Operation system design method, design program, and operation system

Abstract

A method for designing a driving system (2) which is provided with a plurality of sub-systems (10a, 20a, 30a) and which realizes a dynamic driving task of an own vehicle (1) by the sub-systems (10a, 20a, 30a) in cooperation with each other, the method including: calculating an error generated in each of the temporarily designed sub-systems (10a, 20a, 30a); temporarily allocating a permitted deviation permitted for the entire driving system (2) to each of the sub-systems (10a, 20a, 30a); identifying a permitted error permitted for each of the sub-systems (10a, 20a, 30a) from the deviation allocated to each of the sub-systems (10a, 20a, 30a) on the basis of evaluation of the error transmitted through the driving system (2); and adjusting the allocation of the permitted error to each of the sub-systems (10a, 20a, 30a) on the basis of the result of comparing the calculated errors with the corresponding permitted errors of the sub-systems (10a, 20a, 30a).

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application is based on Patent Application No. 2022-9646 filed in Japan on January 25, 2022, and the contents of the original application are incorporated by reference in their entirety. [Technical field]

[0002] The disclosure of this specification relates to a technology for realizing a driving system for a moving object. [Background technology]

[0003] In the method for evaluating a driving system disclosed in Patent Document 1, a driving assistance function is evaluated based on the behavior of an autonomous driving object in response to the behavior of an object controlled by a person in a game environment. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2017-105453 A Summary of the Invention

[0005] However, driving systems are becoming more complex with multiple subsystems. Therefore, simple tests that evaluate responses to behavior have limitations in terms of appropriately verifying the validity of the driving system, including each subsystem. For this reason, it is difficult to optimize the design of the driving system and realize a driving system with high validity.

[0006] One of the objectives of the disclosure of this specification is to provide a design method for improving the validity of a driving system. and design programs or to provide an operating system having high validity.

[0007] One embodiment disclosed herein is 1. A method executed by at least one processor, comprising:A method for designing a driving system including a plurality of subsystems, each subsystem cooperating with each other to realize a dynamic driving task of a moving object, comprising: Calculating the errors occurring in each provisionally designed subsystem; Provisionally assigning to each subsystem a tolerance for deviations permitted for the entire operational system; determining a tolerance for each subsystem based on an evaluation of the error propagating through the operational system from the deviations assigned to each subsystem; and adjusting the allocation of tolerances to each subsystem based on a comparison of the calculated errors with the tolerances of the corresponding subsystems. Another aspect disclosed herein is a design program for implementing a design function of a driving system having a plurality of subsystems, each subsystem cooperating with each other to realize a dynamic driving task of a moving object, the design program comprising: At least one processor Calculating the errors occurring in each provisionally designed subsystem; Provisionally assigning to each subsystem a tolerance for deviations permitted for the entire operational system; determining a tolerance for each subsystem based on an evaluation of the error propagating through the operational system from the deviations assigned to each subsystem; and adjusting the allocation of the tolerance to each subsystem based on a comparison between the calculated error and the tolerance of the corresponding subsystem.

[0008] According to this aspect, the allocation of the allowable error to each subsystem is adjusted. In this adjustment, a comparison between the error of each subsystem tentatively designed and the allowable error is used. Here, the allowable error is specified by evaluating the deviation of the allowable error of the entire operation system provisionally assigned to each subsystem and the error propagating through the operation system. As a result of using the evaluation of the error propagating through the operation system, it is possible to reflect the complex factors based on the interaction between each subsystem in the design. Therefore, it is possible to improve the validity of the operation system having a plurality of subsystems.

[0009] Another aspect disclosed herein is a method for designing a driving system including a plurality of subsystems, each subsystem cooperating with each other to realize a dynamic driving task of a mobile object, the method comprising: Introducing reliability to each subsystem as a common measure for evaluating the complex factors among each subsystem; assigning a reliability to each subsystem based on the operational system specification; Determine the specifications of each subsystem so that the error that occurs in each subsystem and propagates through the operation system falls within the allowable error with a probability equal to or greater than a specified level of reliability. Including . Another aspect disclosed herein is a design program for implementing a design function of a driving system having a plurality of subsystems, each subsystem cooperating with each other to realize a dynamic driving task of a moving object, comprising: At least one processor Introducing reliability to each subsystem as a common measure for evaluating the complex factors among each subsystem; assigning a reliability to each subsystem based on the operational system specification; The system is configured to determine the specifications of each subsystem so that errors occurring in each subsystem and propagating through the operation system fall within an allowable error with a probability equal to or greater than a predetermined confidence level.

[0010] According to this aspect, the specifications of each subsystem are determined so that the error propagating through the operation system falls within the allowable error with a probability equal to or higher than a predetermined reliability. In other words, reliability is introduced as a common measure in a form in which an evaluation based on probability theory is applied to each subsystem. Therefore, even if the recognition system, judgment system, and control system each have different functions, the complex factors due to their interactions can be appropriately reflected in the design. Therefore, the validity of an operation system having multiple subsystems can be improved.

[0011] Another aspect disclosed herein is a driving system including a plurality of subsystems, each subsystem working together to realize a dynamic driving task of a mobile object, comprising: The plurality of subsystems include a recognition system, a judgment system, and a control system; At least one storage medium storing a reliability assignment for each subsystem, the reliability assignment being a common scale between the subsystems, the reliability assignment being determined for each assignment category; and at least one processor configured to modify conditions for achieving the dynamic driving task based on the assignment of confidence levels.

[0012] According to this embodiment, the conditions for realizing the dynamic driving task are changed based on the reliability assignment to each subsystem stored in the storage medium. That is, since the reliability, which is a common measure between the subsystems, is used, even if the recognition system, the judgment system, and the control system each have different functions, it is possible to change the conditions taking into account the load on each subsystem, which may differ depending on the assigned category. Therefore, a driving system having multiple subsystems can achieve high validity.

[0013] Note that the reference characters in parentheses in the claims are intended to exemplify the corresponding relationships with the parts of the embodiments described below, and are not intended to limit the technical scope. [Brief description of the drawings]

[0014] [Figure 1] FIG. 2 is a block diagram showing a schematic configuration of an operation system. [Diagram 2] FIG. 2 is a block diagram showing the configuration of the technology level of the driving system. [Diagram 3] FIG. 2 is a block diagram showing a functional level configuration of the driving system. [Figure 4] FIG. 2 illustrates a control state space of a vehicle. [Diagram 5] FIG. 2 is a block diagram showing a causal loop of the driving system. [Figure 6] FIG. 13 is a diagram illustrating an inner loop. [Figure 7] FIG. 13 is a diagram illustrating an outer loop. [Figure 8] FIG. 11 is a diagram showing an area in which security cannot be maintained based on the concept of the first evaluation method. [Figure 9] 1 is a flowchart illustrating a first evaluation method. [Figure 10] FIG. 13 is a diagram showing an area in which security cannot be maintained based on the concept of the second evaluation method. [Figure 11] 13 is a flowchart illustrating a second evaluation method. [Figure 12]FIG. 13 is a diagram showing an area where security cannot be maintained based on the concept of the third evaluation method. [Figure 13] 13 is a flowchart illustrating a third evaluation method. [Figure 14] 11 is a flowchart illustrating an evaluation method based on reliability. [Figure 15] FIG. 2 is a block diagram showing an evaluation device and a design device. [Figure 16] 1 is a graph showing the relationship between error distribution and reliability. [Figure 17] 1 is a flowchart illustrating a first design method. [Figure 18] FIG. 2 is a block diagram showing a causal loop of the driving system. [Figure 19] FIG. 13 is a diagram illustrating an inner loop. [Figure 20] FIG. 13 is a diagram illustrating an outer loop. [Figure 21] FIG. 2 is a diagram illustrating a vehicle body stabilization loop. [Figure 22] 1 is a table showing various errors. [Diagram 23] 1 is a flowchart illustrating an evaluation method based on an error. [Figure 24] 11 is a flowchart illustrating a second design method. [Diagram 25] 4 is a flowchart illustrating a process of the driving system. [Figure 26] FIG. 2 is a block diagram showing a functional level configuration of the driving system. [Figure 27] FIG. 2 is a block diagram showing the configuration of the technology level of the driving system. [Figure 28] 4 is a flowchart illustrating a process of the driving system. [Figure 29] FIG. 2 is a block diagram showing a functional level configuration of the driving system. [Diagram 30] FIG. 2 is a block diagram showing the configuration of the technology level of the driving system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, a number of embodiments will be described with reference to the drawings. In addition, by assigning the same reference numerals to corresponding components in each embodiment, duplicated descriptions may be omitted. When only a part of the configuration is described in each embodiment, the configuration of the other embodiment described above can be applied to the other parts of the configuration. In addition to the combination of configurations explicitly stated in the description of each embodiment, configurations of multiple embodiments can be partially combined together even if not explicitly stated, as long as there is no particular problem with the combination.

[0016] (First embodiment) The driving system 2 of the first embodiment shown in FIG. 1 realizes functions related to driving a moving object. A part or the whole of the driving system 2 is mounted on the moving object. The moving object that is the target of processing by the driving system 2 is a vehicle. This vehicle can be called the own vehicle 1, which corresponds to a host moving object. The own vehicle 1 may be configured to be able to communicate with other vehicles directly or indirectly via a communication infrastructure. The other vehicles correspond to target moving objects.

[0017] The vehicle 1 is a road user capable of performing automated driving, such as a car or truck. Driving is classified into levels according to the extent to which the driver performs all dynamic driving tasks (DDTs). The automated driving levels are defined, for example, in SAE J3016. In levels 0 to 2, the driver performs some or all of the DDTs. Levels 0 to 2 may be classified as so-called manual driving. Level 0 indicates that driving is not automated. Level 1 indicates that the driving system 2 assists the driver. Level 2 indicates that driving is partially automated.

[0018] At levels 3 and above, the driving system 2 performs all of the DDT while engaged. Levels 3 to 5 may be classified as so-called automated driving. A driving system 2 capable of performing driving at levels 3 and above may be called an automated driving system. Level 3 indicates that driving is conditionally automated. Level 4 indicates that driving is highly automated. Level 5 indicates that driving is fully automated.

[0019] Furthermore, a driving system 2 that is incapable of performing driving at level 3 or above and is capable of performing driving at least one of levels 1 and 2 may be referred to as a driving assistance system. In the following, unless there are circumstances to specify the maximum achievable level of autonomous driving, the autonomous driving system or driving assistance system will be referred to simply as the driving system 2 and the explanation will continue.

[0020] <Sense-Plan-Act Model> The architecture of the driving system 2 is selected so as to enable an efficient SOTIF (safety of the intended functionality) process. For example, the architecture of the driving system 2 may be configured based on a sense-plan-act model. The sense-plan-act model includes a sense element, a plan element, and an act element as main system elements. The sense element, the plan element, and the act element interact with each other. Here, sense may be replaced with perception, plan may be replaced with judgment, and act may be replaced with control, respectively, and the following description will be mainly made using the terms perception, judgment, and control.

[0021] As shown in Fig. 1, in such a driving system 2, at the vehicle level, vehicle level functions 3 are implemented based on a Vehicle Level Safety Strategy (VLSS). At the function level (in other words, from a functional perspective), a recognition function, a judgment function, and a control function are implemented. At the technical level (in other words, from a technical perspective), a plurality of sensors 40 corresponding to the recognition function, a processing system 50 corresponding to the judgment function, and a plurality of motion actuators 60 corresponding to the control function are implemented.

[0022] In detail, a recognition unit 10 which is a functional block realizing a recognition function may be constructed in the driving system 2 mainly consisting of a plurality of sensors 40, a processing system which processes detection information from the plurality of sensors 40, and a processing system which generates an environmental model based on information from the plurality of sensors 40. A judgment unit 20 which is a functional block realizing a judgment function mainly consisting of the processing system may be constructed in the driving system 2. A control unit 30 which is a functional block realizing a control function mainly consisting of a plurality of motion actuators 60 and at least one processing system which outputs operation signals for the plurality of motion actuators 60 may be constructed in the driving system 2.

[0023] Here, the recognition unit 10 may be realized in the form of a recognition system 10a as a subsystem provided so as to be distinguishable from the judgment unit 20 and the control unit 30. The judgment unit 20 may be realized in the form of a judgment system 20a as a subsystem provided so as to be distinguishable from the recognition unit 10 and the control unit 30. The control unit 30 may be realized in the form of a control system 30a as a subsystem provided so as to be distinguishable from the recognition unit 10 and the judgment unit 20. The recognition system 10a, the judgment system 20a, and the control system 30a may constitute components independent of each other.

[0024] Furthermore, the vehicle 1 may be equipped with a plurality of HMI (Human Machine Interface) devices 70. A portion of the plurality of HMI devices 70 that realizes an operation input function by an occupant may be a part of the recognition unit 10. A portion of the plurality of HMI devices 70 that realizes an information presentation function may be a part of the control unit 30. On the other hand, the function realized by the HMI device 70 may be positioned as a function independent of the recognition function, the judgment function, and the control function.

[0025] The recognition unit 10 is responsible for the recognition function, including localization of the vehicle 1 and road users such as other vehicles. The recognition unit 10 detects the external environment EE, the internal environment, the vehicle state, and the state of the driving system 2 of the vehicle 1. The recognition unit 10 fuses the detected information to generate an environmental model. The decision unit 20 applies the objective and driving policy to the environmental model generated by the recognition unit 10 to derive a control action. The control unit 30 executes the control action derived by the recognition element.

[0026] <Technical level system configuration> An example of a detailed configuration of the driving system 2 at a technical level will be described with reference to FIG. 2. The technical level configuration may refer to a physical architecture. The driving system 2 includes a plurality of sensors 40, a plurality of motion actuators 60, a plurality of HMI devices 70, and at least one processing system 50. These components can communicate with each other by one or both of wireless and wired connections. These components may also be able to communicate with each other through an in-vehicle network such as CAN (registered trademark).

[0027] The multiple sensors 40 include one or more external environment sensors 41. The multiple sensors 40 may include at least one of one or more internal environment sensors 42, one or more communication systems 43, and a map DB (database) 44. When the sensor 40 is interpreted in a narrow sense to indicate the external environment sensor 41, the internal environment sensor 42, the communication system 43, and the map DB 44 may be positioned as components separate from the sensor 40 that corresponds to the technology level of the recognition function.

[0028] The external environment sensor 41 may detect a target object present in the external environment EE of the vehicle 1. The target detection type external environment sensor 41 is, for example, a camera, a LiDAR (Light Detection and Ranging / Laser imaging Detection and Ranging) laser radar, a millimeter wave radar, an ultrasonic sonar, etc. Typically, a combination of multiple types of external environment sensors 41 may be implemented to monitor the front, sides, and rear directions of the vehicle 1.

[0029] As an example of the external environment sensor 41, the vehicle 1 may be equipped with multiple cameras (e.g., 11 cameras) configured to monitor each of the directions in front, front side, side, rear side, and rear of the vehicle 1.

[0030] As another example of the installation, the host vehicle 1 may be equipped with a plurality of cameras (e.g., four cameras) configured to monitor the front, sides, and rear of the host vehicle 1, a plurality of millimeter wave radars (e.g., five millimeter wave radars) configured to monitor the front, front-side, sides, and rear of the host vehicle 1, and a LiDAR configured to monitor the front of the host vehicle 1.

[0031] Furthermore, the external environment sensor 41 may detect the atmospheric condition and weather condition in the external environment EE of the vehicle 1. The condition detection type external environment sensor 41 is, for example, an outside air temperature sensor, a temperature sensor, a raindrop sensor, or the like.

[0032] The internal environment sensor 42 may detect a specific physical quantity related to vehicle motion (hereinafter, motion physical quantity) in the internal environment of the host vehicle 1. The motion physical quantity detection type internal environment sensor 42 is, for example, a speed sensor, an acceleration sensor, a gyro sensor, etc. The internal environment sensor 42 may detect the state of an occupant in the internal environment of the host vehicle 1. The occupant detection type internal environment sensor 42 is, for example, an actuator sensor, a sensor and its system for monitoring the driver, a biological sensor, a seating sensor, an in-vehicle equipment sensor, etc. Here, the actuator sensor in particular is, for example, an accelerator sensor, a brake sensor, a steering sensor, etc. that detects the operation state of the occupant with respect to the motion actuator 60 related to the motion control of the host vehicle 1.

[0033] The communication system 43 obtains communication data usable in the driving system 2 by wireless communication. The communication system 43 may receive positioning signals from artificial satellites of a global navigation satellite system (GNSS) present in the external environment EE of the vehicle 1. A positioning type communication device in the communication system 43 is, for example, a GNSS receiver.

[0034] The communication system 43 may transmit and receive communication signals to and from a V2X system present in the external environment EE of the vehicle 1. The V2X type communication device in the communication system 43 is, for example, a dedicated short range communications (DSRC) communication device, a cellular V2X (C-V2X) communication device, etc. Examples of communication with a V2X system present in the external environment EE of the vehicle 1 include communication with a communication system of another vehicle (V2V), communication with infrastructure equipment such as a communication device set in a traffic light (V2I), communication with a mobile terminal of a pedestrian (V2P), and communication with a network such as a cloud server (V2N).

[0035] Furthermore, the communication system 43 may transmit and receive communication signals between the internal environment of the vehicle 1, for example, a mobile terminal such as a smartphone present inside the vehicle 1. The terminal communication type communication device in the communication system 43 is, for example, a Bluetooth (registered trademark) device, a Wi-Fi (registered trademark) device, an infrared communication device, etc.

[0036] The map DB 44 is a database that stores map data available in the driving system 2. The map DB 44 includes at least one type of non-transitory tangible storage medium, such as a semiconductor memory, a magnetic medium, and an optical medium. The map DB 44 may include a database of a navigation unit that navigates a driving route to a destination of the vehicle 1. The map DB 44 may include a database of a PD map generated using probe data (PD) collected from each vehicle. The map DB 44 may include a database of high-precision maps having a high level of accuracy that are mainly used for the application of an automatic driving system. The map DB 44 may include a database of parking lot maps including detailed parking lot information, such as parking space information, that is used for the application of automatic parking or parking assistance.

[0037] The map DB 44 suitable for the driving system 2 acquires and stores the latest map data by, for example, communication with a map server via a V2X type communication system 43. The map data is digitized in two dimensions or three dimensions as data representing the external environment EE of the vehicle 1. The map data may include road data representing at least one of the position coordinates, shape, road surface condition, and standard running route of a road structure. The map data may include marking data representing at least one of the position coordinates and shape of road signs, road indications, and dividing lines attached to a road. The marking data included in the map data may represent, for example, traffic signs, arrow markings, lane markings, stop lines, directional signs, landmark beacons, business signs, changes in road line patterns, and the like, among landmarks. The map data may include structure data representing, for example, at least one of the position coordinates and shape of buildings and traffic lights facing the road. The marking data included in the map data may represent, for example, street lights, road edges, reflectors, poles, and the like, among landmarks.

[0038] The motion actuator 60 can control vehicle motion based on an input control signal. The drive type motion actuator 60 is, for example, a power train including at least one of an internal combustion engine, a drive motor, etc. The braking type motion actuator 60 is, for example, a brake actuator. The steering type motion actuator 60 is, for example, a steering.

[0039] The HMI device 70 may be an operation input device capable of inputting operations by the driver in order to transmit the will or intent of the occupants, including the driver, of the vehicle 1 to the driving system 2. Examples of the operation input type HMI device 70 include an accelerator pedal, a brake pedal, a shift lever, a steering wheel, a turn signal lever, a mechanical switch, and a touch panel of a navigation unit. Of these, the accelerator pedal controls the power train as the motion actuator 60. The brake pedal controls a brake actuator as the motion actuator 60. The steering wheel controls a steering actuator as the motion actuator 60.

[0040] The HMI device 70 may be an information presentation device that presents information such as visual information, auditory information, and cutaneous sensory information to passengers including the driver of the vehicle 1. Examples of the visual information presentation type HMI device 70 include a combination meter, a navigation unit, a center information display (CID), a head-up display (HUD), and an illumination unit. Examples of the auditory information presentation type HMI device 70 include a speaker and a buzzer. Examples of the cutaneous sensory information presentation type HMI device 70 include a steering wheel vibration unit, a driver's seat vibration unit, a steering wheel reaction force unit, an accelerator pedal reaction force unit, a brake pedal reaction force unit, an air conditioning unit, and the like.

[0041] Furthermore, the HMI device 70 may realize an HMI function linked to a mobile terminal such as a smartphone by communicating with the terminal through the communication system 43. For example, the HMI device 70 may present information acquired from the smartphone to passengers including the driver. Also, for example, an operation input to a smartphone may be an alternative means for an operation input to the HMI device 70.

[0042] At least one processing system 50 is provided. For example, the processing system 50 may be an integrated processing system that performs processing related to the recognition function, processing related to the judgment function, and processing related to the control function in an integrated manner. In this case, the integrated processing system 50 may further perform processing related to the HMI device 70, or a processing system dedicated to the HMI may be provided separately. For example, the processing system dedicated to the HMI may be an integrated cockpit system that performs processing related to each HMI device in an integrated manner.

[0043] For example, the processing system 50 may be configured to have at least one processing unit corresponding to processing related to the recognition function, at least one processing unit corresponding to processing related to the judgment function, and at least one processing unit corresponding to processing related to the control function.

[0044] The processing system 50 has a communication interface to the outside and is connected to at least one type of element related to processing by the processing system 50, such as the sensor 40, the motion actuator 60, and the HMI device 70, via at least one of, for example, a LAN (Local Area Network), a wire harness, an internal bus, and a wireless communication circuit.

[0045] The processing system 50 includes at least one dedicated computer 51. The processing system 50 may combine multiple dedicated computers 51 to realize functions such as recognition functions, judgment functions, and control functions.

[0046] For example, the dedicated computer 51 constituting the processing system 50 may be an integration ECU that integrates the driving functions of the host vehicle 1. The dedicated computer 51 constituting the processing system 50 may be a determination ECU that determines the DDT. The dedicated computer 51 constituting the processing system 50 may be a monitoring ECU that monitors the driving of the vehicle. The dedicated computer 51 constituting the processing system 50 may be an evaluation ECU that evaluates the driving of the vehicle. The dedicated computer 51 constituting the processing system 50 may be a navigation ECU that navigates the driving route of the host vehicle 1.

[0047] Moreover, the dedicated computer 51 constituting the processing system 50 may be a locator ECU that estimates the position of the host vehicle 1. The dedicated computer 51 constituting the processing system 50 may be an image processing ECU that processes image data detected by the external environment sensor 41. The dedicated computer 51 constituting the processing system 50 may be an actuator ECU that controls the motion actuator 60 of the host vehicle 1. The dedicated computer 51 constituting the processing system 50 may be an HCU (HMI Control Unit) that comprehensively controls the HMI device 70. The dedicated computer 51 constituting the processing system 50 may be at least one external computer that constitutes an external center or a mobile terminal that can communicate via the communication system 43, for example.

[0048] The dedicated computer 51 constituting the processing system 50 has at least one memory 51a and one processor 51b. The memory 51a may be at least one type of non-transient substantial storage medium, such as a semiconductor memory, a magnetic medium, or an optical medium, which non-temporarily stores programs and data that can be read by the processor 51b. Furthermore, the memory 51a may be provided with a rewritable volatile storage medium, such as a random access memory (RAM). The processor 51b includes at least one type of core, such as a central processing unit (CPU), a graphics processing unit (GPU), or a reduced instruction set computer (RISC)-CPU.

[0049] The dedicated computer 51 constituting the processing system 50 may be a SoC (System on a Chip) in which memory, a processor and an interface are integrated into a single chip, or may have an SoC as a component of the dedicated computer.

[0050] Furthermore, the processing system 50 may include at least one database for executing the dynamic driving task. The database may include at least one type of non-transitory tangible storage medium, such as a semiconductor memory, a magnetic medium, or an optical medium. The database may be a scenario DB 53 that stores a scenario structure, which will be described later.

[0051] The processing system 50 may also include at least one recording device 55 for recording at least one of the recognition information, the judgment information, and the control information of the driving system 2. The recording device 55 may include at least one memory 55a and an interface 55b for writing data to the memory 55a. The memory 55a may be at least one type of non-transient tangible storage medium, such as a semiconductor memory, a magnetic medium, and an optical medium.

[0052] At least one of the memories 55a may be mounted on the board in a form that is not easily removable and replaceable, and in this form, for example, an eMMC (embedded multi media card) using a flash memory may be used. At least one of the memories 55a may be mounted on the board in a form that is removable and replaceable from the recording device 55, and in this form, for example, an SD card may be used.

[0053] The recording device 55 may have a function of selecting information to be recorded from among the recognition information, the judgment information, and the control information. In this case, the recording device 55 may have a dedicated computer 55c. A processor provided in the recording device 55 may temporarily store information in a RAM or the like. The processor may select information to be recorded from the temporarily stored information, and save the selected information in the memory 51a.

[0054] The recording device 55 may access the memory 55a and perform recording according to a data write command from the recognition system 10a, the judgment system 20a, or the control system 30a. The recording device 55 may determine information flowing through the in-vehicle network, and access the memory 55a and perform recording according to the judgment of a processor provided in the recording device 55.

[0055] <Functional level system configuration> Next, an example of a detailed configuration of the driving system 2 at the functional level will be described with reference to Fig. 3. The functional level configuration may mean a logical architecture. The recognition unit 10 includes an external recognition unit 11, a self-location recognition unit 12, a fusion unit 13, and an internal recognition unit 14 as sub-blocks that further classify the recognition function.

[0056] The external recognition unit 11 realizes a function of individually processing the detection data detected by each external environment sensor 41 and recognizing objects such as targets and other road users. The detection data may be detection data provided by, for example, a millimeter wave radar, a sonar, a LiDAR, etc. The external recognition unit 11 may generate relative position data including the direction, size, and distance of the object relative to the vehicle 1 from the raw data detected by the external environment data.

[0057] Furthermore, the detection data may be image data provided by, for example, a camera, LiDAR, or the like. The external recognition unit 11 processes the image data and extracts objects reflected within the angle of view of the image. The extraction of the object may include estimation of the direction, size, and distance of the object relative to the vehicle 1. The extraction of the object may also include classifying the object using, for example, semantic segmentation.

[0058] The self-location recognition unit 12 performs localization of the vehicle 1. The self-location recognition unit 12 acquires global position data of the vehicle 1 from a communication system 43 (e.g., a GNSS receiver). In addition, the self-location recognition unit 12 may acquire at least one of the position information of the target extracted in the external recognition unit 11 and the position information of the target extracted in the fusion unit 13. The self-location recognition unit 12 also acquires map information from a map DB 44. The self-location recognition unit 12 integrates these pieces of information to estimate the position of the vehicle 1 on the map.

[0059] The fusion unit 13 fuses the external recognition information of each external environment sensor 41 processed by the external recognition unit 11, the localization information processed by the self-position recognition unit 12, and the V2X information acquired by V2X.

[0060] The fusion unit 13 fuses object information of other road users, etc., individually recognized by each external environment sensor 41, and identifies the type and relative position of the object around the vehicle 1. The fusion unit 13 fuses road target information individually recognized by each external environment sensor 41, and identifies the static structure of the road around the vehicle 1. The static structure of the road includes, for example, curve curvature, number of lanes, free space, etc.

[0061] Next, the fusion unit 13 fuses the types of objects around the vehicle 1, their relative positions, the static structure of the road, the localization information, and the V2X information to generate an environmental model. The environmental model can be provided to the determination unit 20. The environmental model may be an environmental model specialized for modeling the external environment EE.

[0062] The environmental model may be an integrated environmental model that is realized by expanding the acquired information and that fuses information such as the internal environment, the vehicle state, and the state of the driving system 2. For example, the fusion unit 13 may acquire traffic rules such as the Road Traffic Act and reflect them in the environmental model.

[0063] The internal recognition unit 14 processes the detection data detected by each internal environment sensor 42, and realizes a function of recognizing the vehicle state. The vehicle state may include the state of the motion physical quantity of the vehicle 1 detected by a speed sensor, an acceleration sensor, a gyro sensor, etc. In addition, the vehicle state may include at least one of the states of the occupants including the driver, the operation state of the driver with respect to the motion actuator 60, and the switch state of the HMI device 70.

[0064] The judgment unit 20 includes an environment judgment unit 21, an operation planning unit 22, and a mode management unit 23 as sub-blocks that further classify the judgment function.

[0065] The environment determination unit 21 acquires the environment model generated by the fusion unit 13 and the vehicle state recognized by the internal recognition unit 14, and performs a determination about the environment based on these. Specifically, the environment determination unit 21 may interpret the environment model and estimate the situation in which the vehicle 1 is currently placed. The situation here may be an operational situation. The environment determination unit 21 may interpret the environment model and predict the trajectory of objects such as other road users. The environment determination unit 21 may also interpret the environment model and predict potential dangers.

[0066] Furthermore, the environment determination unit 21 may interpret the environment model and perform a determination regarding the scenario in which the host vehicle 1 is currently placed. The determination regarding the scenario may be to select at least one scenario in which the host vehicle 1 is currently placed from a catalog of scenarios constructed in the scenario DB 53. The determination regarding the scenario may be a determination of a scenario category, which will be described later.

[0067] Furthermore, the environment judgment unit 21 may estimate the driver's intention based on at least one of the predicted object trajectory, the predicted potential hazard, and the judgment regarding the scenario, and the vehicle state provided by the internal recognition unit 14.

[0068] The driving planning unit 22 plans the driving of the vehicle 1 based on at least one of the estimated information of the position of the vehicle 1 on a map by the self-position recognition unit 12, the judgment information and driver's intention estimation information by the environment judgment unit 21, and the functional constraint information by the mode management unit 23, etc.

[0069] The driving planner 22 realizes a route planning function, a behavior planning function, and a trajectory planning function. The route planning function is a function for planning at least one of a route to a destination and a mid-distance lane plan based on estimated information of the position of the vehicle 1 on a map. The route planning function may further include a function for determining at least one of a lane change request and a deceleration request based on the mid-distance lane plan. Here, the route planning function may be a mission / route planning function in a strategic function, and may output a mission plan and a route plan.

[0070] The behavior planning function is a function for planning the behavior of the host vehicle 1 based on at least one of the route to the destination planned by the route planning function, the mid-distance lane plan, the lane change request and the deceleration request, the judgment information and the driver's intention estimation information by the environment judgment unit 21, and the function constraint information by the mode management unit 23. The behavior planning function may include a function for generating a condition regarding the state transition of the host vehicle 1. The condition regarding the state transition of the host vehicle 1 may correspond to a triggering condition. The behavior planning function may include a function for determining the state transition of the application that realizes the DDT and further the state transition of the driving behavior based on this condition. The behavior planning function may include a function for determining the longitudinal constraint regarding the path of the host vehicle 1 and the lateral constraint regarding the path of the host vehicle 1 based on the information of these state transitions. The behavior planning function may be a tactical behavior plan in the DDT function and may output the tactical behavior.

[0071] The trajectory planning function is a function for planning the travel trajectory of the host vehicle 1 based on the judgment information by the environment judgment unit 21, the longitudinal constraints on the path of the host vehicle 1, and the lateral constraints on the path of the host vehicle 1. The trajectory planning function may include a function for generating a path plan. The path plan may include a speed plan, or the speed plan may be generated as a plan independent of the path plan. The trajectory planning function may include a function for generating a plurality of path plans and selecting an optimal path plan from the plurality of path plans, or a function for switching between path plans. The trajectory planning function may further include a function for generating backup data of the generated path plan. The trajectory planning function may be a trajectory planning function in the DDT function, and may output a trajectory plan.

[0072] The mode management unit 23 monitors the driving system 2 and sets constraints on the driving functions. The mode management unit 23 may monitor the state of the subsystem related to the driving system 2 and determine the malfunction of the driving system 2. The mode management unit 23 may determine the mode based on the driver's intention based on the driver's intention estimation information generated by the internal recognition unit 14. The mode management unit 23 may set constraints on the driving functions based on at least one of the malfunction determination result of the driving system 2, the mode determination result, the vehicle state by the internal recognition unit 14, the sensor abnormality (or sensor failure) signal output from the sensor 40, the state transition information of the application by the driving plan unit 22, the trajectory plan, and the like.

[0073] Furthermore, the mode management unit 23 may have a function of determining, in addition to the constraints on the driving functions, a vertical constraint on the path of the vehicle 1 and a horizontal constraint on the path of the vehicle 1. In this case, the driving planner 22 plans the behavior and the trajectory according to the constraints determined by the mode management unit 23.

[0074] The control unit 30 includes a motion control unit 31 and an HMI output unit 71 as sub-blocks that further classify the control functions. The motion control unit 31 controls the motion of the host vehicle 1 based on a trajectory plan (e.g., a path plan and a speed plan) acquired from the driving plan unit 22. Specifically, the motion control unit 31 generates accelerator request information, shift request information, brake request information, and steering request information according to the trajectory plan, and outputs them to the motion actuator 60.

[0075] Here, the motion control unit 31 can directly obtain the vehicle state recognized by the recognition unit 10 (particularly the internal recognition unit 14), such as at least one of the current speed, acceleration, and yaw rate of the vehicle 1, from the recognition unit 10 and reflect this in the motion control of the vehicle 1.

[0076] The HMI output unit 71 outputs information about the HMI based on at least one of the judgment information and driver's intention estimation information by the environment judgment unit 21, the state transition information and trajectory plan of the application by the driving plan unit 22, and the function constraint information by the mode management unit 23. The HMI output unit 71 may manage vehicle interactions. The HMI output unit 71 may generate a notification request based on the management state of the vehicle interactions and control an information notification function of the HMI device 70. Furthermore, the HMI output unit 71 may generate a control request for the wipers, the sensor washing device, the headlights, and the air conditioning device based on the management state of the vehicle interactions and control these devices.

[0077] <Scenario> A scenario-based approach may be adopted to execute or evaluate a dynamic driving task. As described above, the process required to execute a dynamic driving task in an automated driving system is classified into disturbances in a recognition element, disturbances in a judgment element, and disturbances in a control element, which are based on different physical principles. The root causes that affect the processing results in each element are structured as a scenario structure.

[0078] The disturbance in the recognition element is a perception disturbance. The perception disturbance is a disturbance indicating a state in which the recognition unit 10 cannot correctly recognize a danger due to an internal or external factor of the sensor 40 and the vehicle 1. The internal factor is, for example, instability related to the mounting or manufacturing variation of a sensor such as the external environment sensor 41, tilting of the vehicle due to an uneven load that changes the direction of the sensor, shielding of the sensor due to parts mounted on the outside of the vehicle, etc. The external factor is, for example, fogging or dirt of the sensor. The physical principle in the recognition disturbance is based on the sensor mechanism of each sensor.

[0079] The disturbance in the judgment element is a traffic disturbance. The traffic disturbance is a disturbance indicating a dangerous traffic situation that occurs as a result of a combination of the road geometry, the behavior of the vehicle 1, and the positions and behaviors of surrounding vehicles. The physical principles in the traffic disturbance are based on a geometric perspective and the actions of road users.

[0080] Disturbances in the control elements are vehicle disturbances. Vehicle disturbances may also be referred to as control disturbances. Vehicle disturbances are disturbances that indicate situations in which the vehicle may not be able to control its own dynamics due to internal or external factors. Internal factors include, for example, the total weight of the vehicle, weight balance, etc. External factors include, for example, road irregularities, inclination, wind, etc. The physical principles in vehicle disturbances are based on the mechanical actions input to the tires and the vehicle body, etc.

[0081] In order to deal with a collision between the host vehicle 1 and another road user or structure as a risk in a dynamic driving task of automated driving, a traffic disturbance scenario system in which traffic disturbance scenarios are systematized as one of the scenario structures is used. A reasonably foreseeable range or a reasonably foreseeable boundary is defined for the traffic disturbance scenario system, and an avoidable range or an avoidable boundary can be defined.

[0082] The avoidable range or avoidable boundary can be defined, for example, by defining and modeling the performance of a competent and careful human driver, which can be defined in three elements: perception, judgment, and control.

[0083] The traffic disturbance scenario is, for example, a cut-in scenario, a cut-out scenario, a deceleration scenario, etc. The cut-in scenario is a scenario in which another vehicle traveling in an adjacent lane of the host vehicle 1 merges in front of the host vehicle 1. The cut-out scenario is a scenario in which another preceding vehicle that is the subject of the host vehicle 1's following changes lanes to an adjacent lane. In this case, it is required to implement a proper response to a fallen object that suddenly appears in front of the host vehicle 1, a stopped vehicle at the end of a traffic jam, etc. The deceleration scenario is a scenario in which another preceding vehicle that is the subject of the host vehicle 1's following suddenly decelerates.

[0084] Traffic disturbance scenarios can be generated by systematically analyzing and classifying different combinations of elements of road geometry, the behavior of the ego vehicle 1, the positions of other surrounding vehicles, and the behavior of other surrounding vehicles.

[0085] Here, as an example of systematizing a traffic disturbance scenario, the structure of a traffic disturbance scenario on a highway will be described. Road shapes are classified into four categories: main line, merging, branching, and ramp. The behavior of the host vehicle 1 is classified into two categories: lane keeping and lane changing. The positions of other vehicles in the vicinity are defined by adjacent positions in eight directions that may enter the travel trajectory of the host vehicle 1, for example. Specifically, the eight directions are leading (Lead), following (Following), parallel running in front of the right (Parallel: Pr-f), parallel running on the right side (Parallel: Pr-s), parallel running in the rear of the right (Parallel: Pr-r), parallel running in front of the left (Parallel: Pl-f), parallel running on the left side (Parallel: Pl-s), and parallel running in the rear of the left (Parallel: Pl-r). The behavior of other vehicles in the vicinity is classified into five categories: cut-in, cut-out, acceleration, deceleration, and synchronization. Deceleration may include stopping.

[0086] There are combinations of positions and actions of other vehicles in the vicinity that may cause reasonably foreseeable obstacles and those that may not. For example, cut-in can occur in six parallel categories. Cut-out can occur in two categories, leading and following. Acceleration can occur in three categories, following, parallel right rear, and parallel left rear. Deceleration can occur in three categories, leading, parallel right front, and parallel left front. Synchronization can occur in two categories, parallel right side and parallel left side. Thus, the structure of traffic disturbance scenarios on the expressway is composed of a matrix including 40 possible combinations. The structure of traffic disturbance scenarios may be further expanded to include complex scenarios by considering at least one of a motorcycle and multiple vehicles.

[0087] Next, a perception disturbance scenario system will be described. The perception disturbance scenario may include a blind spot scenario (also called an occlusion scenario) and a communication disturbance scenario in addition to a sensor disturbance scenario caused by an external environment sensor.

[0088] Sensor disturbance scenarios can be generated by systematically analyzing and classifying different combinations of factors and elements of the sensor mechanism.

[0089] Among the factors of sensor disturbance, factors related to the vehicle and the sensor are classified into three categories: the vehicle itself 1, the sensor, and the sensor front. Factors related to the vehicle itself 1 include, for example, changes in vehicle attitude. Factors related to the sensor include, for example, mounting variations and malfunctions of the sensor itself. Factors related to the sensor front include attachments and changes in characteristics, and in the case of a camera, also include reflections. In relation to these factors, the influence of the sensor mechanism specific to each external environment sensor 41 can be assumed as recognition disturbances.

[0090] Among the factors of sensor disturbance, factors related to the external environment are classified into three categories: surrounding structures, space, and surrounding moving objects. The surrounding structures are classified into three categories: road surface, roadside structures, and upper structures based on their positional relationship with the vehicle 1. Road surface factors include, for example, shape, road surface condition, and material. Roadside structure factors include, for example, reflection, occlusion, and background. Upper structure factors include, for example, reflection, occlusion, and background. Space factors include, for example, spatial obstacles, radio waves in space, and light. Surrounding moving object factors include, for example, reflection, occlusion, and background. For these factors, the influence of the sensor mechanism specific to each external environment sensor can be assumed as recognition disturbance.

[0091] Among the factors of sensor disturbance, factors related to the sensor's recognition target can be broadly divided into four categories: the driving route, traffic information, road obstacles, and moving objects.

[0092] A lane is classified into a division line, a tall structure, and a road edge based on the structure of the object that displays the lane. A road edge is classified into a road edge without a step and a road edge with a step. Factors of a division line include, for example, color, material, shape, dirt, scratches, and relative position. Factors of a tall structure include, for example, color, material, dirt, and relative position. Factors of a road edge without a step include, for example, color, material, dirt, and relative position. Factors of a road edge with a step include, for example, color, material, dirt, and relative position. For these factors, the influence according to the sensor mechanism specific to each external environment sensor can be assumed as a recognition disturbance.

[0093] Traffic information is classified into signals, signs, and road markings based on the display format. Factors of signals are, for example, color, material, shape, light source, dirt, and relative position. Factors of signs are, for example, color, material, shape, light source, dirt, and relative position. Factors of road markings are, for example, color, material, shape, dirt, and relative position. For these factors, the influence of the sensor mechanism specific to each external environment sensor 41 can be assumed as recognition disturbance.

[0094] Road obstacles are classified into fallen objects, animals, and installed objects based on the presence or absence of movement and the degree of impact if they collide with the vehicle 1. Factors of fallen objects include, for example, color, material, shape, size, relative position, and behavior. Factors of animals include, for example, color, material, shape, size, relative position, and behavior. Factors of installed objects include, for example, color, material, shape, size, dirt, and relative position. For these factors, the influence according to the sensor mechanism specific to each external environment sensor 41 can be assumed as recognition disturbance.

[0095] Based on the type of traffic participant, moving objects are classified into other vehicles, motorcycles, bicycles, and pedestrians. Factors of other vehicles are, for example, color, material, paint, surface properties, attachments, shape, size, relative position, and behavior. Factors of motorcycles are, for example, color, material, attachments, shape, size, relative position, and behavior. Factors of bicycles are, for example, color, material, attachments, shape, size, relative position, and behavior. Factors of pedestrians are, for example, color and material of what they are wearing, posture, shape, size, relative position, and behavior. For these factors, the influence according to the sensor mechanism specific to each external environment sensor 41 can be assumed as recognition disturbance.

[0096] The sensor mechanism that generates the recognition disturbance is classified into the recognition process and others. The disturbance that occurs in the recognition process is classified into the disturbance related to the signal from the recognition object and the disturbance that inhibits the signal from the recognition object. The disturbance that inhibits the signal from the recognition object is, for example, noise and unnecessary signals.

[0097] In particular, in camera recognition processing, physical quantities that characterize the signal of the recognition target object are, for example, intensity, direction, range, signal change, acquisition time, etc. Noise and unnecessary signals can be low contrast or high noise.

[0098] In particular, in the recognition process of LiDAR, physical quantities that characterize the signal of the recognition target are, for example, scan timing, intensity, propagation direction, and speed. Noise and unnecessary signals are, for example, DC noise, pulse noise, multiple reflections, and reflection or refraction from objects other than the recognition target.

[0099] In particular, for millimeter-wave radar, disturbances classified as "other" include disturbances due to the orientation of the sensor. In the recognition process of millimeter-wave radar, physical quantities that characterize the signal of the recognition target are, for example, frequency, phase, and intensity. Noise and unwanted signals are, for example, small signal loss due to circuit signals, phase noise components of unwanted signals, signal burial due to radio interference, and unwanted signals from sources other than the recognition target.

[0100] Blind spot scenarios are classified into three categories: surrounding vehicles, road structure, and road shape. In the surrounding vehicle blind spot scenario, the surrounding vehicle may induce blind spots that affect other vehicles. Therefore, the positions of the surrounding vehicles may be based on an extended definition that extends the surrounding eight adjacent positions. In the surrounding vehicle blind spot scenario, the possible blind spot vehicle movements are classified into cut-in, cut-out, acceleration, deceleration, and synchronization.

[0101] The blind spot scenarios due to road structures are defined by taking into consideration the positions of road structures and the relative movement patterns between the vehicle 1 and other vehicles present in the blind spot or other virtual vehicles assumed to be in the blind spot. The blind spot scenarios due to road structures are classified into blind spot scenarios due to external barriers and blind spot scenarios due to internal barriers. For example, external barriers cause blind spot areas on curves.

[0102] Blind spot scenarios due to road shape are classified into longitudinal gradient scenarios and adjacent lane gradient scenarios. The longitudinal gradient scenario generates blind spot areas in either or both of the front and rear of the vehicle 1. The adjacent lane gradient scenario generates blind spot areas due to the difference in elevation between adjacent lanes at merging roads, branching roads, etc.

[0103] Communication disturbance scenarios are classified into three categories: sensor, environment, and transmitter. Sensor-related communication disturbances are classified into map factors and V2X factors. Environment-related communication disturbances are classified into static entities, spatial entities, and dynamic entities. Transmitter-related communication disturbances are classified into other vehicles, infrastructure facilities, pedestrians, servers, and satellites.

[0104] Next, the vehicle motion disturbance scenario system will be described. Vehicle motion disturbance scenarios are classified into two categories: vehicle body input and tire input. Vehicle body input is an input in which an external force acts on the vehicle body and affects the motion in at least one of the longitudinal, lateral, and yaw directions. Elements that affect the vehicle body are classified into road shape and natural phenomena. Road shape includes, for example, superelevation of curved sections, longitudinal gradient, curvature, etc. Natural phenomena include, for example, crosswind, tailwind, headwind, etc.

[0105] A tire input is an input that changes tire-generated forces and affects motion in at least one of the following directions: longitudinal, lateral, up-down, and yaw. Factors that affect tires are classified into road conditions and tire conditions.

[0106] The road surface condition is, for example, the coefficient of friction between the road surface and the tire, the external force on the tire, etc. Here, the road surface factors that affect the coefficient of friction are classified, for example, into wet roads, frozen roads, snow-covered roads, partial gravel, road markings, etc. The road surface factors that affect the external force on the tire are, for example, potholes, protrusions, steps, ruts, joints, grooving, etc. The tire condition is, for example, punctures, bursts, tire wear, etc.

[0107] The scenario DB 53 may include at least one of a functional scenario, a logical scenario, and a concrete scenario. A functional scenario defines a top-level qualitative scenario structure. A logical scenario is a scenario in which a quantitative parameter range is assigned to a structured functional scenario. A concrete scenario defines a boundary of a safety judgment that distinguishes between a safe state and an unsafe state.

[0108] The unsafe state is, for example, a hazardous situation. Moreover, the range corresponding to the safe state may be referred to as a safe range, and the range corresponding to the unsafe state may be referred to as an unsafe range. Furthermore, a condition that contributes to a dangerous behavior of the host vehicle 1 in a scenario or an inability to prevent, detect, and mitigate a reasonably foreseeable misuse may be a trigger condition.

[0109] Scenarios can be classified as known or unknown and as hazardous or non-hazardous, i.e., known hazardous scenarios, known non-hazardous scenarios, unknown hazardous scenarios and unknown non-hazardous scenarios.

[0110] The scenario DB 53 may be used for making judgments regarding the environment in the driving system 2 as described above, and may also be used for verification and validation of the driving system 2. The method for verifying and validating the driving system 2 may be rephrased as a method for evaluating the driving system 2.

[0111] <Safety and Security> The driving system 2 estimates the situation and controls the behavior of the vehicle 1. The driving system 2 is configured to avoid accidents and dangerous situations that could lead to accidents as much as possible and maintain a safe situation or safety. A dangerous situation may be caused as a result of the maintenance state of the vehicle 1 or a malfunction of the driving system 2. A dangerous situation may also be caused by external factors such as other road users. The driving system 2 is configured to maintain safety by reacting to an event in which a safe situation cannot be maintained due to an external factor such as other road users and changing the behavior of the vehicle 1.

[0112] The driving system 2 has a control performance for stabilizing the behavior of the host vehicle 1 to a safe state. The safe state depends not only on the behavior of the host vehicle 1 but also on the situation. If it is not possible to control the behavior of the host vehicle 1 to be stable to a safe state, the driving system 2 behaves to minimize the harm or risk of an accident. Here, the harm of an accident may mean the damage or the magnitude of the damage caused to traffic participants (road users) when a collision occurs. The risk may be based on the magnitude and likelihood of the harm, or may be, for example, the product of the magnitude and likelihood of the harm.

[0113] A behavior or the best way to derive the behavior that minimizes the harm or risk of an accident may be referred to as best effort. Best effort may include best effort that the automated driving system can guarantee to minimize the severity or risk of an accident (hereinafter, best effort that can guarantee minimal risk). Guaranteed best effort may refer to minimal risk maneuver (MRM) or DDT fallback. Best effort may include best effort that cannot guarantee to minimize the harm or risk of an accident, but attempts to reduce and minimize the severity or risk of an accident as far as possible under control (hereinafter, best effort that cannot guarantee minimal risk).

[0114] FIG. 4 illustrates a control state space SP that spatially represents the control state of the vehicle. The driving system 2 may have a control performance that stabilizes the behavior of the vehicle 1 within a range that has a margin on the safe side of the performance limit of the system that can ensure safety. The performance limit of the system that can ensure safety may be the boundary between a safe state and an unsafe state, that is, the boundary between a safe range and an unsafe range. The operational design domain (ODD) of the driving system 2 is typically set within a performance limit range R2, and more preferably outside the stable controllable range R1.

[0115] A range with a margin on the safe side of the performance limit may be referred to as a stable range. In the stable range, the driving system 2 can maintain a safe state with nominal operation as designed. A state in which a safe state can be maintained with nominal operation as designed may be referred to as a stable state. A stable state can provide "usual peace of mind" to passengers and the like. Here, the stable range may be referred to as a stable controllable range R1 in which stable control is possible.

[0116] Furthermore, outside the stable controllable range R1 and within the performance limit range R2, the driving system 2 can return control to a stable state on the premise that environmental assumptions are met. These environmental assumptions may be, for example, reasonably foreseeable assumptions. For example, the driving system 2 can change the behavior of the vehicle 1 in response to reasonably foreseeable behavior of road users, etc., to avoid falling into a dangerous situation, and return to stable control again. A state in which control can be returned to a stable state can provide "safety in case of an emergency" to occupants, etc.

[0117] In the operation system 2, the judgment unit 20 may judge whether to continue stable control or to transition to a minimal risk condition (MRC) within the performance limit range R2 (in other words, before going outside the performance limit range R2). The minimal risk condition may be a fallback condition. The judgment unit 20 may judge whether to continue stable control or to transition to a minimal risk condition outside the stable controllable range R1 and within the performance limit range R2. The transition to the minimal risk condition may be execution of MRM or DDT fallback.

[0118] Also, for example, when the autonomous driving of a level 3 autonomous driving system is being performed, the determination unit 20 may transfer authority to the driver, for example, execute takeover. When the driving is not handed over from the autonomous driving system to the driver, control for executing MRM or DDT fallback may be adopted.

[0119] The determination unit 20 may determine a state transition of the driving behavior based on the situation estimated by the environment determination unit 21. The state transition of the driving behavior may mean a transition regarding the behavior of the vehicle 1 realized by the driving system 2, for example, a transition between a behavior that maintains consistency and predictability of rules and a reactive behavior of the vehicle 1 according to external factors such as other road users. That is, the state transition of the driving behavior may be a transition between an action and a reaction. In addition, the determination of the state transition of the driving behavior may be a determination of whether to continue stable control or to move to a minimum risk condition. Stable control may mean a state in which the behavior of the vehicle 1 does not have sway, sudden acceleration, sudden braking, etc., or the occurrence frequency is extremely low. Stable control may mean a level of control at which a human driver recognizes the behavior of the vehicle 1 as stable or normal.

[0120] The situation estimated by the environment determination unit 21, i.e., the situation estimated by the electronic system, may include a difference from the real world. Therefore, the performance limit of the driving system 2 may be set based on an allowable range of the difference from the real world. In other words, the margin between the performance limit range R2 and the stable controllable range R1 may be defined based on the difference between the situation estimated by the electronic system and the real world. Here, the difference between the situation estimated by the electronic system and the real world may be an example of an influence or error due to a disturbance.

[0121] Here, the situation used to determine whether to transition to the minimum risk condition may be recorded in the recording device 55, for example, in a format estimated by the electronic system. In the MRM or DDT fallback, for example, when there is an interaction between the electronic system and the driver through the HMI device 70, the operation of the driver may be recorded in the recording device 55.

[0122] <Interaction in driving systems> The architecture of the driving system 2 can be represented by an abstraction layer, a physical interface layer (hereinafter, physical IF layer), and the relationship with the real world. Here, the abstraction layer and the physical IF layer may mean a layer composed of an electronic system. As shown in Fig. 5, the interaction of the recognition unit 10, the judgment unit 20, and the control unit 30 can be represented by a block diagram showing a causal loop.

[0123] In detail, the vehicle 1 in the real world affects the external environment EE. The recognition unit 10 belonging to the physical IF layer recognizes the vehicle 1 and the external environment EE. The recognition unit 10 may generate errors or deviations due to erroneous recognition, observation noise, recognition disturbance, and the like. The errors or deviations generated in the recognition unit 10 affect the judgment unit 20 belonging to the abstraction layer. Also, on the premise that the control unit 30 acquires the vehicle state for controlling the motion actuator 60, the errors or deviations generated in the recognition unit 10 directly affect the control unit 30 belonging to the physical IF layer without passing through the judgment unit 20. The judgment unit 20 may generate judgment errors, traffic disturbances, and the like. The errors or deviations generated in the judgment unit 20 affect the control unit 30 belonging to the physical IF layer. When the control unit 30 controls the motion of the vehicle 1, vehicle motion disturbances occur. Also, the vehicle 1 in the real world affects the external environment EE, and the recognition unit 10 recognizes the vehicle 1 and the external environment EE.

[0124] In this way, the driving system 2 forms a causal loop structure that crosses each layer. Furthermore, it forms a causal loop structure that travels between the real world, the physical IF layer, and the abstract layer. Errors or deviations that occur in the recognition unit 10, the judgment unit 20, and the control unit 30 can propagate along the causal loop.

[0125] Causal loops are classified into open loops and closed loops. An open loop can be said to be a partial loop that is a part of a closed loop. An open loop is, for example, a loop composed of the recognition unit 10 and the judgment unit 20, or a loop composed of the judgment unit 20 and the control unit 30.

[0126] The closed loop is a loop configured to circulate between the real world and at least one of the physical IF layer and the abstraction layer. The closed loop is classified into an inner loop IL that is completed in the host vehicle 1, and an outer loop EL that includes the interaction between the host vehicle 1 and the external environment EE.

[0127] 6, the inner loop IL is a loop that returns to the host vehicle 1 via the recognition unit 10 and the control unit 30. As described above, the parameters that directly affect the control unit 30 from the recognition unit 10 are, under one assumption, vehicle conditions such as vehicle speed, acceleration, and yaw rate, and do not include the recognition results of the external environment sensor 41. Therefore, the inner loop IL can be said to be a loop that is completed at the host vehicle 1. The outer loop EL is a loop that returns to the host vehicle 1 via the external environment EE, the recognition unit 10, the determination unit 20, and the control unit 30, for example, in FIG.

[0128] <Verification and validation> The verification and validation of the operational system 2 may include an evaluation of at least one, and preferably all, of the following functions and capabilities. The evaluation targets here may also be referred to as verification targets or validation targets.

[0129] For example, relevant evaluation objects for the perceiving unit 10 are the functionality of sensors or external data sources (eg map data sources), the functionality of sensor processing algorithms which model the environment, and the reliability of infrastructure and communication systems.

[0130] For example, the evaluation target related to the judgment unit 20 is the capability of the decision algorithm. The capability of the decision algorithm is the capability of safely handling potential functional deficiencies, and the capability of making appropriate decisions according to the environment model, the driving policy, the current destination, etc. Also, for example, the evaluation targets related to the judgment unit 20 are the absence of unreasonable risks due to dangerous behavior of the intended functions, the capability of the system to safely handle the use cases of the ODD, the robust performance of the execution of the driving policy across the ODD, the suitability of the DDT fallback, and the suitability of the minimum risk condition.

[0131] For example, the evaluation target may be the robust performance of a system or function, such as the robust performance of the system against adverse environmental conditions, the appropriateness of the system's operation against known trigger conditions, the sensitivity of the intended function, the monitoring capability against various scenarios, etc.

[0132] Next, several examples of the evaluation method of the driving system 2 will be specifically described with reference to Figs. 8 to 13. The evaluation method here may be a configuration method of the driving system 2 or a design method of the driving system 2. In Figs. 8, 10, and 12 below, each circle A1, A2, and A3 virtually and diagrammatically shows an area where safety cannot be maintained due to factors of the recognition unit 10, the judgment unit 20, and the control unit 30, respectively.

[0133] 8, the first evaluation method is a method of independently evaluating the recognition unit 10, the judgment unit 20, and the control unit 30. That is, the first evaluation method includes individually evaluating the nominal performance of the recognition unit 10, the nominal performance of the judgment unit 20, and the nominal performance of the control unit 30. The individual evaluation may mean evaluating the recognition unit 10, the judgment unit 20, and the control unit 30 based on different viewpoints and means.

[0134] For example, the control unit 30 may be evaluated based on a control theory. The judgment unit 20 may be evaluated based on a logical model that demonstrates safety. The logical model may be a Responsibility Sensitive Safety (RSS) model, a Safety Force Field (SFF) model, or the like.

[0135] The recognition unit 10 may be evaluated based on the recognition failure rate. For example, the evaluation criterion may be whether or not the recognition result of the entire recognition unit 10 is equal to or lower than a target recognition failure rate. The target recognition failure rate for the entire recognition unit 10 may be a value smaller than a statistically calculated collision accident occurrence rate caused by a human driver. The target recognition failure rate may be, for example, 10-9, which is a probability two orders of magnitude lower than the accident occurrence rate. The recognition failure rate here is a value normalized to be 1 when 100% failure occurs.

[0136] Furthermore, when multiple subsystems (e.g., a camera subsystem, an external environment sensor 41 subsystem excluding the camera, and a map subsystem) are configured by multiple sensors 40, the reliability may be ensured by majority vote of the multiple subsystems. When the majority vote of the subsystems is assumed, the target recognition failure rate for each subsystem may be a value larger than the target recognition failure rate of the entire recognition unit 10. The target recognition failure rate for each subsystem may be, for example, 10-5. In the first evaluation method, a target value or a target condition may be set based on a positive risk balance.

[0137] An example of the first evaluation method will be described with reference to the flowchart of Fig. 9. The implementing entity of each step of S11 to 13 is, for example, at least one of the following entities: the manufacturer of the vehicle, the designer of the vehicle, the manufacturer of the driving system 2, the designer of the driving system 2, the manufacturer of a subsystem constituting the driving system 2, the designer of the subsystem, a party commissioned by these manufacturers or designers, a testing organization or a certification organization for the driving system 2, etc. In the case where the evaluation is performed by simulation, the substantial implementing entity may be at least one processor. In each step of S11 to 13, the implementing entities may be the same entity or different entities.

[0138] In S11, the nominal performance of the recognition unit 10 is evaluated. In S12, the nominal performance of the determination unit 20 is evaluated. In S13, the nominal performance of the control unit 30 is evaluated. The order of S11 to S13 can be changed as appropriate, and they can be performed simultaneously.

[0139] 10, the second evaluation method includes evaluating the nominal performance of the judgment unit 20 and evaluating the robust performance of the judgment unit 20 by considering at least one of the error of the recognition unit 10 and the error of the control unit 30. As a premise of this evaluation method, the evaluation may further include evaluating the nominal performance of the recognition unit 10 and evaluating the nominal performance of the control unit 30. The nominal performance of the judgment unit 20 may be evaluated based on the above-mentioned traffic disturbance scenario.

[0140] The robust performance of the judgment unit 20 may be evaluated by verifying a traffic disturbance scenario in which an error range is specified using a physics-based error model that represents an error of the recognition unit 10, such as an error of a sensor. For example, a traffic disturbance scenario is evaluated under an environmental condition in which a recognition disturbance occurs. In this way, the second evaluation method can include an area A12 in which the circle A1 of the recognition unit 10 and the circle A2 of the judgment unit 20 overlap, in other words, a complex factor of the recognition unit 10 and the judgment unit 20, as an evaluation target. The evaluation of the complex factor of the recognition unit 10 and the judgment unit 20 may be realized by an open-loop evaluation that goes directly from the recognition unit 10 to the judgment unit 20 in the above-mentioned causal loop.

[0141] The robust performance of the determination unit 20 may be evaluated by verifying a traffic disturbance scenario in which an error range is specified using a physics-based error model that represents an error of the control unit 30, such as an error of vehicle motion. For example, a traffic disturbance scenario is evaluated under an environmental condition in which a vehicle motion disturbance occurs. In this way, the second evaluation method can include an area A23 in which the circle A2 of the determination unit 20 and the circle A3 of the control unit 30 overlap, in other words, a combined factor of the determination unit 20 and the control unit 30, as an evaluation target. The evaluation of the combined factor of the determination unit 20 and the control unit 30 may be realized by an open-loop evaluation that goes directly from the determination unit 20 to the control unit 30 in the above-mentioned causal loop.

[0142] An example of the second evaluation method will be described with reference to the flowchart of Fig. 11. The implementing entity of S21 to 24 is, for example, at least one of the following entities: the manufacturer of the vehicle, the designer of the vehicle, the manufacturer of the driving system 2, the designer of the driving system 2, the manufacturer of a subsystem constituting the driving system 2, the designer of the subsystem, a party commissioned by these manufacturers or designers, a testing agency or a certification agency for the driving system 2, etc. In the case where the evaluation is performed by simulation, the substantial implementing entity may be at least one processor. In each step of S21 to 24, the implementing entities may be the same entity or different entities.

[0143] In S21, the nominal performance of the recognition unit 10 is evaluated. In S22, the nominal performance of the control unit 30 is evaluated. In S23, the nominal performance of the judgment unit 20 is evaluated. In S24, the robust performance of the judgment unit 20 is evaluated taking into account the error of the recognition unit 10 and the error of the control unit 30. The order of S21 to S24 can be changed as appropriate, and they can also be performed simultaneously.

[0144] As shown in Fig. 12, the third evaluation method includes areas A12, A23, A13, and AA where at least two of the circle A1 of the recognition unit 10, the circle A2 of the judgment unit 20, and the circle A3 of the control unit 30 overlap as evaluation targets. The third evaluation method includes first evaluating the nominal performance of the recognition unit 10, the nominal performance of the judgment unit 20, and the nominal performance of the control unit 30. The evaluation of the nominal performance may employ the first evaluation method itself, or a part of the first evaluation method. On the other hand, the evaluation of the nominal performance may employ a method completely different from the first evaluation method.

[0145] Furthermore, the third evaluation method includes a focused evaluation of the robust performance of the recognition unit 10, the robust performance of the judgment unit 20, and the robust performance of the control unit 30 on a composite factor in which at least two of the recognition unit 10, the judgment unit 20, and the control unit 30 are combined. Here, the composite factor in which at least two of the recognition unit 10, the judgment unit 20, and the control unit 30 are a composite factor of the recognition unit 10 and the judgment unit 20, a composite factor of the judgment unit 20 and the control unit 30, a composite factor of the recognition unit 10 and the control unit 30, and three composite factors of the recognition unit 10, the judgment unit 20, and the control unit 30.

[0146] The focused evaluation of the complex factors may involve extracting a specific condition in which the interaction between the recognition unit 10, the judgment unit 20, and the control unit 30 is relatively large, for example, on a scenario basis, and evaluating the specific condition in more detail than other conditions in which the interaction is relatively small. The detailed evaluation may include at least one of evaluating the specific condition in more detail than other conditions and evaluating it by increasing the number of tests. The conditions to be evaluated (for example, the specific condition and other conditions) may include a trigger condition. Here, the magnitude of the interaction may be identified using the causal loop described above.

[0147] Some of the above-mentioned evaluation methods may include defining an evaluation target, designing a test plan based on the definition of the evaluation target, and executing the test plan to show the absence of unreasonable risks due to known or unknown dangerous scenarios. The test may be any of a physical test, a simulation test, and a combination of a physical test and a simulation test. The physical test may be, for example, a Field Operational Test (FOT). The target value in the FOT may be set in the form of an allowable number of failures for a predetermined driving distance (for example, tens of thousands of km) of the test vehicle using FOT data or the like.

[0148] An example of the third evaluation method will be described with reference to the flowchart of Fig. 13. The implementing entity of S31 to S34 is, for example, at least one of the following entities: the manufacturer of the vehicle, the designer of the vehicle, the manufacturer of the driving system 2, the designer of the driving system 2, the manufacturer of a subsystem constituting the driving system 2, the designer of the subsystem, a party commissioned by these manufacturers or designers, a testing organization or a certification organization for the driving system 2, etc. In the case where the evaluation is performed by simulation, the substantial implementing entity may be at least one processor. In each step of S31 to S34, the implementing entities may be the same entity or different entities.

[0149] In S31, the nominal performance of the recognition unit 10 is evaluated. In S32, the nominal performance of the judgment unit 20 is evaluated. In S33, the nominal performance of the control unit 30 is evaluated. In S34, the robust performance is evaluated with a focus on the composite regions A12, A23, A13, and AA. The order of S31 to S34 can be changed as appropriate, and they can be performed simultaneously.

[0150] <Evaluation strategy for driving systems> The evaluation strategy of the driving system 2 includes a pre-evaluation strategy and a post-evaluation strategy. The pre-evaluation strategy may include selecting an optimal method for improving or ensuring at least one of the performance and the validity of the driving system 2 from a plurality of evaluation methods, such as the above-mentioned first evaluation method, second evaluation method, third evaluation method, and other evaluation methods.

[0151] The pre-evaluation strategy may be a strategy of independently evaluating each of the recognition unit 10, the decision unit 20, and the control unit 30, as shown in the first evaluation method. This strategy can be realized by an approach of evaluating nominal performance in an open loop.

[0152] The pre-evaluation strategy may be a strategy that focuses on evaluating the combined factors resulting from the combination of the recognition unit 10 and the judgment unit 20 and the combined factors resulting from the combination of the judgment unit 20 and the control unit 30, as shown in the second evaluation method. This strategy can be realized by including an approach to evaluate robustness performance in an open loop.

[0153] The pre-evaluation strategy may be a strategy that focuses on evaluating a composite factor resulting from a combination of the control unit 30 and the recognition unit 10 and a composite factor resulting from a combination of the recognition unit 10, the judgment unit 20, and the control unit 30. This strategy can be realized by including an approach of evaluating robust performance by a closed loop in the embodiment of the third evaluation method. More specifically, the evaluation of the composite factor resulting from the combination of the control unit 30 and the recognition unit 10 can be realized by evaluating the composite factor in an inner loop IL that is completed in the host vehicle 1. The evaluation of the composite factor resulting from the combination of the recognition unit 10, the judgment unit 20, and the control unit 30 can be realized by evaluating the composite factor in an outer loop EL that includes the interaction between the host vehicle 1 and the external environment EE.

[0154] In the following, several specific examples will be described in detail regarding an evaluation method for evaluating robust performance by a closed loop, a design method for the driving system 2 using this evaluation method, and further the driving system 2 realized by these.

[0155] <Assign confidence level / assign tolerance> The first design method is a design method that takes into consideration the division of responsibility among each subsystem (i.e., the recognition system 10a, the judgment system 20a, and the control system 30a) and is a design method based on the allocation of reliability to each subsystem. When evaluating multiple factors, it is preferable to use a unified index among each subsystem. The unified index is, for example, reliability.

[0156] Therefore, in this design method and the evaluation method used in the design, reliability can be newly introduced as an index for evaluating the control unit 30. Then, the idea of ​​probabilistic robust control is introduced, in which the driving system 2 sets the allowable error to ε or less with a probability equal to or greater than the reliability (1-δ). This idea of ​​probabilistic robust control may be an example of an operation policy. In this way, when using evaluation based on a combination of reliability and allowable error, it is possible to avoid the need to calculate the probability distribution of the error propagating through each of the recognition unit 10, the judgment unit 20, and the control unit 30. Therefore, the load in the evaluation can be reduced.

[0157] The reliability of the driving system 2 may be set based on technical or social grounds. For example, the reliability of the driving system 2 may be set to a value equal to or lower than a statistically calculated collision accident occurrence rate caused by a human driver.

[0158] In stochastic robust control, reliability has a greater impact on comfort than error. Error has a greater impact on safety than reliability. By separating reliability and error and evaluating them separately, comfort and safety in the driving system 2 can be optimized. Reliability is assigned to each subsystem based on the safety specifications required for the driving system 2. Therefore, the first design method based on reliability assignment can be said to be a top-down design method that attempts to break down the specifications of the driving system 2 as a whole into the specifications of each subsystem.

[0159] If the reliability required for the operation system 2 were used as the reliability of each subsystem, the performance required for each subsystem would be high. Therefore, by allocating the reliability of the operation system 2 to each subsystem, i.e., distributing the reliability, it is possible to avoid requiring excessive performance from each subsystem.

[0160] Here, an example of an evaluation method used in the first design method will be described with reference to the flowchart of Fig. 14. The implementing entity of S101 to 104 is, for example, at least one of the following entities: the manufacturer of the vehicle, the designer of the vehicle, the manufacturer of the driving system 2, the designer of the driving system 2, the manufacturer of a subsystem constituting the driving system 2, the designer of the subsystem, a person commissioned by these manufacturers or designers, a testing organization or a certification organization for the driving system 2, etc. When the evaluation is performed by simulation, the substantial implementing entity may be, for example, an evaluation device 81 or a design device 82 as shown in Fig. 15. In each step of S101 to 104, the implementing entities may be the same entity or different entities.

[0161] The evaluation device 81 includes at least one memory 81a and at least one processor 81b, and the at least one processor 81b executes a program stored in the memory 81a to realize an evaluation function. The memory 81a may be at least one type of non-transient real storage medium, such as a semiconductor memory, a magnetic medium, and an optical medium, which non-temporarily stores a program and data that can be read by a computer (which may be the processor 81b, for example). The processor 81b includes at least one type of core, such as a central processing unit (CPU), a graphics processing unit (GPU), and a reduced instruction set computer (RISC)-CPU. The evaluation device 81 may further include an interface that is connected to and can communicate with the driving system 2 or another computer provided outside the device that reproduces the architecture of the driving system 2 during evaluation. The evaluation device 81 may further include a scenario DB 53 used to define the premise of a simulation during evaluation.

[0162] The design device 82 includes at least one memory 82a and at least one processor 82b, and the at least one processor 82b executes a program stored in the memory 82a to realize a design function. The memory 82a may be at least one type of non-transient real storage medium, such as a semiconductor memory, a magnetic medium, or an optical medium, which non-temporarily stores a program and data that can be read by a computer (which may be the processor 82b, for example). The processor 82b includes at least one type of core, such as a central processing unit (CPU), a graphics processing unit (GPU), or a reduced instruction set computer (RISC)-CPU. The design function may include an evaluation function. Furthermore, the design device 82 may include an interface capable of communicating with another computer provided outside the device that reproduces the architecture of the driving system 2. Furthermore, the design device 82 may further include a scenario DB 53 used to define the premise of a simulation during evaluation. The memories 81a and 82a may be realized in the form of a storage medium that is provided independently outside the devices 81 and 82 and is configured to be readable by another computer.

[0163] In S101, interactions between each subsystem and the real world are modeled as a loop structure. Based on the architecture of the driving system 2 to be evaluated, for example, a causal loop spanning the abstraction layer, the physical IF layer, and the real world in Fig. 5 is modeled. The causal loop may be modeled in more detail to more faithfully reproduce the complexity of the architecture (see the example in Fig. 18).

[0164] As a result, at least one closed loop is identified. For example, two closed loops, an outer loop EL and an inner loop IL, are identified as shown in Figures 6 and 7. After S101, the process proceeds to S102.

[0165] In S102, reliability is introduced as a unified index for each subsystem. After S102, the process moves to S103.

[0166] In S103, errors occurring in each subsystem are identified. For example, as shown in FIG. 5, errors occurring due to erroneous recognition in the recognition unit 10, errors occurring due to misjudgment in the judgment unit 20, and errors occurring due to vehicle motion disturbance in the control unit 30 are identified. These errors may include errors based on quantitative errors and errors based on qualitative errors, as described below. These errors may be identified individually for each scenario based on the above-mentioned scenario-based approach. These errors may be identified based on a relationship with the ODD.

[0167] Furthermore, as shown in Fig. 16, for these errors, a boundary value ε of the error that has a probability of 1-δ corresponding to the reliability may be set in the probability density function representing the error distribution. After S103, the process proceeds to S104.

[0168] In S104, the closed loop identified in S101 is evaluated based on the reliability introduced in S102. If multiple closed loops are identified, evaluation may be performed for all of the closed loops. On the other hand, evaluation of some closed loops that are less influenced by the composite factors may be omitted.

[0169] The evaluation of the closed loop based on the reliability is, for example, evaluating the error propagating through the closed loop based on the probability robust control. That is, it can be evaluated that the error propagating through the closed loop falls within the allowable error with a probability equal to or higher than a predetermined reliability. This evaluation may be performed using the formulas 1 to 4 described later. A series of evaluations ends with S104. The order of S101 to S103 can be changed as appropriate, and they can be performed simultaneously.

[0170] Next, an example of the first design method will be described with reference to the flowchart in Fig. 17. The implementing entity of S111 to 114 may be, for example, the manufacturer of the vehicle, the designer of the vehicle, the manufacturer of the driving system 2, the designer of the driving system 2, the manufacturer of the subsystem constituting the driving system 2, the designer of the subsystem, or a person commissioned by these manufacturers or designers. The implementing entity may be the design device 82. In each step of S111 to 114, the implementing entities may be the same entity or different entities.

[0171] In S111, the overall specifications of the driving system 2 are determined. The overall specifications here may include the architecture of the entire driving system 2 based on the components that make up the driving system 2. The overall specifications do not need to include detailed specifications of the components of the subsystem, such as detailed specifications of a camera. After S111, proceed to S112.

[0172] In S112, a reliability is assigned to each of the subsystems, that is, the recognition system 10a, the judgment system 20a, and the control system 30a, based on the overall specifications of the driving system 2 determined in S111. The reliability may be assigned as a uniform fixed value independent of the ODD, scenario, etc. This assignment may be called a static assignment.

[0173] On the other hand, an individual value may be assigned to each assignment category such as ODD and scenario. This assignment may be called dynamic assignment. For example, if excessive reliability is required for the recognition system 10a in the recognition disturbance scenario, the external environment sensor 41 is required to have extremely high performance as a specification, which leads to an increase in the cost of the driving system 2. For this reason, in the recognition disturbance scenario, an assignment may be made such that the reliability of the recognition system 10a is reduced and the reliability of the judgment system 20a and the control system 30a is increased accordingly.

[0174] The allocation category may be further subdivided. For example, in a communication disturbance scenario among the recognition disturbance scenarios, the information in the map DB 44 may not be updated to the latest information. In this case, it is difficult to assign excessive reliability to the map DB 44. Therefore, the allocation may be changed so that the reliability assigned to the map DB 44 is reduced and the reliability assigned to other external environment sensors 41 such as a camera, or the determination system 20a and the control system 30a is increased. After S112, the process proceeds to S113.

[0175] In S113, the error distribution or allowable error for each subsystem is calculated based on the reliability assigned in S112. The error distribution or allowable error may be calculated using the closed-loop evaluation method shown in S101 to S104. After S113, the process proceeds to S114.

[0176] In S114, the specifications of each subsystem are determined based on the error distribution or the allowable error calculated in S113. That is, each subsystem is designed so as to achieve the error distribution or the allowable error allowed for each subsystem. The series of processes ends with S114.

[0177] The second design method is a design method using the sensitivity of the driving system 2, which is based on the allocation of a tolerance to each subsystem. This design method includes evaluating the propagating error in the causal loop structure shown in Figs.

[0178] For example, the causal loop structure in Fig. 18 is a more specific version of the causal loop structure in Fig. 5. A self-location estimation block 10y in Fig. 18 corresponds to the self-location recognition unit 12 and the internal recognition unit 14 in the recognition unit 10. An object recognition / path recognition block 10x corresponds to the external recognition unit 11 and the fusion unit 13 in the recognition unit 10. An action plan / trajectory generation block 20x corresponds to the judgment unit 20. A position control / attitude control block 30x corresponds to the motion control unit 31 in the control unit 30.

[0179] In this causal loop structure, there is also an inner loop IL that is completed in the host vehicle 1 among the closed loops, and an outer loop EL that includes an interaction between the host vehicle 1 and the external environment EE. The inner loop IL shown in Fig. 19 is a loop that returns from the host vehicle 1 to the host vehicle 1 via the self-location estimation block 10y and the position control / attitude control block 30x. The outer loop EL shown in Fig. 20 is a loop that returns from the host vehicle 1 to the host vehicle 1 via the external environment EE, the object recognition / road recognition block 10x, the action plan / trajectory generation block 20x, and the position control / attitude control block 30x.

[0180] 21, in an actual vehicle, there is a closed loop (hereinafter referred to as a vehicle body stabilization loop SL) that occurs in the vehicle body of the vehicle 1 or between the vehicle body of the vehicle 1 and the control unit 30. The vehicle body stabilization loop SL can be realized by stabilizing the vehicle body by, for example, motor control in the powertrain, suspension control, or the like.

[0181] As shown in FIG. 18, various errors may be input into the causal loop. In the object recognition / roadway recognition block 10x, an error classified as erroneous recognition may occur. In the self-localization block 10y, an error classified as observation noise may occur. In the action plan / trajectory generation block 20x, an error classified as misjudgment may occur. In the position control / attitude control block 30x, an error classified as vehicle motion disturbance may occur. Note that the misrecognition and observation noise may be replaced with the above-mentioned recognition disturbance. The misjudgment may be replaced with the above-mentioned traffic disturbance.

[0182] As shown in FIG. 22, examples of the subject of erroneous recognition include object recognition and lane recognition. Quantitative errors in erroneous recognition include, for example, errors in object position and speed. Qualitative errors in erroneous recognition include, for example, non-detection, false detection, and misinterpretation. Examples of the subject of observation noise include self-location estimation. Quantitative errors in observation noise include, for example, errors in self-location and attitude.

[0183] The subject of the misjudgment is the action plan and the trajectory generation. The quantitative error in the misjudgment is, for example, an error in the target trajectory. The qualitative error in the misjudgment is, for example, an error in the selection of the scenario or the selection of the mode.

[0184] The subject of the vehicle motion disturbance is the position control and the attitude control. A quantitative error in the vehicle motion disturbance is, for example, an error in the control input.

[0185] A quantitative error can be expressed as an error directly by a numerical value that corresponds to a physical quantity. Furthermore, a quantitative error can be evaluated by the probability that the error falls within the allowable error. The probability here corresponds to the reliability.

[0186] On the other hand, qualitative errors can be expressed as errors by true or false (T / F) or discrete values ​​such as 1 or 0. Errors expressed in this way are statistically collected and processed for each event, and as a result, they directly represent the reliability. Note that qualitative errors in observation noise and qualitative errors in vehicle motion disturbances do not need to be taken into consideration. If an unknown qualitative error is discovered, the error can be evaluated using the reliability in the same way as other qualitative errors.

[0187] Here, assuming that each subsystem can be linearized, the sensitivity to various errors is considered using a sensitivity function and a complementary sensitivity function. For example, as shown in Fig. 18, the transfer functions from the target value to the output in each block in the causal loop are P for the vehicle 1, E for the external environment EE, L for the self-localization block 10y, S for the object recognition / road recognition block 10x, D for the action planning / trajectory generation block 20x, and K for the position control / attitude control block 30x.

[0188] In the following, the term "error" is used to mean a value obtained by quantifying an error, and the term "deviation" is used to mean a difference between a target value and an output value that appears in the operation system 2 due to an error.

[0189] However, when the context does not distinguish between error and deviation, the error may refer to a concept including a value obtained by quantifying an error and a difference between a target value and an output value that appears in the operation system 2 due to the value obtained by quantifying an error.

[0190] If the error due to vehicle motion disturbance is d, the resulting deviation from the target value can be expressed as in Equation 1 below.

[0191]

number

[0192] If the error due to misrecognition is m, the resulting deviation from the target value can be expressed as Equation 2 below.

[0193]

number

[0194]

number

[0195]

number

[0196] The transfer function E of the external environment EE may be set based on a combination with the transfer function D of the action plan. For example, in the above-mentioned traffic disturbance scenario, expressing an interaction between a certain action or reaction of the host vehicle 1 and an external factor such as another road user as a function may substantially correspond to setting the transfer function E of the external environment EE.

[0197] In addition, the transfer function E of the external environment EE may be set according to the assumption that external factors such as other road users act or react based on reasonably foreseeable assumptions, for example following safety-related models.

[0198] On the other hand, it is preferable to set the transfer function E of the external environment EE and the transfer function D of the action plan as separate and independent functions.

[0199] There are errors that may occur in each subsystem due to specifications or technology. When the allowable deviation e_max allowed for the entire operation system 2 is determined, the allocation is adjusted again so that these errors d, m, n, j do not exceed the maximum allowable errors d_max, m_max, n_max, j_max calculated from the deviations allocated to each subsystem using formulas 1 to 4. Therefore, the second design method based on error allocation can be said to be a bottom-up design method in which the specifications of the entire operation system 2 are adjusted after the specifications of each subsystem are determined.

[0200] Here, an example of an evaluation method used in the first design method will be described with reference to the flowchart of Fig. 23. The implementing entity of S121 to 124 is, for example, at least one of the following entities: the manufacturer of the vehicle, the designer of the vehicle, the manufacturer of the driving system 2, the designer of the driving system 2, the manufacturer of a subsystem constituting the driving system 2, the designer of the subsystem, a person commissioned by these manufacturers or designers, a testing organization or a certification organization for the driving system 2, etc. When the evaluation is performed by simulation, the substantial implementing entity may be, for example, an evaluation device 81 or a design device 82 as shown in Fig. 15. In each step of S121 to 124, the implementing entities may be the same entity or different entities.

[0201] In S121, the interaction between each subsystem and the real world is modeled as a loop structure in the same manner as in S101. This identifies at least one closed loop. After S121, the process moves to S122.

[0202] In S122, the allowable deviation e_max permitted for the entire driving system is specified. After S122, the process proceeds to S123.

[0203] In S123, an error occurring in response to each subsystem is identified. The method of identifying the error here varies depending on the intent and purpose of the evaluation. For example, when it is desired to evaluate a deviation occurring in the driving system 2 in the current subsystem specifications or performance, an error is set based on the current subsystem specifications or performance.

[0204] In S124, the closed loop identified in S121 is evaluated based on the allowable deviation e_max identified in S122. When multiple closed loops are identified, evaluation may be performed for all of the closed loops. On the other hand, evaluation of some closed loops that are less influenced by the composite factors may be omitted. A series of evaluations ends with S124. The order of S121 to S123 may be changed as appropriate, and they may be performed simultaneously.

[0205] Next, an example of the second design method will be described with reference to the flowchart in Fig. 24. The implementing entity of S131 to 136 may be, for example, the manufacturer of the vehicle, the designer of the vehicle, the manufacturer of the driving system 2, the designer of the driving system 2, the manufacturer of the subsystem constituting the driving system 2, the designer of the subsystem, or a person commissioned by these manufacturers or designers. The actual implementing entity may be the design device 82. In each step of S131 to 136, the implementing entities may be the same entity or different entities.

[0206] In S131, each subsystem is tentatively designed. In each tentatively designed subsystem, an error based on each performance is identified. After S131, the process proceeds to S132.

[0207] In S132, the allowable deviation permitted by the entire driving system 2 is specified. This allowable deviation may be determined based on the specifications of the entire driving system 2. For example, the allowable deviation may be determined by calculating a safety margin backward from a positive risk balance. After S132, the process proceeds to S133.

[0208] In S133, an allowable deviation is provisionally assigned to each subsystem based on the allowable deviation of the entire driving system 2. Here, the provisional assignment may be an equal assignment to each subsystem. The equal assignment means that, of the allowable deviation of the entire driving system 2, the recognition system 10a is responsible for substantially 1 / 3 (33%), the judgment system 20a is responsible for substantially 1 / 3 (33%), and the control system 30a is responsible for substantially 1 / 3 (33%). In the case where the recognition system 10a is divided into an object recognition / path recognition block 10x and a self-localization block 10y as shown in FIG. 17, the deviation assigned to the recognition system 10a may be further distributed to the object recognition / path recognition block 10x and the self-localization block 10y.

[0209] If a certain degree of appropriate allocation has been found empirically, the allocation obtained empirically may be used provisionally. After S133, the process proceeds to S134.

[0210] In S134, the maximum allowable errors d_max, m_max, n_max, and j_max required for each subsystem can be calculated from the deviation allowed for each subsystem by inversely calculating each of the formulas 1 to 4 which express the error propagating through the closed loop. After S134, the process proceeds to S135.

[0211] In S135, it is determined for each subsystem whether the errors d, m, n, and j of each subsystem identified in S131 are within the maximum allowable errors d_max, m_max, n_max, and j_max provisionally assigned to that subsystem. If a positive determination is made for all subsystems, the allocation of the allowable errors for each system is confirmed and the series of processes ends. If a negative determination is made for at least one subsystem, the process proceeds to S136.

[0212] In S136, the allocation to each subsystem is adjusted, i.e., the adjustment is performed so that the allocation to the subsystem whose error exceeded the allowable error in S135 is increased and the allocation to the subsystem whose error fell within the allowable error is decreased.

[0213] For example, consider a case where each subsystem is provisionally assigned equally in S132. Assume that in S135, it is determined that the error of the recognition system 10a falls within the allowable error provisionally assigned to the recognition system 10a, and that the error of the control system 30a falls within the allowable error provisionally assigned to the control system 30a. On the other hand, it is determined in S135 that the error of the judgment system 20a exceeds the allowable error provisionally assigned to the judgment system 20a. In this case, adjustments may be made such as reducing the allocation to the recognition system 10a to, for example, 20%, increasing the allocation to the judgment system 20a to, for example, 60%, and reducing the allocation to the control system 30a to, for example, 20%. After S136, the process returns to S134.

[0214] By repeating the adjustments in S134 to 136, if an allocation solution is found in which the errors d, m, n, j occurring in all subsystems fall within the allowable errors d_max, m_max, n_max, and j_max, the allocation of the allowable errors for each subsystem can be determined at that point. On the other hand, if an allocation solution is not found in which the errors d, m, n, j occurring in all subsystems fall within the allowable errors d_max, m_max, n_max, and j_max, it is necessary to review the specifications of at least one subsystem. In other words, it is necessary to review the performance of the subsystem to a higher performance so as to reduce the occurring errors.

[0215] The first design method and the second design method may be selectively implemented. On the other hand, when the first design method and the second design method are implemented in combination, an operation system 2 with higher validity can be designed. For example, an operation system 2 in which both the allowable error and the reliability are optimized may be designed by performing an allocation of the reliability using the first design method after performing an allocation of the allowable error using the second design method. For example, an operation system 2 in which both the allowable error and the reliability are optimized may be designed by performing an allocation of the reliability using the first design method after performing an allocation of the allowable error using the second design method.

[0216] <Operation system realized by evaluating multiple factors> An operation system 2 designed by the design method described above, and in particular an operation system 2 that executes a processing method using assigned reliability, will be described.

[0217] The operation system 2 stores dynamic reliability allocation for each allocation category determined at the time of design. The storage medium (e.g., non-transitive substantial storage medium) storing the reliability allocation may be one or more. The storage medium may be the memory 51a included in the dedicated computer 51 of the processing system 50, the scenario DB 53, or the memory 55a of the recording device 55.

[0218] The driving system 2 changes the conditions for executing the driving dynamic task by referring to the reliability allocation for each allocation category. The allocation category is set based on the type of ODD use case, scenario, etc. In other words, while the host vehicle 1 is traveling, the reliability allocation in the driving system 2 changes dynamically according to the current situation of the host vehicle 1.

[0219] For example, the driving system 2 may determine which of the components of the driving system 2 is to be used as the main component for realizing the dynamic driving task, depending on the ODD, scenario, etc. That is, the driving system 2 may flexibly switch the combination of the components as the main component for realizing the dynamic driving task, depending on the ODD, scenario, etc. As the main component, some of the sensors 40 among the multiple sensors 40 that realize the recognition system 10a may be selected. The combination here is, for example, a combination of a camera, a map, and control, a combination of a millimeter wave radar, a map, and control, a combination of a camera, a millimeter wave radar, and control, etc.

[0220] For example, the driving system 2 may determine whether to plan a careful control action based on the product of the reliability of the recognition system 10a and the reliability of the control system 30a for the reliability assigned according to the ODD, scenario, etc. The driving system 2 may determine to plan a careful control action when the product value becomes smaller than a preset value. This preset value may be set according to at least one of the stable controllable range R1 and the performance limit range R2.

[0221] The conditions for executing the dynamic driving task may include conditions for the environment determination unit 21 to determine the environment. The environment determination unit 21 selects a scenario and refers to the allocation of the reliability corresponding to the scenario. The environment determination unit 21 may then interpret the environment model taking into account the reliability. For example, when a communication disturbance scenario is selected, in order to interpret the environment model to achieve the reliability assigned to the recognition system 10a corresponding to this scenario, the environment determination unit 21 may ensure the reliability of the recognition system 10a as a whole by interpreting the environment model under the premise that the contribution of the map and information acquired by V2X is reduced.

[0222] The conditions for executing the dynamic driving task may include conditions for the driving planner 22 to determine a behavior plan and a trajectory plan. The driving planner 22 may determine the behavior plan and the trajectory plan in consideration of the allocation of reliability according to the scenario selected by the environment judger 21. For example, when a high reliability is required for the judgment system 20a due to low reliability of the recognition system 10a and the control system 30a, the driving planner 22 may plan a more cautious control action than a normal plan. The cautious control action may include a transition to a degenerate action, execution of MRM, a transition to a DDT fallback, and the like.

[0223] The conditions for executing the dynamic driving task may include conditions for determining at least one of the mode managed by the mode management unit 23 and the constraints to be set. The mode management unit 23 may set functional constraints in consideration of the allocation of reliability according to the scenario selected by the environment determination unit 21. For example, when a high reliability is required for the determination system 20a due to low reliability of the recognition system 10a and the control system 30a, the mode management unit 23 may set constraints such as an upper limit of speed and an upper limit of acceleration in the behavior plan and trajectory plan planned by the driving plan unit 22.

[0224] The conditions for performing the dynamic driving task may be a trigger condition, a minimum risk condition, a fallback condition, etc. Furthermore, a change in the conditions for performing the dynamic driving task may be a change in the condition equation itself or a change in the numerical value input to the condition equation.

[0225] An example of a process related to changing conditions for realizing a dynamic driving task among the operation flows of the driving system 2 will be described below with reference to the flowchart in Fig. 25. A series of processes shown in steps S141 to S144 is repeatedly executed by the driving system 2 at predetermined time intervals or based on a predetermined trigger.

[0226] In S141, the environment determination unit 21 selects a scenario based on the current situation of the vehicle 1. After S141, the process proceeds to S142.

[0227] In S142, at least one of the execution subjects among the environment determination unit 21, the operation planning unit 22, and the mode management unit 23 acquires the scenario selected in S141, and acquires the reliability allocation corresponding to the scenario from the storage medium storing the reliability allocation. After the process of S142, the process proceeds to S143.

[0228] In S143, the execution subject of S142 changes the conditions for realizing the dynamic driving task based on the acquired reliability allocation. After the process of S143, the process proceeds to S144.

[0229] In S144, the operation plan unit 22 derives a control action based on the condition or the result of the calculation process executed according to the condition. The series of processes ends with S144.

[0230] The scenario used in the processes of S141 to S144 may be replaced with an ODD, or may be replaced with a combination of the scenario and an ODD.

[0231] <Action and effect> The effects of the first embodiment described above will be described below.

[0232] According to the first embodiment, the allocation of the allowable error to each subsystem is adjusted. In such an adjustment, a comparison between the error of each subsystem tentatively designed and the allowable error is used. Here, the allowable error is specified by evaluating the deviation of the allowable error of the entire driving system 2 provisionally assigned to each subsystem and the error propagating through the driving system 2. As a result of using the evaluation of the error propagating through the driving system 2, the complex factors based on the interaction between each subsystem can be reflected in the design. Therefore, the validity of the driving system 2 having multiple subsystems can be improved.

[0233] Moreover, according to the first embodiment, the specifications of each subsystem are determined so that the error propagating through the driving system 2 falls within the allowable error with a probability equal to or higher than a predetermined reliability. That is, reliability is introduced as a common measure in a form in which an evaluation based on probability theory is applied to each subsystem. Therefore, even if the recognition system 10a, the judgment system 20a, and the control system 30a each have different functions, the complex factors due to their interactions can be appropriately reflected in the design. Therefore, the validity of the driving system 2 having multiple subsystems can be improved. Furthermore, it is easily possible to realize a system configuration that enhances the continuity of the operation of the driving system 2 by mutually complementing each other among the subsystems.

[0234] Moreover, according to the first embodiment, the error propagating through the driving system 2 is evaluated according to a closed loop in which the interaction between each subsystem and the real world is modeled as a loop structure. The closed loop allows the error generated in each subsystem to be expressed in a form that allows the propagation between each subsystem to be simulated, so that the composite factors between each subsystem can be easily confirmed. Therefore, the validity of the driving system 2 having multiple subsystems can be appropriately confirmed.

[0235] Moreover, according to the first embodiment, the closed loop includes an inner loop IL that circulates among the host vehicle 1, the recognition system 10a, and the control system 30a in the real world and is completed within the host vehicle 1. By evaluating such an inner loop IL, it becomes possible to confirm the propagation of an error that could not be detected only by the evaluation related to the judgment system 20a.

[0236] According to the first embodiment, the closed loop includes an outer loop EL that evaluates the interaction between the vehicle 1 in the real world, the external environment EE in the real world, the recognition system 10a, the determination system 20a, and the control system 30a. By evaluating such an outer loop EL, the combined factors of the recognition system 10a, the determination system 20a, and the control system 30a can be more appropriately confirmed.

[0237] According to the first embodiment, the conditions for realizing the dynamic driving task are changed based on the reliability assignment to each subsystem stored in a storage medium such as the memory 51a, the scenario DB 53, or the memory 55a. That is, since the reliability, which is a common measure between the subsystems, is used, even if the recognition system 10a, the judgment system 20a, and the control system 30a each have different functions, it is possible to change the conditions taking into account the load on each subsystem, which may differ depending on the assigned category. Therefore, high validity can be achieved in the driving system 2 having multiple subsystems.

[0238] According to the first embodiment, the scenario in which the vehicle 1 is currently located is selected. Furthermore, in changing the conditions for realizing the dynamic driving task, the reliability allocation determined corresponding to the scenario is referenced, and whether or not to transition to degenerate behavior is determined based on the product of the reliability of the recognition system 10a and the reliability of the control system 30a. Therefore, even if the reliability of one of the recognition system 10a and the control system 30a is low, if the reliability of the other is high, transition to degenerate behavior can be avoided and appropriate driving behavior can be continued. Therefore, a highly flexible response can be realized in the driving system 2.

[0239] Moreover, according to the first embodiment, the interaction between each subsystem and the real world is modeled as a loop structure. By the thus specified closed loop, the error generated in each subsystem is expressed in a form that allows the propagation between each subsystem to be simulated. By evaluating the error propagating according to the closed loop, the composite factors between each subsystem can be confirmed. Therefore, the validity of the driving system 2 having multiple subsystems can be appropriately confirmed.

[0240] Moreover, according to the first embodiment, the interaction between each subsystem and the real world is modeled as a loop structure. The evaluation of the closed loop thus identified is based on the reliability, which is a common measure between each subsystem. Since the reliability is introduced as a common measure, even if the recognition system 10a, the judgment system 20a, and the control system 30a each have different functions, it is possible to confirm the complex factors caused by these interactions. Therefore, the validity of the driving system 2 having multiple subsystems can be appropriately confirmed.

[0241] Moreover, according to the first embodiment, it is evaluated that the error propagating along the closed loop falls within the allowable error with a probability equal to or higher than a predetermined reliability. By applying an evaluation based on probability theory to each subsystem, it becomes possible to appropriately confirm the validity of the operation system 2. Furthermore, it becomes possible to easily realize a system configuration that enhances the continuity of the operation of the operation system 2 by mutually complementing each subsystem.

[0242] Moreover, according to the first embodiment, the closed loop includes an inner loop IL that circulates among the host vehicle 1, the recognition system 10a, and the control system 30a in the real world and is completed within the host vehicle 1. By evaluating such an inner loop IL, it becomes possible to confirm the propagation of an error that could not be detected only by the evaluation related to the judgment system 20a.

[0243] According to the first embodiment, the closed loop includes an outer loop EL that evaluates the interaction between the vehicle 1 in the real world, the external environment EE in the real world, the recognition system 10a, the determination system 20a, and the control system 30a. By evaluating such an outer loop EL, the combined factors of the recognition system 10a, the determination system 20a, and the control system 30a can be more appropriately confirmed.

[0244] Second embodiment 26 and 27, the second embodiment is a modification of the first embodiment. The second embodiment will be described focusing on the differences from the first embodiment.

[0245] 26, the driving system 202 of the second embodiment may further include a monitoring unit 221 that monitors the determination unit 220 at a functional level. In other words, a monitoring system 221a may be provided as a subsystem that monitors the determination system 220a. On the other hand, the monitoring unit 221 or the monitoring system 221a may be positioned as a part of the determination unit 220 or the determination system 220a included in the determination unit 220 or the determination system 220a.

[0246] As shown in Fig. 27, the operation system 202 further includes a dedicated computer 252 for realizing a monitoring function at a technical level. The dedicated computer 252 may be configured on the same board as the dedicated computer 51 in the processing system 250 that realizes the determination function, and may be capable of on-board communication with each other. On the other hand, the dedicated computer 252 may be implemented in the form of a monitoring ECU provided separately from the processing system 250 that realizes the determination function. The dedicated computer 252 may be an RSS system that realizes a safety-related model such as an RSS model.

[0247] The dedicated computer 252 has at least one memory 252a and one processor 252b. The memory 252a may be at least one type of non-transient substantial storage medium, such as a semiconductor memory, a magnetic medium, or an optical medium, which non-temporarily stores programs and data that can be read by the processor 252b. Furthermore, the memory 252a may be provided with a rewritable volatile storage medium, such as a random access memory (RAM). The processor 252b includes at least one type of core, such as a central processing unit (CPU), a graphics processing unit (GPU), or a reduced instruction set computer (RISC)-CPU.

[0248] The dedicated computer 252 may be a system on a chip (SoC) in which a memory, a processor, and an interface are integrated into a single chip, or may have an SoC as a component of the dedicated computer.

[0249] The monitoring unit 221 acquires information such as an environmental model and a vehicle state from the recognition unit 10, and monitors at least one of a risk occurring between the host vehicle 1 and other road users and a risk due to a misjudgment by the judgment unit 220. The monitoring unit 221 sets, for example, a safety envelope. The monitoring unit 221 detects a violation of the safety envelope in at least one of the control actions derived by the host vehicle 1 and the judgment unit 220.

[0250] The safety envelope may be set according to assumptions based on a safety-related model. The assumptions based on the safety-related model may be reasonably foreseeable assumptions regarding other road users. Such assumptions may be, for example, in the RSS model, reasonably worst-case assumptions of other road users, in which a minimum safe longitudinal distance and a minimum safe lateral distance are calculated. Such assumptions may be set based on a scenario selected by the recognition unit 10, the determination unit 220 or the monitoring unit 221. The safety envelope may define a boundary around the ego-vehicle 1. The safety envelope may be set based on the kinematic characteristics of other road users, traffic rules, the region, etc.

[0251] The monitoring unit 221 may change the control action derived by the decision unit 220 when a violation of the safety envelope is detected. The change in the control action here may correspond to an appropriate response, to a transition to a minimum risk condition, or to a DDT fallback.

[0252] When a violation of the safety envelope is detected, the monitoring unit 221 may reject the control action derived by the determination unit 220. In this case, the monitoring unit 221 may set a constraint on the determination unit 220. When the control action is rejected, the determination unit 220 may again derive a control action based on the set constraint.

[0253] The safety-related model or the mathematical model used for monitoring by the monitoring unit 221 may be capable of invalidating quantitative errors and qualitative errors in misjudgment by the judgment unit 220. The safety-related model or the mathematical model may be capable of forcibly correcting errors due to quantitative errors and qualitative errors in misjudgment by the judgment unit 220 within an allowable range.

[0254] That is, by installing the monitoring unit 221, it becomes possible to regard the error j due to misjudgment as substantially 0. On the other hand, the error d due to vehicle motion disturbance, the error m due to misrecognition, and the error n due to observation noise remain, and these errors propagate according to the closed loop.

[0255] Therefore, verification and validation of complex factors between subsystems is also effective in the driving system 202 including the monitoring function of the monitoring unit 221. The evaluation method and design method of the first embodiment may be applied to the driving system 202. Also, similar to the first embodiment, the determination unit 220 or the monitoring unit 221 may change the conditions for realizing the dynamic driving task based on the allocation of the reliability.

[0256] 28, an example of the process related to the monitoring function by the monitoring system 221a will be described below from the operation flow of the operation system 202. A series of processes shown in steps S201 to 206 is repeatedly executed by the operation system 202 at predetermined time intervals or based on a predetermined trigger.

[0257] In S201, a scenario in which the host vehicle 1 is currently located is selected. After S201, the process proceeds to S202.

[0258] In S202, the movements of other road users are assumed within a reasonable and foreseeable range based on the scenario selected in S201. After S202, the process proceeds to S203.

[0259] In S203, a safety envelope is set based on the assumptions and mathematical model in S202. The mathematical model here is a mathematical model that invalidates quantitative and qualitative errors in judgment errors in the judgment function, or a mathematical model that forcibly corrects errors due to quantitative and qualitative errors in judgment errors in the judgment function within an allowable range. After the processing of S203, the process proceeds to S204.

[0260] In S204, detection of a violation of the safety envelope is performed using information such as an environmental model. That is, it is determined whether or not a violation has occurred. If a negative determination is made in S204, the process proceeds to S205. If a positive determination is made in S205, the process proceeds to S206.

[0261] In S205, the control action derived by the judgment function is adopted. After S205, the series of processes ends.

[0262] In S206, the control action derived by the decision function is changed or rejected. After S206, the series of processes ends.

[0263] Third embodiment As shown in Fig. 29, the third embodiment is a modification of the first embodiment. The second embodiment will be described focusing on the differences from the first embodiment.

[0264] In the driving system 302 of the third embodiment, no direct input / output of information is performed between the recognition unit 10 and the control unit 30. That is, information output by the recognition unit 10 is input to the control unit 30 via the judgment unit 20. For example, at least one of the vehicle state recognized by the internal recognition unit 14, for example, the current speed, acceleration, and yaw rate of the host vehicle 1, is passed directly to the motion control unit 31 via the environment judgment unit 321 and the driving plan unit 322, or via the mode management unit 323 and the driving plan unit 322.

[0265] That is, the environment judgment unit 321 and the operation planning unit 322 or the mode management unit 323 and the operation planning unit 322 have the function of processing some of the information acquired from the internal recognition unit 14 and outputting it to the movement control unit 31 in the form of a trajectory plan or the like, and outputting other information acquired from the internal recognition unit 14 to the movement control unit 31 as unprocessed information.

[0266] Therefore, the interaction between the recognition unit 10 and the control unit 30 in the physical IF layer of the causal loop shown in FIG. 5 is substantially realized.

[0267] (Fourth embodiment) As shown in Fig. 30, the fourth embodiment is a modification of the first embodiment. The second embodiment will be described, focusing on the differences from the first embodiment.

[0268] The driving system 402 of the fourth embodiment has a configuration that employs a domain-based architecture that realizes driving assistance up to level 2. An example of a detailed configuration of the driving system 402 at a technical level will be described with reference to Fig. 30 .

[0269] The driving system 402 includes, as in the first embodiment, a plurality of sensors 41 and 42, a plurality of motion actuators 60, a plurality of HMI devices 70, and a plurality of processing systems. Each processing system is a domain controller that aggregates processing functions for each functional domain. The domain controller may have the same configuration as the processing system or ECU of the first embodiment. For example, the driving system 402 includes, as processing systems, an ADAS domain controller 451, a powertrain domain controller 452, a cockpit domain controller 453, and a connectivity domain controller 454.

[0270] The ADAS domain controller 451 aggregates functions related to ADAS (Advanced Driver-Assistance Systems). The ADAS domain controller 451 may realize a part of the recognition function, a part of the judgment function, and a part of the control function in a composite manner. A part of the recognition function realized by the ADAS domain controller 451 may be, for example, a function corresponding to the fusion unit 13 of the first embodiment or a simplified function thereof. A part of the judgment function realized by the ADAS domain controller 451 may be, for example, a function corresponding to the environment judgment unit 21 and the driving plan unit 22 of the first embodiment or a simplified function thereof. A part of the control function realized by the ADAS domain controller 451 may be, for example, a function of generating request information for the motion actuator 60, among the functions corresponding to the motion control unit 31 of the first embodiment.

[0271] Specifically, the functions realized by the ADAS domain controller 451 are functions that support driving in non-dangerous scenarios, such as a lane keeping assist function that makes the host vehicle 1 run along white lines, and a vehicle distance maintaining function that keeps a predetermined distance from another preceding vehicle that is ahead of the host vehicle 1. In addition, the functions realized by the ADAS domain controller 451 are functions that realize appropriate responses in dangerous scenarios, such as a collision damage mitigation braking function that applies the brakes when it is about to collide with another road user or an obstacle, and an automatic steering avoidance function that avoids a collision by steering when it is about to collide with another road user or an obstacle.

[0272] The powertrain domain controller 452 aggregates functions related to the control of the powertrain. The powertrain domain controller 452 may realize at least a part of the recognition function and at least a part of the control function in a composite manner. A part of the recognition function realized by the powertrain domain controller 452 may be, for example, a function of recognizing the operation state of the driver with respect to the motion actuator 60, among the functions corresponding to the internal recognition unit 14 in the first embodiment. A part of the control function realized by the powertrain domain controller 452 may be, for example, a function of controlling the motion actuator 60, among the functions corresponding to the motion control unit 31 in the first embodiment.

[0273] The cockpit domain controller 453 aggregates functions related to the cockpit. The cockpit domain controller 453 may realize at least a part of the recognition function and at least a part of the control function in a composite manner. A part of the recognition function realized by the cockpit domain controller 453 may be, for example, a function of recognizing the switch state of the HMI device 70 among the internal recognition unit 14 of the first embodiment. A part of the control function realized by the cockpit domain controller 453 may be, for example, a function corresponding to the HMI output unit 71 of the first embodiment.

[0274] The connectivity domain controller 454 aggregates functions related to connectivity. The connectivity domain controller 454 may realize at least a part of the recognition function in a composite manner. A part of the recognition function realized by the connectivity domain controller 454 may be a function of organizing and converting the global position data, V2X information, etc. of the host vehicle 1 acquired from the communication system 43 into a format that can be used by the ADAS domain controller 451, for example.

[0275] In the fourth embodiment, at the functional level, the functions of the driving system 402 including the domain controllers 451, 452, 453, and 454 can be associated with the recognition unit 10, the determination unit 20, and the control unit 30. Therefore, evaluation using the causal loop structure similar to that of the first embodiment is possible.

[0276] (Other embodiments) Although several embodiments have been described above, the present disclosure should not be construed as being limited to those embodiments, and can be applied to various embodiments and combinations within the scope not departing from the gist of the present disclosure.

[0277] The driving system 2 can be applied to various moving objects other than vehicles, such as ships, aircraft, drones, construction machines, agricultural machines, and the like.

[0278] The controller and method described herein may be implemented by a special-purpose computer having a processor programmed to execute one or more functions embodied in a computer program. Alternatively, the device and method described herein may be implemented by a special-purpose hardware logic circuit. Alternatively, the device and method described herein may be implemented by one or more special-purpose computers configured by a combination of a processor executing a computer program and one or more hardware logic circuits. The computer program may also be stored on a computer-readable non-transitory tangible recording medium as instructions executed by the computer.

[0279] (Terminology explanation) The following describes terms related to the present disclosure. This description is included in the embodiments of the present disclosure.

[0280] A road user may be a person who uses a road, including sidewalks and other adjacent spaces. A road user may be a road user on or adjacent to an active road for the purpose of moving from one place to another.

[0281] A dynamic driving task (DDT) may be a real-time operational and tactical function for operating a vehicle in traffic.

[0282] An automated driving system may be a set of hardware and software capable of executing the entire DDT on a continuous basis, whether or not it is limited to a specific operational design domain.

[0283] SOTIF (safety of the intended functionality) may be the absence of undue risk due to inadequacies in the intended functionality or in the functionality of its implementation.

[0284] A driving policy may be a strategy and rules that define control behavior at the vehicle level.

[0285] Vehicle motion may refer to the vehicle state and its dynamics captured in terms of physical quantities (eg, speed, acceleration).

[0286] A situation may be a factor that can affect the behavior of the system, and may include conditions, traffic conditions, weather, and the behavior of the ego-vehicle.

[0287] The estimation of the situation may involve reconstructing a set of parameters representing the situation in an electronic system from the situation obtained from a sensor.

[0288] A scenario may be a depiction of the temporal relationships between several scenes in a sequence of scenes, including goals and values ​​in a particular situation influenced by actions and events. A scenario may be a depiction of a continuous time sequence of activities that integrates a subject vehicle, all its external environments, and their interactions in the process of performing a particular driving task.

[0289] The behavior of the host vehicle may be an interpretation of the vehicle motion in the context of a traffic situation.

[0290] A triggering condition may be a particular condition of a scenario that acts as a trigger for subsequent system responses that contribute to unsafe behavior or the failure to prevent, detect, and mitigate reasonably foreseeable indirect misuse.

[0291] A proper response may be an action that resolves a dangerous situation when other road users are acting in accordance with assumptions about reasonably foreseeable behavior.

[0292] A hazardous situation may be a scenario that represents an increased level of risk present for DDT unless preventive action is taken.

[0293] A safe situation may be a situation within the performance limits within which the system can ensure safety. Note that a safe situation is a design concept due to the definition of the performance limits.

[0294] A minimal risk manoeuvre (MRM) may be the function of an (automated) driving system to transition a vehicle between nominal and minimal risk conditions.

[0295] A DDT fallback may be a response by the driver or an automated system to execute a DDT or transition to a minimal risk condition after detection of a fault or insufficiency, or upon detection of a potentially dangerous behavior.

[0296] The performance limit may be the design limit within which the system can achieve its objectives. The performance limit may be set for multiple parameters.

[0297] An operational design domain (ODD) may be the specific conditions in which a given (automated) driving system is designed to function. An operational design domain may be the operating conditions in which a given (automated) driving system or feature is specifically designed to function, including, but not limited to, environmental, geographic, and time-of-day constraints, and / or the presence or absence of specific traffic or roadway features.

[0298] A (stable) controllable range may be a range of design values ​​within which the system can continue to perform its intended purpose. (Stable) controllable ranges can be set for multiple parameters.

[0299] A minimal risk condition may be a condition of the vehicle to reduce risk if a given trip cannot be completed. A minimal risk condition may be a condition that a user or automated driving system places on the vehicle after performing a minimal risk maneuver to reduce the risk of a collision if a given trip cannot be completed.

[0300] A takeover may be the transfer of the driving task between the automated driving system and the driver.

[0301] An unreasonable risk may be a risk that is judged to be unacceptable in a particular situation according to reasonable social and moral concepts.

[0302] Safety-related models may be representations of safety-related aspects of driving behaviour based on assumptions about the reasonably foreseeable behaviour of other road users. Safety-related models may be on-board or off-board safety checks or analyses, mathematical models, more conceptual sets of rules, sets of scenario-based behaviours, or a combination of these.

[0303] A safety envelope may be a set of limits and conditions within which an (automated) driving system is designed to operate, subject to constraints or controls, in order to maintain operation within an acceptable level of risk. A safety envelope may be a general concept that can be used to accommodate all principles to which a driving policy can adhere, according to which an ego-vehicle operated by an (automated) driving system may have one or more boundaries around it.

[0304] (Additional remarks) The present disclosure also includes the following technical features based on the above embodiments.

[0305] <Technical feature 1> A method for evaluating a driving system of a moving object, the driving system including a recognition system, a judgment system, and a control system as subsystems, comprising: Evaluating the nominal performance of the recognition system; Evaluating the nominal performance of the decision system; and evaluating a nominal performance of the control system.

[0306] <Technical feature 2> A method for evaluating a driving system of a moving object, the driving system including a recognition system, a judgment system, and a control system as subsystems, comprising: Evaluating the nominal performance of the decision system; and and evaluating a robust performance of the judgment system taking into account at least one of the errors of the recognition system and the errors of the control system.

[0307] <Technical feature 3> A method for evaluating a driving system of a moving object, the driving system including a recognition system, a judgment system, and a control system as subsystems, comprising: Independently assessing the nominal performance of the recognition system, the nominal performance of the decision system, and the nominal performance of the control system; and evaluating the robust performance of the entire driving system so as to include in the evaluation targets a complex factor between the recognition system and the judgment system, a complex factor between the judgment system and the control system, and a complex factor between the recognition system and the control system.

[0308] <Technical feature 4> A driving system for a moving object, comprising a recognition system, a judgment system, and a control system as subsystems, a first closed loop indicating interactions between each subsystem and the real world, the first closed loop circulating between a moving object in the real world, the recognition system, and the control system, and completing within the moving object; a second closed loop including an interaction between the moving object in the real world, an external environment in the real world, a recognition system, a judgment system, and a control system, the second closed loop being a loop showing an interaction between the moving object and the external environment; The driving system is configured such that errors propagating through the first closed loop and the second closed loop are within a predetermined tolerance.

[0309] <Technical feature 5> A driving system for a moving object, comprising a recognition system, a judgment system, and a control system as subsystems, a first closed loop indicating interactions between each subsystem and the real world, the first closed loop circulating between a moving object in the real world, the recognition system, and the control system, and completing within the moving object; a second closed loop including an interaction between the moving object in the real world, an external environment in the real world, a recognition system, a judgment system, and a control system, the second closed loop being a loop showing an interaction between the moving object and the external environment; An operating system configured such that an error propagating through the first closed loop and the second closed loop falls within a predetermined tolerance with a probability equal to or greater than a predetermined confidence level.

[0310] <Technical feature 6> A monitoring system for monitoring a decision-making function in driving a vehicle, the monitoring system including at least one processor, The processor Detecting violations of the safety envelope based on a mathematical model that neutralizes quantitative and qualitative errors in judgment errors in the judgment function; and modifying or overruling the control action derived by the decision function if a violation of the safety envelope is detected.

[0311] <Technical feature 7> A monitoring system for monitoring a decision-making function in driving a vehicle, the monitoring system including at least one processor, The processor Detecting violations of the safety envelope based on a mathematical model that forcibly corrects errors due to quantitative and qualitative errors in judgment errors in judgment functions within a tolerable range; and modifying or overruling the control action derived by the decision function if a violation of the safety envelope is detected.

Claims

1. A method executed by at least one processor (82b), comprising: a method for designing a driving system (2, 202, 302, 402) having a plurality of subsystems (10a, 20a, 220a, 221a, 30a), each of which cooperates with the others to realize a dynamic driving task of a moving object (1), comprising: Calculating errors occurring in each of the provisionally designed subsystems; provisionally allocating to each of the subsystems a tolerance allowed for the entire operating system; determining a tolerance allowed for each of the subsystems from the deviations assigned to each of the subsystems based on an evaluation of the error propagating through the operational system; and adjusting an allocation of a tolerance to each of the subsystems based on a comparison between the calculated error and a corresponding tolerance of the subsystem.

2. A method executed by at least one processor (82b), comprising: a method for designing a driving system (2, 202, 302, 402) comprising a plurality of subsystems (10a, 20a, 220a, 221a, 30a), each of which cooperates with the others to realize a dynamic driving task of a moving object (1), comprising: Introducing a reliability to each of the subsystems as a common measure among the subsystems for evaluating composite factors among the subsystems; assigning a reliability to each subsystem based on a specification of the operational system; determining specifications for each of the subsystems so that errors occurring in the subsystems and propagating through the operating system fall within an allowable error with a probability equal to or greater than a predetermined confidence level.

3. The design method according to claim 1 or 2, wherein the error propagated through the driving system is evaluated according to a closed loop (IL, EL, SL) in which an interaction between each of the subsystems and the real world is modeled as a loop structure.

4. The design method of claim 3, wherein the plurality of subsystems includes a perception system (10a), a decision system (20a, 220a), and a control system (30a).

5. The design method according to claim 4 , wherein the closed loop includes a loop (IL) that is completed within the moving body and circulates among the moving body in the real world, the recognition system, and the control system.

6. 6. The design method according to claim 4 or 5, wherein the closed loop includes a loop (EL) that evaluates an interaction between the moving object in the real world and the external environment (EE) in the real world, the recognition system, the judgment system, and the control system.

7. A design program for implementing a design function of a driving system (2, 202, 302, 402) including a plurality of subsystems (10a, 20a, 220a, 221a, 30a), each of which cooperates with the other to implement a dynamic driving task of a moving object (1), comprising: by at least one processor (82b), Calculating errors occurring in each of the provisionally designed subsystems; provisionally allocating to each of the subsystems a tolerance allowed for the entire operating system; determining a tolerance allowed for each of the subsystems from the deviations assigned to each of the subsystems based on an evaluation of the error propagating through the operational system; and adjusting an allocation of a tolerance to each of the subsystems based on a result of comparing the calculated error with a corresponding tolerance of the subsystem.

8. A design program for implementing a design function of a driving system (2, 202, 302, 402) including a plurality of subsystems (10a, 20a, 220a, 221a, 30a), each of which cooperates with the other to implement a dynamic driving task of a moving object (1), comprising: by at least one processor (82b), Introducing a reliability to each of the subsystems as a common measure among the subsystems for evaluating composite factors among the subsystems; assigning a reliability to each subsystem based on a specification of the operational system; determining specifications for each of the subsystems so that errors occurring in each of the subsystems and propagating through the operating system fall within an allowable error with a probability equal to or greater than a predetermined confidence level.

9. A driving system comprising a plurality of subsystems (10a, 20a, 220a, 221a, 30a), each of which cooperates with the others to realize a dynamic driving task of a moving object (1), The plurality of subsystems include a recognition system (10a), a judgment system (20a, 220a), and a control system (30a); At least one storage medium (51a, 53, 55a) storing an assignment of reliability to each of the subsystems, the assignment being a common scale between the subsystems, the assignment being determined for each assignment category; and at least one processor (51b) configured to modify conditions for achieving the dynamic driving task based on the assignment of confidence.

10. The storage medium includes a scenario database (53) that constructs a catalog of scenarios, The driving system of claim 9, wherein the processor is further configured to select the scenario in which the moving body is currently located, and in changing the conditions, the processor refers to the reliability assignment defined corresponding to the scenario, and determines whether to transition to a degenerate behavior based on the value of the product of the reliability of the recognition system and the reliability of the control system.

Images