information based on the judgment that the cause of the malfunction is in the map information. [Brief description of the drawings]

[0015] [Figure 1] 1 is a diagram showing the overall configuration of a map updating system 1 according to an embodiment. [Diagram 2] FIG. 1 shows a configuration of an in-vehicle system 10. [Diagram 3] FIG. 4 is a diagram showing a process executed by a defect determination unit 61. [Figure 4] FIG. 4 is a diagram showing a process executed by a defect determination unit 61. [Diagram 5] FIG. 2 shows the configuration of a server 80. [Figure 6] 13 is a flowchart for suspending the use of map information and applications. [Figure 7] 13 is a flowchart for suspending the use of map information and applications. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a diagram showing the overall configuration of a map updating system 1 of this embodiment. The map updating system 1 includes an in-vehicle system 10 mounted on a vehicle 2, and a server 80 installed at an arbitrary position outside the vehicle 2. The in-vehicle system 10 and the server 80 can communicate with each other via a communication line network 3.

[0017] [Configuration of in-vehicle system 10] 2 shows the configuration of the in-vehicle system 10. The in-vehicle system 10 includes an in-vehicle sensor 20, a storage unit 30, a vehicle-side communication unit 40, a vehicle control unit 50, and an in-vehicle device 60. These are connected to an in-vehicle LAN 11 and communicate with each other via the in-vehicle LAN 11.

[0018] The on-vehicle sensor 20 is a sensor mounted on the vehicle 2 to detect various pieces of information used for vehicle control. The on-vehicle sensor 20 includes a surroundings detection sensor 21, a GNSS receiver 24, an inertial sensor 25, and a driver operation detection sensor 26. In addition to these, the on-vehicle sensor 20 may include other sensors, such as a sensor that detects the state of the driver.

[0019] The periphery detection sensor 21 is a sensor that detects various objects present around the vehicle 2. The objects include planar objects such as lane lines. FIG. 2 shows a camera 22 and a Lidar 23 as the periphery detection sensor 21. The camera 22 captures an image in front of the vehicle 2. The camera 22 may also capture images of the sides and rear of the vehicle 2. The Lidar 23 detects the positions of objects present around the vehicle 2 by projecting and receiving light. In addition to or instead of these, the periphery detection sensor 21 may include other sensors that detect objects present around the vehicle 2, such as a millimeter wave radar. The periphery detection sensor 21 may be configured to detect objects around the vehicle by using one or a combination of a camera, a Lidar, a millimeter wave radar, and the like.

[0020] The GNSS receiver 24 receives navigation signals transmitted by navigation satellites included in a global navigation satellite system (GNSS), which is a satellite navigation system, and sequentially calculates the current position based on the received navigation signals. The inertial sensor 25 is a sensor that detects inertia occurring in the vehicle 2, and includes one or both of an acceleration sensor and an angular velocity sensor. The GNSS receiver 24 and the inertial sensor 25 are sensors for sequentially detecting the current position of the vehicle 2. Since a change in the current position indicates the behavior of the vehicle 2, the GNSS receiver 24 and the inertial sensor 25 are sensors that detect information indicating the behavior of the vehicle 2.

[0021] The driver operation detection sensor 26 is a sensor that detects an input operation performed by the driver to change or maintain the behavior of the vehicle 2. The driver operation detection sensor 26 is an accelerator sensor, a brake sensor, a steering sensor, a shift position sensor, or the like.

[0022] The storage unit 30 is writable and stores various information. A flash memory can be used for the storage unit 30. A map database (hereinafter, map DB) is stored in the storage unit 30. The map DB includes map information called a high-precision map. The high-precision map is a three-dimensional map, and includes information about features that exist around the road. The features include traffic lights and road signs. The high-precision map has more detailed information not only about three-dimensional information, but also about two-dimensional information such as the positions of lane lines, than a low-precision map used for route searching.

[0023] The vehicle-side communication unit 40 is a communication unit that performs wireless communication, and communicates with the server 80 via the communication network 3 .

[0024] The vehicle control unit 50 acquires at least one of information indicating the behavior of the vehicle 2 and information indicating objects present around the vehicle 2 from the on-board sensor 20. The vehicle control unit 50 also acquires information from a map DB stored in the storage unit 30. The vehicle control unit 50 uses the acquired information to execute one or more types of vehicle control for controlling the behavior of the vehicle 2. The vehicle control unit 50 can be realized by a configuration including at least one processor.

[0025] An example of vehicle control is traffic light stop control. Traffic light stop control is control to stop at a stop line when the light of a target traffic light is red and the vehicle is not traveling in a driving lane in the direction indicated by an arrow light. When multiple target traffic lights are detected by the periphery detection sensor 21, which one is the target traffic light is determined from the position and orientation of the traffic light relative to the vehicle 2. The map DB contains information for identifying traffic lights (hereinafter, traffic light information), such as the coordinates, shape, and size of the traffic light. In traffic light stop control, the traffic light information stored in the map DB is used to identify the target traffic light from the traffic lights detected by the periphery detection sensor 21. Then, the lights that are turned on at the identified target traffic light are determined.

[0026] Another example of vehicle control is lane keeping control. Lane keeping control is a control in which the vehicle 2 automatically travels in the same lane while successively detecting the positions of the lane markings and the vehicle 2 in the vehicle width direction. Lane keeping control may be performed on the condition that the deviation between the position and shape of the lane markings recognized by the periphery detection sensor 21 and the position and shape of the lane markings included in the map DB is within an acceptable range. This is to control the vehicle by confirming that the lane markings recognized by the periphery detection sensor 21 are correct.

[0027] It is also possible to compare a target trajectory determined from the lane markings recognized by the periphery detection sensor 21 with a target trajectory determined from the lane markings included in the map DB. When lane markings on both the left and right sides of the vehicle 2 can be recognized, the target trajectory can be the trajectory indicating the middle between the lane markings on both the left and right sides, that is, the center in the lane width direction. This is because comparing target trajectories allows a judgment of similarity to be made as by comparing lane markings.

[0028] Furthermore, lane keeping control may be performed under the condition that the target trajectory determined from the marking lines recognized by the periphery detection sensor 21 does not intersect with the marking lines included in the map DB. This is to prevent the vehicle 2 from crossing the marking lines while lane keeping control is being performed, while allowing the position and shape of the marking lines recognized by the periphery detection sensor 21 to deviate slightly from the position and shape of the marking lines included in the map DB.

[0029] Another example of vehicle control is lane change control. Lane change control is a control to change the lane in which the vehicle 2 is traveling by controlling the vehicle 2 to cross a lane line in a road section where the lane line is a type of lane changeable lane line. The lane change control compares the position and shape of the lane line recognized by the periphery detection sensor 21 with the position and shape of the lane line contained in the map DB. In addition, the lane change control checks whether the line type recognized from the signal detected by the periphery detection sensor 21 is the line type of the lane line contained in the map DB. This is because the recognized lane line may be blurred and recognized as a broken line, but may be a solid line in the map DB, or a yellow line may be erroneously recognized as a white line due to a color misrecognition. In addition, in some cases, the map DB may be incorrect, and the yellow line may be changed to a white line.

[0030] The vehicle control executed by the vehicle control unit 50 is not limited to the specific control described above, and may be other control, for example, constant speed driving control, inter-vehicle distance control, automatic parking control, etc. The vehicle control unit 50 executes one or more types of vehicle control.

[0031] The vehicle-mounted device 60 can be realized by a configuration including at least one processor. For example, the vehicle-mounted device 60 can be realized by a computer including a processor, a non-volatile memory, a RAM, an I / O, and a bus line connecting these components. The non-volatile memory stores a program for operating a general-purpose computer as the vehicle-mounted device 60. The processor executes the program stored in the non-volatile memory while utilizing the temporary storage function of the RAM, so that the vehicle-mounted device 60 operates as a malfunction determination unit 61, an inspection unit 62, and a map update unit 63. The execution of these operations means that a method corresponding to the program is executed.

[0032] The malfunction determination unit 61 determines whether or not there is a malfunction in the vehicle control executed by the vehicle control unit 50 for each type of vehicle control. Five specific conditions for determining a malfunction will be described. The malfunction determination unit 61 may use only one of the five conditions described below, or may use a combination of two or more of the conditions.

[0033] The first condition is that the driver of the vehicle 2 performs a vehicle operation that changes the vehicle control by the vehicle control unit 50. The first condition will be specifically described. In the case of traffic light stop control, if the driver brakes the vehicle 2 before the position where the vehicle 2 is scheduled to be stopped by the traffic light stop control, it can be determined that there is a defect in the traffic light stop control. Conversely, it can be determined that there is a defect in the traffic light stop control if the driver operates the accelerator while the vehicle control unit 50 is decelerating the vehicle 2 in order to stop the vehicle 2 by the traffic light stop control. In the case of lane keeping control, it can be determined that there is a defect in the lane keeping control if the position in the vehicle width direction is changed by the driver's steering operation by a predetermined distance or more. The predetermined distance may be a distance for changing lanes, or may be a distance for adjusting the position within one lane. In the case of lane change control, it can be determined that there is a defect in the lane change control if the driver returns the lateral position of the vehicle 2 by steering operation while changing lanes by the lane change control so as not to change lanes.

[0034] In the case of constant speed cruise control, if the driver changes the shift position, it may be determined that there is a malfunction in the constant speed cruise control. Also, if the driver operates an operation unit to forcibly terminate the vehicle control while these vehicle controls are being executed, it may be determined that there is a malfunction in the vehicle control terminated by the driver. The correspondence between a specific vehicle control and a driver operation that determines that there is a malfunction in the vehicle control is set in advance.

[0035] The second condition for determining whether a malfunction exists is when the map-based control information and the sensor-based control information differ. Map-based control information is information used for vehicle control, and is control information determined using information contained in the map DB. In the case of traffic light stop control, traffic light information such as the position of the traffic light is used for control. Traffic light information contained in the map DB is an example of map-based control information.

[0036] The traffic light information will be described in detail. The traffic light information can include one or more of the coordinates, shape, size, direction, light arrangement, number of lights, light color, light shape, and light illumination pattern of the traffic light. When this traffic light information is used as map-based control information, the corresponding information is acquired using the periphery detection sensor 21. The acquired information is sensor-based control information.

[0037] In determining whether the map-based control information and the sensor-based control information differ, if the difference can be considered an error, the map-based control information and the sensor-based control information are not determined to differ. Whether the map-based control information and the sensor-based control information differ is determined, for example, by whether the difference between the map-based control information and the sensor-based control information exceeds a preset threshold value.

[0038] Map-based control information may be generated by processing information contained in the map DB. For example, in lane keeping control, a target trajectory determined from lane markings contained in the map DB is an example of map-based control information generated by processing information contained in the map DB. Sensor-based control information is information used for vehicle control, and is control information determined using information detected by the perimeter detection sensor 21. For example, the position and shape of lane markings recognized using the perimeter detection sensor 21 is sensor-based control information.

[0039] The third condition for determining a malfunction is a condition that information output by one or more on-board sensors 20 used by the vehicle control unit 50 for vehicle control is erroneous. Cases in which the information output by the on-board sensor 20 is erroneous include a case in which the on-board sensor 20 is broken, and a case in which the on-board sensor 20 is not broken but cannot output a correct signal for some reason. An example of the latter is a case in which the GNSS receiver 24 cannot receive navigation signals from a required number of navigation satellites due to the surrounding environment. Another example of the latter is a case in which a sensor for detecting the driver's state cannot detect the driver's state (for example, the driver's face) due to the driver's posture, etc. In addition, when the state of the driver detected by the sensor for detecting the driver's state is a state in which vehicle control cannot be continued, such as when the driver is not gripping the steering wheel, the information output by the sensor for detecting the driver's state may be erroneous.

[0040] The fourth condition for determining whether a malfunction has occurred is that a warning has been issued in the vehicle 2. Warnings issued in the vehicle 2 include a rear-end collision warning, a collision warning, a vehicle distance warning, etc. This warning is issued when there is a sudden change in the behavior of the vehicle, such as when a sudden turn is made, a sudden start is made, a sudden acceleration is made, or a sudden stop is made.

[0041] The fifth condition for determining a defect is that a market complaint has occurred. Unlike the other conditions, this fifth condition includes a condition in which information is obtained manually. The fifth condition is made available for the defect determination unit 61 to determine when information regarding the market complaint is input to the server 80 or the like through a person. There are, for example, a regular route and an unregular route for obtaining the market complaint. The regular route is a transmission route from the end user to the vehicle manufacturer or dealer, a route of internal information from an organization including the vehicle manufacturer, and an information route from a government agency. The unregular route is a route in which information obtained from a user community, a social networking service, and the like is input to the server 80 by a person. In a social networking service, registered users can access and provide information. This unregular route makes it possible to widely pick up information using a social networking service that has not yet been made public.

[0042] 3 and 4 are flowcharts showing the processing executed by the malfunction determination unit 61. The malfunction determination unit 61 executes the processing shown in Fig. 3 at a predetermined cycle when vehicle control for determining a malfunction is being executed. In S1, it is determined whether or not there is a malfunction in the vehicle control being executed. One or more conditions for determining that there is a malfunction in the vehicle control are set for each type of vehicle control.

[0043] If it is determined that there is no malfunction, the determination result in S1 is NO. If the determination result in S1 is NO, the process in Fig. 3 is terminated. If the process in Fig. 3 is terminated and vehicle control is continuing, the process in Fig. 3 is restarted after a predetermined period.

[0044] If the judgment result of S1 is YES, proceed to S2. In S2, malfunction judgment result information is created and stored in a predetermined storage unit. The malfunction judgment result information includes the judgment result of S1. The malfunction judgment result information also includes information that identifies the content of the vehicle control that has been judged to be malfunctioning. The information that identifies the content of the vehicle control is, for example, the name of a specific vehicle control, such as traffic light stop control or lane keeping control. The malfunction judgment result information includes position identification information that identifies the position of the vehicle 2 when the malfunction occurred. An example of the position identification information is coordinates. Another example of the position identification information is the road link or lane link on which the vehicle 2 is traveling when the malfunction occurred. If the vehicle 2 is located at an intersection when the malfunction occurred, the position identification information may be the name of the intersection.

[0045] The malfunction determination result information may also include one or more of the time and date when the malfunction occurred, information indicating the conditions under which it was determined that a malfunction occurred, weather, and version information of the map DB.

[0046] The failure determination unit 61 performs the process shown in Fig. 4 at an upload timing that is set arbitrarily. The upload timing is, for example, each time vehicle control ends. The upload timing may also be when the vehicle 2 is started, that is, when the ignition switch is turned on. The upload timing may also be each time Fig. 3 ends.

[0047] In Fig. 4, in S11, it is determined whether or not defect determination result information is stored. If the determination result in S11 is NO, the process in Fig. 4 is terminated. If the determination result in S11 is YES, the process proceeds to S12.

[0048] In S12, the stored malfunction determination result information is uploaded from the vehicle-side communication unit 40 to the server 80. After uploading, the uploaded malfunction determination result information is deleted from the storage unit.

[0049] Returning to Fig. 2 for explanation, when the vehicle-side communication unit 40 receives an inspection instruction from the server 80, the inspection unit 62 performs an inspection in accordance with the inspection instruction. The inspection target includes the map DB. That is, the inspection unit 62 inspects whether the map DB stored in the storage unit 30 is correct. The inspection target may also include vehicle control executed by the vehicle control unit 50.

[0050] Specifically, the map DB inspection involves comparing the map DB stored in the memory unit 30 with recognized map information created from information detected by the surroundings detection sensor 21 mounted on the vehicle 2.

[0051] The inspection instruction specifies an area in the map DB where the map information should be inspected to see if it is correct. The specified area may be a relatively large area such as a section of a road, or a relatively small area such as an intersection. When the inspection unit 62 receives the inspection instruction from the vehicle-side communication unit 40 and travels through the area specified in the inspection instruction, the inspection unit 62 creates recognized map information from information detected by the periphery detection sensor 21 in the area specified in the inspection instruction.

[0052] The recognized map information is, for example, the position and shape of the lane markings. However, it is possible to arbitrarily set which map information corresponds to which recognized map information. It is preferable that the inspection unit 62 creates as much recognized map information as possible within the range that can be created from the information detected by the periphery detection sensor 21. This is because it is possible to judge whether the map DB is correct for a larger number of map information.

[0053] When the inspection instruction includes information for identifying a vehicle control, the inspection unit 62 executes the vehicle control identified by the inspection instruction in the section identified by the inspection instruction. Then, the inspection unit 62 judges whether or not there is a malfunction in the executed vehicle control. The process for judging whether or not there is a malfunction in the vehicle control may be the same as the process executed by the malfunction judgment unit 61.

[0054] If the inspection instruction includes map data for inspection, the portion of the map DB corresponding to the map data for inspection is updated with the map data for inspection. Then, it is inspected whether there is a malfunction in the vehicle control. In this case, if the vehicle control malfunction does not occur as a result of updating the map DB, it can be assumed that the cause of the malfunction is in the map information. In addition, if the vehicle control malfunction occurs even after updating the map DB, it can be assumed that the cause of the malfunction is something other than the map information.

[0055] The inspection instruction may also include other inspection conditions such as weather, time of day, etc. The inspection unit 62 inspects the vehicle control or the map DB when the conditions indicated in the inspection instruction are satisfied.

[0056] The inspection unit 62 transmits the inspection result from the vehicle-side communication unit 40 to the server 80. An example of the inspection result is information indicating a difference between the recognized map information and information included in the map DB stored in the storage unit 30 and corresponding to the recognized map information. If the recognized map information is a lane line, the inspection result is the distance between the link end points of the lane line in the recognized map information and the lane line included in the map DB that are the same link. The inspection result may also be information before the information indicating the difference is calculated. That is, the inspection result may be the recognized map information and information corresponding to the recognized map information in the map DB stored in the storage unit 30. If the server 80 can manage the map DB stored in the storage unit 30 using version information or the like, the inspection result may be the version of the recognized map information and the map DB.

[0057] When the vehicle-side communication unit 40 receives update map data, the map update unit 63 uses the update map data to update the map DB stored in the storage unit 30. The update map data is distributed from the server 80.

[0058] [Server 80 configuration] 5 shows the configuration of the server 80. The server 80 includes a server-side communication unit 81, a storage unit 82, and a server-side control unit 83. The server-side communication unit 81 is a communication unit that communicates with the vehicle-side communication unit 40 via the communication network 3. The server-side communication unit 81 may be connected to the communication network 3 in a wired or wireless manner.

[0059] A delivery map DB is stored in the storage unit 82. The delivery map DB is a database that stores maps to be delivered to the vehicle 2 in order to update a part or the whole of the map DB stored in the storage unit 30 of the vehicle 2.

[0060] The server-side control unit 83 can be realized by a configuration including at least one processor. For example, the server-side control unit 83 can be realized by a computer including a processor, a non-volatile memory, a RAM, an I / O, and a bus line connecting these components. The non-volatile memory stores a program for operating a general-purpose computer as the server-side control unit 83. The processor executes the program stored in the non-volatile memory while utilizing the temporary storage function of the RAM, so that the server-side control unit 83 operates as an inspection necessity determination unit 84, an inspection instruction unit 85, and an update determination unit 86. The execution of these operations means that a method corresponding to the program is executed.

[0061] The inspection necessity determination unit 84 determines whether or not to inspect the cause of the malfunction based on the malfunction determination result information received from the vehicle 2. Whether or not to inspect the cause of the malfunction is determined for each area. The area can be determined for each type of vehicle control. For example, if the vehicle control is traffic light stop control, the area can be the periphery of the intersection set to include the traffic lights present at the intersection and a certain distance before that intersection. If the vehicle control is lane keeping control or lane change control, the area is determined to include the road link or lane link where a malfunction has occurred in the lane keeping control or lane change control.

[0062] The inspection necessity determination unit 84 can perform statistical processing of the malfunction judgment result information transmitted from a plurality of vehicles 2 and determine whether or not to inspect the cause of the malfunction. For example, when a certain number or more of malfunction judgment information indicating that there is a malfunction in the vehicle control for the same type of vehicle control is received within a preset certain period of time, it determines that the cause of the malfunction should be inspected. The above-mentioned certain period of time may be changed according to the road type, such as whether the road is an expressway or an ordinary road. The road type may be determined based on the position identification information included in the malfunction judgment result information and the delivery map DB stored in the storage unit 82. The certain period of time may also be determined according to the traffic volume.

[0063] Furthermore, the condition under which the malfunction was determined to be a malfunction, as indicated by the malfunction determination result information, may be taken into consideration. For example, when determining whether the cause of the malfunction is the map DB, malfunction determination result information in which the condition for determining that the malfunction is a malfunction is that the information output by the vehicle-mounted sensor 20 is an error may not be counted as malfunction determination result information.

[0064] The inspection necessity determination unit 84 does not necessarily need to perform statistical processing of malfunction judgment result information transmitted from a plurality of vehicles 2. It may determine whether or not to inspect the cause of the malfunction based on the malfunction judgment result information received for the first time at regular intervals. In this case, if malfunction judgment result information is received within a regular interval, it can be determined that the cause of the malfunction is to be inspected. This determination can be made for each content of vehicle control.

[0065] Also, it may be determined that the cause of the malfunction is to be inspected if malfunction determination result information is received within a certain period of time and the malfunction determination result information indicates that the condition established when the malfunction is determined to be a malfunction is not a condition that the information output by the in-vehicle sensor 20 is an error. In other words, it may be determined that the cause of the malfunction is to be inspected if the condition established when the malfunction is determined to be a malfunction is the first condition or the second condition described above. This is because, when comparing the first, second and third conditions described above, when the first and second conditions are established, there is a higher possibility that the map DB is defective than when the third condition is established.

[0066] When the inspection necessity determination unit 84 determines that the cause of the malfunction should be inspected, the inspection instruction unit 85 transmits an inspection instruction to one or more in-vehicle systems 10 to instruct the inspection to inspect the cause of the malfunction. One of the purposes of the inspection is to determine whether the cause of the malfunction lies in the map DB. Therefore, the inspection instruction includes information indicating the area of ​​the map to be inspected. The indicated area is the area that the inspection necessity determination unit 84 determines should be inspected, or a larger area set to include that area. The information indicating the area may be one or more coordinates that identify the area, such as the center of the area.

[0067] The inspection instruction unit 85 may transmit the inspection instruction to all of the in-vehicle systems 10 with which it can communicate. Alternatively, the inspection instruction may be transmitted to the in-vehicle systems 10 that exist around the area instructed to be inspected by the inspection instruction.

[0068] The inspection instruction may include information for identifying the vehicle control to be inspected. When identifying the vehicle control to be inspected, the conditions for executing the vehicle control, such as the time of day, weather, etc. The inspection instruction may also include map data for the area identified in the inspection instruction, extracted from the delivery map DB, for inspection.

[0069] When the in-vehicle system 10 receives the inspection instruction and the inspection unit 62 performs an inspection in accordance with the inspection instruction, it transmits the inspection result to the server 80. The update determination unit 86 of the server 80 determines whether it is necessary to update the map DB based on the inspection result. More precisely, the update determination unit 86 determines whether it is necessary to update the map information in the map DB that has been instructed to be inspected. Updating the map information in the map DB that has been instructed to be inspected also constitutes updating the map DB. Hereinafter, "updating the map DB" may mean updating the map information in the map DB that has been instructed to be inspected. When it can be determined from the inspection result that the map DB is incorrect, the update determination unit 86 determines that it is necessary to update the map DB.

[0070] For example, the update determination unit 86 performs statistical processing on the inspection results received from a plurality of vehicles 2 to determine whether the map DB needs to be updated. As one example, when the update determination unit 86 acquires a preset number of inspection results, if the ratio of the acquired inspection results indicating that the map DB is correct is equal to or greater than a threshold, the update determination unit 86 determines that the map DB is correct and therefore does not need to be updated. In this case, it can be estimated that the cause of the malfunction in vehicle control is a cause other than the map DB.

[0071] If the ratio of the inspection results indicating that the map DB is correct is smaller than the threshold, the update determination unit 86 determines that the map DB needs to be updated. If it is determined that the map DB needs to be updated, it is assumed that the cause of the malfunction in the vehicle control is the map DB.

[0072] When the update determination unit 86 determines that the map DB needs to be updated, it creates update map data from the delivery map DB stored in the storage unit 82. Then, it transmits the created update map data to the in-vehicle system 10 that transmitted the determination result that there is a problem with vehicle control. When the vehicle-side communication unit 40 receives this update map data, the map update unit 63 updates the map DB. Note that the update map data may be transmitted by broadcasting without specifying the recipient. When transmitting the update map data by broadcasting, the receiving side determines whether or not to update the update map data based on the version of the update map data, etc.

[0073] Fig. 6 shows a flowchart relating to the suspension of use of map information and the suspension of use of an application. The inspection necessity determination unit 84 executes the process shown in S100 of Fig. 6 at a predetermined cycle when malfunction determination result information is acquired. In S100, as described above, it is determined whether or not to inspect the cause of the malfunction based on the malfunction determination result information. If it is determined not to inspect the malfunction, the determination result of S100 is NO. If the determination result of S100 is NO, the process of S100 is executed repeatedly.

[0074] If the determination result of S100 is YES, the process proceeds to S110. In S110, the update determination unit 86 determines whether the cause of the malfunction is in the map information based on the inspection result transmitted from the vehicle 2 or by statistically processing the inspection results transmitted from a plurality of vehicles 2. If it is determined that the cause of the malfunction is in the map information, the determination result of S110 becomes YES. If the determination result of S110 is YES, the process proceeds to S120. In S120, the map update system 1 executes a process to stop the use of the map information. The in-vehicle system 10 may notify the user of the vehicle 2 by display or audio that the process of S120 has been executed. After the process of S120 is executed, the process of FIG. 6 is terminated. If the process of FIG. 6 is terminated and vehicle control is still ongoing, the process of FIG. 6 is started again after a predetermined period.

[0075] If it is determined that the cause of the malfunction is not in the map information, the determination result of S110 becomes NO. If the determination result of S110 is NO, the process proceeds to S130. In S130, the in-vehicle device 60 or the malfunction determination unit 61 determines whether or not there is a malfunction in the application of the vehicle 2. In S130, it is determined that there is a malfunction when the functional unit of the application is not operating normally, when there is a malfunction in the display of the driving state or the driving assistance, or when there is another malfunction. The application is software related to the control of the automatic driving or the driving assistance of the vehicle 2 executed by the vehicle control unit 50. The application is software that is installed in the vehicle 2, can be operated or visually recognized by the user in the vehicle 2, and can be used. The control of the automatic driving or the driving assistance includes, for example, constant speed driving control, inter-vehicle distance control, automatic parking control, lane change control, and intersection driving control. The application is an application that is used in the vehicle and is related to the automatic driving or the driving assistance of the vehicle 2. The application displays or provides voice guidance for route guidance, or for signs and features related to the automatic driving or the driving assistance.

[0076] If it is determined that there is no malfunction in the application, the determination result in S130 is NO. If the determination result in S130 is NO, the process returns to S100. If it is determined that there is a malfunction in the application, the determination result in S130 is YES. If the determination result in S130 is YES, the process proceeds to S140. In S140, the vehicle-mounted device 60 executes a process to stop the use of the application. The vehicle-mounted device 60 may notify the user of the vehicle 2 by display or audio that the process of S140 has been executed. After the process of S140 is executed, the process of FIG. 6 is terminated. If the process of FIG. 6 has been terminated and vehicle control is still ongoing, the process of FIG. 6 is restarted after a predetermined period.

[0077] FIG. 7 shows a flowchart regarding the suspension of use of map information and suspension of use of an application. The process shown in FIG. 7 differs from FIG. 6 in that S125 is executed. As shown in FIG. 7, if the determination result of S110 is YES, the process of S125 may be executed together with the process of S120. In S125, the vehicle-mounted device 60 executes a process to stop use of the application. The vehicle-mounted device 60 may notify the user of the vehicle 2 by display or voice that the process of S125 has been executed. After the process of S125 is executed, the process of FIG. 6 is terminated. This process makes it possible to stop use of an application related to automatic driving or driving assistance when the update determination unit determines that the map information is the cause of the malfunction.

[0078] Summary of the embodiment In the map updating system 1 of the present embodiment described above, the update determination unit 86 determines whether or not it is necessary to update the map DB based on the inspection result transmitted from the in-vehicle system 10. The inspection result is a result obtained in response to an inspection instruction, and the inspection instruction is issued when there is a problem with the vehicle control. Therefore, determining that it is necessary to update the map DB based on the inspection result means that it has been determined that the map information needs to be updated based on the determination that the cause of the problem with the vehicle control lies in the map information.

[0079] Therefore, if there is no problem with the vehicle control executed by the vehicle control unit 50, even if the map DB is not the latest, it is possible to determine that there is no need to update the map DB. Therefore, it is possible to suppress updates to the map DB that are not essential.

[0080] Furthermore, the malfunction determination unit 61 determines that there is a malfunction in the vehicle control executed by the vehicle control unit 50 based on the fact that the driver of the vehicle 2 has performed a vehicle operation that changes the vehicle control by the vehicle control unit 50. When there is a malfunction in the vehicle control, the driver often performs a vehicle operation that changes the vehicle control, so the malfunction determination unit 61 can reduce cases in which it cannot determine that there is a malfunction even though there is a malfunction in the vehicle control.

[0081] The malfunction determination unit 61 determines that there is a malfunction in the vehicle control executed by the vehicle control unit 50 based on the difference between the map-based control information and the sensor-based control information. By determining whether there is a malfunction in the vehicle control in this manner, it is possible to reduce cases where it cannot be determined that there is a malfunction in the vehicle control even though there is a malfunction caused by the map information.

[0082] The malfunction determination unit 61 determines that there is a malfunction in the vehicle control based on the fact that the information output by the in-vehicle sensor 20 is an error. By determining whether there is a malfunction in the vehicle control in this manner, it is possible to prevent a malfunction that may account for a certain proportion of the cause of the malfunction in the vehicle control from being unable to be determined to be a malfunction.

[0083] The map updating system 1 includes an in-vehicle device 60 and a server 80, the in-vehicle device 60 includes a defect determination unit 61, and the server 80 includes an inspection necessity determination unit 84, an inspection instruction unit 85, and an update determination unit 86. The update determination unit 86 can determine whether or not it is necessary to update the map DB by acquiring defect determination result information from a plurality of in-vehicle devices 60. The inspection necessity determination unit 84 determines whether or not to inspect the cause of the defect based on the defect determination result information. If the inspection necessity determination unit 84 determines not to inspect the defect, the inspection instruction unit 85 does not transmit an inspection instruction to the in-vehicle device 60. This configuration can prevent the cause of the defect from being inspected even when it is not necessary to inspect the cause of the defect.

[0084] The malfunction determination result information includes information for identifying the details of vehicle control, which enables the inspection necessity determination unit 84 to identify the details of vehicle control and determine whether or not it is necessary to inspect the cause of the malfunction.

[0085] The malfunction determination result information includes location identification information that identifies the location of the vehicle 2 when the malfunction occurred. This enables the inspection necessity determination unit 84 to identify an area to inspect for the malfunction and determine whether or not it is necessary to inspect the cause of the malfunction.

[0086] When the inspection necessity determination unit 84 acquires malfunction judgment result information from a plurality of vehicles 2, it performs statistical processing on the plurality of malfunction judgment result information to determine whether or not to inspect the cause of the malfunction. Therefore, the accuracy of determining whether or not to inspect the cause of the malfunction is improved.

[0087] The update determination unit 86 determines whether or not the cause of the malfunction is in the map information by statistically processing the inspection results transmitted from a plurality of vehicles 2. This improves the accuracy of determining whether or not the cause of the malfunction is in the map information.

[0088] The map update system 1 stops the use of the map information when the update determination unit 86 determines that the cause of the malfunction is in the map information. This makes it possible to avoid behavior control of the vehicle 2 that uses the map information in which the malfunction has occurred.

[0089] When the update determination unit 86 determines that the cause of the malfunction is in the map information, the map update system 1 stops applications related to the automatic driving or driving assistance of the vehicle 2. This makes it possible to avoid the use of applications that use the map information in which the malfunction has occurred.

[0090] The map update system 1 stops the application when the update determination unit 86 determines that the cause of the malfunction is not in the map information but that there is a malfunction in an application related to automatic driving or driving assistance of the vehicle 2. This makes it possible to avoid using the application that is causing the malfunction, regardless of whether there is a malfunction in the map information.

[0091] Although the embodiments have been described above, the disclosed technology is not limited to the above-described embodiments, and the following modifications are also included in the scope of the disclosure. Furthermore, various modifications other than those described below can be implemented without departing from the gist of the invention. In the following description, elements having the same reference numbers as those used up to that point are the same as the elements having the same reference numbers in the previous embodiments, unless otherwise specified. In addition, when only a portion of the configuration is described, the previously described embodiment can be applied to the other portions of the configuration.

[0092] <Variation 1> In the embodiment, the malfunction judgment unit 61 creates the malfunction judgment result information only when it judges that there is a malfunction in the vehicle control. However, the malfunction judgment unit 61 may also create the malfunction judgment result information indicating that there is no malfunction in the vehicle control even when it judges that there is no malfunction.

[0093] When creating malfunction judgment result information both when there is a malfunction in the vehicle control and when there is no malfunction, the inspection necessity determination unit 84 makes the following determination, for example. The inspection necessity determination unit 84 compiles a certain number of malfunction judgment result information, and determines whether or not to inspect the cause of the malfunction based on the ratio of malfunction judgment result information that means there is a malfunction in the vehicle control. Note that when the third condition described above, that is, the condition that the information output by the on-board sensor 20 is an error, is satisfied, it is unlikely that the map DB is the cause. Therefore, when determining whether or not to inspect whether the malfunction is caused by the map DB, malfunction judgment result information that means that the third condition described above is satisfied in the above ratio may be treated as meaning that there is no malfunction in the vehicle control.

[0094] <Variation 2> In the embodiment, the server 80 is described as being outside the vehicle 2. However, the server 80 may be mounted on the vehicle 2. Therefore, the vehicle-mounted device 60 may have the functions of the server-side control unit 83, such as the update determination unit 86.

[0095] <Variation 3> In the embodiment, it has been described that the inspection necessity determination unit 84 does not need to perform statistical processing. Therefore, the inspection necessity determination unit 84 may be omitted, and the inspection instruction unit 85 may issue an inspection instruction when the malfunction determination unit 61 determines that there is a malfunction in the vehicle control.

[0096] <Variation 4> When the map-based control information and the sensor-based control information are different, there is a high possibility that there is a defect in the map DB. In this way, when there is a high possibility that the cause of the defect in the vehicle control is in the map DB, the inspection necessity determination unit 84, the inspection instruction unit 85, and the inspection unit 62 may be omitted, and the update determination unit 86 may determine that the cause of the defect is in the map information. Note that, even in this modification 4, the defect determination unit 61 determines whether the map-based control information used for the vehicle control is different from the corresponding sensor-based control information. Even if the map DB does not correctly represent real roads and features, if the map information that does not correctly represent real roads and features is not used for vehicle control, the defect determination unit 61 does not determine that there is a defect in the vehicle control. For example, in lane change control, it is necessary to distinguish whether the division line is a solid line or a broken line, but the color of the solid line is not used. Therefore, even in the aspect of modification 4, the update of the map information that is not essential can be suppressed.

[0097] <Variation 5> The update determination unit 86 does not necessarily need to perform statistical processing on the inspection results, and may determine whether or not to update the map DB based on only one inspection result.

[0098] <Variation 6> The malfunction determination result information described in the embodiment includes information specifying the content of vehicle control and information specifying the position of the vehicle 2. However, the malfunction determination result information does not have to include one or both of the information specifying the content of vehicle control and the information specifying the position of the vehicle 2. Even in this case, if the malfunction determination unit 61 does not determine that there is a malfunction in the vehicle control, the update determination unit 86 does not determine to update the map information, so that updating of non-essential map information can be suppressed.

[0099] <Variation 7> In the embodiment, the map update unit 63 of the vehicle-mounted device 60 updates the map DB online based on the update map data distributed from the server 80. However, the map DB may be updated offline.

[0100] (Disclosure of technical ideas) This specification discloses multiple technical ideas described in the following multiple dependent claims. Some of the claims may be described in a multiple dependent form, where the subsequent claim alternatively refers to the preceding claim. Furthermore, some of the claims may be described in a multiple dependent form, where the subsequent claim alternatively refers to the preceding claim. The claims described in these multiple dependent forms define multiple technical ideas.

[0101] (Technical thought 1) A map update system (1) for determining whether or not map information stored in a storage unit (30) mounted on a vehicle (2) and used by a vehicle control unit (50) that controls a behavior of the vehicle needs to be updated, comprising: a malfunction determination unit (61) that determines whether or not there is a malfunction in the vehicle control executed by the vehicle control unit; and an update determination unit (86) that determines that the map information needs to be updated based on the determination that the cause of the malfunction is in the map information.

[0102] (Technical thought 2) A map update system according to Technical Concept 1, The malfunction determination unit determines that there is a malfunction in the vehicle control performed by the vehicle control unit based on a vehicle operation performed by a driver of the vehicle that changes vehicle control by the vehicle control unit.

[0103] (Technical Thought 3) A map update system according to Technical Idea 1 or 2, The malfunction determination unit determines that there is a malfunction in the vehicle control executed by the vehicle control unit based on a difference between map-based control information, which is determined based on map information stored in the memory unit and used for vehicle control by the vehicle control unit, and sensor-based control information, which is determined based on information detected by a surrounding detection sensor (21) mounted on the vehicle and is information corresponding to the map-based control information.

[0104] (Technical Thought 4) A map update system according to any one of technical concepts 1 to 3, the vehicle control unit acquires at least one of information indicating a behavior of the vehicle and information indicating an object present around the vehicle from an on-board sensor (20) mounted on the vehicle, and controls the behavior of the vehicle; The malfunction determination unit determines that there is a malfunction in the vehicle control executed by the vehicle control unit based on an error in the information output by the vehicle-mounted sensor.

[0105] (Technical Thought 5) A map update system according to any one of technical concepts 1 to 4, a plurality of vehicle-mounted devices (60) each including the malfunction determination unit and mounted on a plurality of the vehicles; a server (80) that includes the update determination unit and communicates with the vehicle-mounted device; the malfunction determination unit transmits malfunction determination result information, which is information indicating whether or not there is a malfunction in the vehicle control, from a vehicle-side communication unit (40) to the server; The server, an inspection necessity determination unit (84) that determines whether or not to inspect the cause of the malfunction based on the malfunction judgment result information received from the vehicle; an inspection instruction unit (85) that transmits an inspection instruction to one or more of the in-vehicle devices when the inspection necessity determination unit determines that the cause of the malfunction should be inspected, The vehicle-mounted device includes: an inspection unit (62) that, when receiving the inspection instruction, inspects whether the map information stored in the storage unit is correct by comparing the map information stored in the storage unit with recognized map information created from information detected by a surrounding detection sensor (21) mounted on the vehicle, and transmits the inspection result from the vehicle-side communication unit to the server; The update determination unit determines whether or not the map information needs to be updated based on the inspection result transmitted from the vehicle.

[0106] (Technical Thought 6) A map update system according to Technical Concept 5, A map updating system, wherein the malfunction determination result information includes information that specifies the content of the vehicle control.

[0107] (Technical Thought 7) A map update system according to Technical Idea 5 or 6, A map updating system, wherein the malfunction determination result information includes location identification information that identifies the location of the vehicle when the malfunction occurred.

[0108] (Technical Thought 8) A map update system according to any one of Technical Ideas 5 to 7, a map updating system in which, when the malfunction determination result information is acquired from a plurality of the vehicles, the inspection necessity determination unit performs statistical processing on the plurality of pieces of malfunction determination result information and determines whether or not to inspect the cause of the malfunction.

[0109] (Technical Thought 9) A map update system according to any one of Technical Ideas 5 to 8, The update determination unit performs statistical processing on the inspection results transmitted from the plurality of vehicles to determine whether or not the cause of the defect is in the map information.

[0110] (Technical Thought 10) A map update system according to Technical Concept 9, A map update system that stops use of the map information when the update determination unit determines that the cause of the problem lies in the map information.

[0111] (Technical Thought 11) A map update system according to Technical Concept 9, A map update system that stops use of an application related to automatic driving or driving assistance of the vehicle when the update determination unit determines that the map information is the cause of a malfunction.

[0112] (Technical Thought 12) A map update system according to Technical Concept 9, A map update system that stops an application related to automatic driving or driving assistance of the vehicle when the update determination unit determines that there is no cause of the malfunction in the map information and that there is a malfunction in an application related to automatic driving or driving assistance of the vehicle.

Claims

1. A map update system (1) for determining whether or not map information stored in a storage unit (30) mounted on a vehicle (2) and used by a vehicle control unit (50) that controls a behavior of the vehicle needs to be updated, comprising: a plurality of vehicle-mounted devices (60) each mounted on a plurality of the vehicles, the vehicle-mounted devices (60) including a defect determination unit (61) for determining whether or not there is a defect in the vehicle control executed by the vehicle control unit; an update determination unit (86) that determines that the map information needs to be updated based on the determination that the cause of the malfunction is in the map information, and a server (80) that communicates with the vehicle-mounted device; The malfunction determination unit transmits malfunction determination result information, which is information indicating whether or not there is a malfunction in the vehicle control, from a vehicle-side communication unit (40) to the server, The server, an inspection necessity determination unit (84) for determining whether or not to inspect the cause of the malfunction based on the malfunction judgment result information received from the vehicle; an inspection instruction unit (85) that transmits an inspection instruction to one or more of the vehicle-mounted devices when the inspection necessity determination unit determines that the cause of the malfunction should be inspected, The vehicle-mounted device includes: an inspection unit (62) that, when receiving the inspection instruction, inspects whether the map information stored in the storage unit is correct by comparing the map information stored in the storage unit with recognized map information created from information detected by a surrounding detection sensor (21) mounted on the vehicle, and transmits the inspection result from the vehicle-side communication unit to the server; The update determination unit determines whether or not the map information needs to be updated based on the inspection result transmitted from the vehicle.

2. 2. A map update system according to claim 1, The malfunction determination unit determines that there is a malfunction in the vehicle control performed by the vehicle control unit based on a vehicle operation performed by a driver of the vehicle that changes vehicle control by the vehicle control unit.

3. 3. A map update system according to claim 1, further comprising: A map updating system, wherein the malfunction determination result information includes information that specifies the content of the vehicle control.

4. 3. A map update system according to claim 1, further comprising: A map updating system, wherein the malfunction determination result information includes location identification information that identifies the location of the vehicle when the malfunction occurred.

5. 3. A map update system according to claim 1, further comprising: a map updating system in which, when the malfunction determination result information is acquired from a plurality of the vehicles, the inspection necessity determination unit performs statistical processing on the plurality of pieces of malfunction determination result information and determines whether or not to inspect the cause of the malfunction.

6. 3. A map update system according to claim 1, further comprising: The update determination unit performs statistical processing on the inspection results transmitted from the plurality of vehicles to determine whether or not the cause of the defect is in the map information.

7. 7. A map update system according to claim 6, A map update system that stops use of the map information when the update determination unit determines that the map information is the cause of the problem.

8. 7. A map update system according to claim 6, further comprising: A map update system that stops use of an application related to automatic driving or driving assistance of the vehicle when the update determination unit determines that the map information is the cause of a malfunction.

9. 7. A map update system according to claim 6, further comprising: A map update system that stops an application related to automatic driving or driving assistance of the vehicle when the update determination unit determines that there is no cause of the malfunction in the map information and that there is a malfunction in an application related to automatic driving or driving assistance of the vehicle.

10. a malfunction judgment unit (61) that judges whether or not there is a malfunction in vehicle control executed by a vehicle control unit (50) that controls the behavior of the vehicle (2) using map information stored in a storage unit (30) mounted on the vehicle (2), and transmits malfunction judgment result information indicating the judgment result from a vehicle-side communication unit (40) to a server (80); The vehicle-mounted device is provided with an inspection unit (62) that, when receiving an inspection instruction from the server, inspects whether the map information stored in the memory unit is correct by comparing the map information stored in the memory unit with recognized map information created from information detected by a surrounding detection sensor (21) mounted on the vehicle, and transmits the inspection result from the vehicle-side communication unit to the server.

11. an inspection necessity determination unit (84) that receives, from the vehicle (2), malfunction determination result information, which is information obtained by determining whether or not there is a malfunction in vehicle control by a vehicle control unit (50) that controls the behavior of the vehicle using map information stored in a storage unit (30) mounted on the vehicle (2), and determines whether or not to inspect the cause of the malfunction based on the malfunction determination result information; an inspection instruction unit (85) that transmits an inspection instruction to one or more vehicle-mounted devices (60) when the inspection necessity determination unit determines that the cause of the malfunction should be inspected; and an update determination unit (86) that, when the malfunction determination result information is acquired from a plurality of the vehicles, performs statistical processing on the plurality of the malfunction determination result information to determine whether or not the cause of the malfunction lies in the map information, and determines to update the map information based on the determination that the cause of the malfunction lies in the map information.

Images