Vehicle, control device and control method thereof, and program

Abstract

To appropriately protect personal information of a vehicle driver.SOLUTION: A control device for controlling a vehicle comprises: a drive control unit that provides multiple features related to vehicle driving; and an administrative unit that administers consent information related to whether or not a driver of the vehicle consents that specific personal information acquired by a sensor of the vehicle will be used by the vehicle. The number of executable features when the driver does not consent to the use of specific personal information among the multiple features is lower than the number of executable features when the driver consents to the use of specific personal information among the multiple features.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a vehicle, a control device and a control method thereof, and a program. [Background technology]

[0002] A driver of a vehicle with a driving control function is required to approve the conditions for using the driving control function. In response to the driver's approval of the conditions, a code is generated in the system and the driving control function is enabled. Patent Document 1 describes a method in which a part of the vehicle's driving control function is restricted until the code is approved, and the restriction on the driving control function is lifted after the code is approved. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-034638 A Summary of the Invention [Problem to be solved by the invention]

[0004] In order to execute a driving control function, personal information of a driver of a vehicle may be used. An object of some aspects of the present invention is to provide a technique for appropriately protecting the personal information of a driver of a vehicle. [Means for solving the problem]

[0005] According to some embodiments, a control device for controlling a vehicle includes a driving control means for providing a plurality of functions related to driving of the vehicle, and a management means for managing consent information related to whether a driver of the vehicle has consented to the vehicle using specific personal information acquired by a sensor of the vehicle, and a number of functions that can be executed when the driver has not consented to the use of the specific personal information among the plurality of functions is smaller than a number of functions that can be executed when the driver has consented to the use of the specific personal information among the plurality of functions.The specific personal information includes camera information acquired by a camera mounted on the vehicle and location information of the vehicle acquired by a positioning sensor mounted on the vehicle, and the management means allows the driver to select whether or not to consent to the use of the camera information and whether or not to consent to the use of the location information. , a control device is provided. Effect of the Invention

[0006] According to some embodiments, the personal information of the vehicle driver is adequately protected. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a block diagram illustrating an example configuration of a vehicle according to some embodiments. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a functional configuration of a controller of a vehicle according to some embodiments. [Diagram 3] FIG. 11 illustrates an example of required consent information according to some embodiments. [Figure 4] FIG. 13 is a schematic diagram illustrating an example of a consent setting screen according to some embodiments. [Diagram 5] FIG. 11 is a flow diagram illustrating an example of operations for enabling functionality of some embodiments. [Figure 6] FIG. 11 is a flow diagram illustrating an example of an operation for switching between permission and prohibition of a setting change according to some embodiments. [Figure 7] 1 is a flow diagram illustrating example operations for changing consent settings according to some embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the invention according to the claims, and not all combinations of features described in the embodiments are essential to the invention. Two or more features among the multiple features described in the embodiments may be arbitrarily combined. In addition, the same reference numbers are used for the same or similar configurations, and duplicated descriptions are omitted.

[0009] FIG. 1 is a block diagram of a control device CNT according to an embodiment of the present invention, and a schematic diagram of a vehicle V which is an application example of the control device CNT. In FIG. 1, the vehicle V is shown in a plan view and a side view. The vehicle V of this embodiment is, as an example, a four-wheeled sedan-type passenger vehicle, and may be, for example, a parallel hybrid vehicle. The vehicle V is not limited to a four-wheeled passenger vehicle, and may be a saddle-type vehicle (motorcycle, motor three-wheeler), or a large vehicle such as a truck or a bus.

[0010] The control device CNT includes a controller 1 which is an electronic circuit that executes control of the vehicle V including driving assistance of the vehicle V. The controller 1 includes a plurality of ECUs (Electronic Control Units). For example, an ECU is provided for each function of the control device CNT. Each ECU includes a processor represented by a CPU (Central Processing Unit), a storage device such as a semiconductor memory, an interface with an external device, and the like. The storage device stores a program executed by the processor, data used by the processor for processing, and the like. The interface includes an input / output interface and a communication interface. Each ECU may include a plurality of processors, a plurality of storage devices, and a plurality of interfaces. The program stored in the storage device may be stored in the storage device by being installed in the control device CNT using a storage medium such as a CD-ROM. In addition to or instead of this, the program stored in the storage device may be downloaded from an external server through wireless communication.

[0011] The controller 1 controls an information output device 5 that notifies the inside of the vehicle of information. The information output device 5 includes, for example, a display device 5a that notifies the driver of information by image and / or a voice output device 5b that notifies the driver of information by voice. The display device 5a includes, for example, a display device provided on an instrument panel or a display device provided on a steering wheel ST. The display device 5a may also include a head-up display. The information output device 5 may notify the occupant of information by vibration or light.

[0012] The controller 1 receives instruction inputs from a passenger (e.g., the driver) via the input device 6. The input device 6 is disposed in a position operable by the driver, and includes, for example, a switch group 6a with which the driver issues instructions to the vehicle V, and / or a turn signal lever 6b for operating a turn signal (blinker).

[0013] The controller 1 recognizes and determines the current position and course (attitude) of the vehicle V. In this embodiment, the vehicle V is provided with a gyro sensor 7a, a GNSS (Global Navigation Satellite System) sensor 7b, and a communication device 7c. The gyro sensor 7a detects the rotational motion (yaw rate) of the vehicle V. The GNSS sensor 7b is an example of a positioning sensor for detecting the current position of the vehicle V. The communication device 7c wirelessly communicates with a server that provides map information and traffic information to obtain such information. In this embodiment, the controller 1 determines the course of the vehicle V based on the detection results of the gyro sensor 7a and the GNSS sensor 7b, and sequentially obtains map information related to the course from the server via the communication device 7c and stores it in a database 7d (storage device). The vehicle V may be provided with other sensors for detecting the state of the vehicle V, such as an acceleration sensor that detects the acceleration of the vehicle V.

[0014] The controller 1 executes driving assistance for the vehicle V based on the detection results of various detection units provided in the vehicle V. The vehicle V is provided with surrounding detection units 8a-8b, which are external sensors that detect the outside (surrounding conditions) of the vehicle V, and interior detection units 9a-9c, which are interior sensors that detect the conditions inside the vehicle (the conditions of the occupants (particularly the driver)). The controller 1 can grasp the surrounding conditions of the vehicle V based on the detection results of the surrounding detection units 8a-8b, and execute driving assistance in accordance with the surrounding conditions. In addition, the controller 1 can determine whether the driver is performing a predetermined operational obligation imposed on the driver when executing driving assistance based on the detection results of the interior detection units 9a-9c.

[0015] The surroundings detection unit 8a is an imaging device that captures an image in front of the vehicle V (hereinafter, may be referred to as the forward camera 8a), and is attached, for example, to the inside of the passenger compartment of the windshield at the front of the roof of the vehicle V. The controller 1 can extract the contours of targets and lane markings (white lines, etc.) on the road by analyzing the image captured by the forward camera 8a.

[0016] The surroundings detection unit 8b is a millimeter wave radar (hereinafter, sometimes referred to as radar 8b), which detects targets around the vehicle V using radio waves and detects (measures) the distance to the target and the direction (azimuth) of the target relative to the vehicle V. In the example shown in Fig. 1, five radars 8b are provided, one at the center of the front of the vehicle V, one at each of the left and right corners of the front, and one at each of the left and right corners of the rear.

[0017] The surrounding detection unit installed in the vehicle V is not limited to the above configuration, and the number of cameras and the number of radars may be changed, or a LIDAR (Light Detection and Ranging) that detects targets around the vehicle V may be installed.

[0018] The in-vehicle detection unit 9a is an imaging device that captures images of the interior of the vehicle (hereinafter, may be referred to as the in-vehicle camera 9a), and is attached, for example, to the inside of the vehicle compartment at the front part of the roof of the vehicle interior V. In the case of this embodiment, the in-vehicle camera 9a is a driver monitor camera that captures images of the driver (for example, the driver's eyes and face). The controller 1 can determine the driver's line of sight and the direction of the driver's face by analyzing the image (driver's facial image) captured by the in-vehicle camera 9a.

[0019] The in-vehicle detection unit 9b is a grip sensor that detects the driver's grip of the steering wheel ST (hereinafter, may be referred to as grip sensor 9b), and is provided, for example, on at least a part of the steering wheel ST. As the in-vehicle detection unit, the torque sensor 4c that detects the steering torque of the driver may be used.

[0020] The in-vehicle detection unit 9c is a microphone that detects voices inside the vehicle (hereinafter, may be referred to as an in-vehicle microphone 9c), and is attached to the instrument panel of the vehicle V, for example.

[0021] The driving assistance function of the vehicle V for the driver may include, for example, an acceleration / deceleration assistance function, a lane keeping assistance function, and a lane change assistance function. The acceleration / deceleration assistance function may include a following function (ACC: Adaptive Cruise Control) in which the controller 1 automatically controls the power unit 2 and the hydraulic device 3 based on the detection results of the surroundings detection unit 8 and map information to automatically control the acceleration / deceleration of the vehicle V within a predetermined vehicle speed. With ACC, when there is a preceding vehicle, it is also possible to accelerate or decelerate the vehicle V so as to maintain a distance from the preceding vehicle. ACC reduces the operational burden on the driver of acceleration / deceleration operations (operations of the accelerator pedal AP and the brake pedal BP).

[0022] The acceleration / deceleration assistance function may include an abnormality deceleration function that automatically decelerates the vehicle V in response to detection that an abnormality has occurred in the driver. The acceleration / deceleration assistance function may include a curve deceleration function that automatically decelerates the vehicle V before a curve. The acceleration / deceleration assistance function may include a collision mitigation braking function that automatically decelerates the vehicle V in response to detection that the vehicle V is about to collide with another object (e.g., another vehicle).

[0023] The lane keeping assist function may include a lane keeping assist system (LKAS) in which the controller 1 automatically controls the electric power steering device 4 based on the detection results of the surroundings detection unit 8 and map information to keep the vehicle V inside the lane. The LKAS reduces the driver's burden of steering (operation of the steering wheel ST) while the vehicle V is traveling straight.

[0024] The lane change assist function may include a lane change function (ALC: Auto Lane Changing, ALCA: Active Lane Change Assist) in which the controller 1 automatically controls the power unit 2, the hydraulic device 3, and the electric power steering device 4 based on the detection result of the surrounding detection unit 8 and map information to automatically change the driving lane of the vehicle V to an adjacent lane. The ALC is a lane change function based on a system request, and the ALCA is a lane change function based on an occupant request. Examples of the system request include a case where a navigation system that guides the vehicle V to a destination requests the vehicle V to change lanes, and a case where the vehicle V overtakes a preceding vehicle regardless of whether route guidance is provided. When making an occupant request, the driver instructs the vehicle V to change lanes by operating an input device (e.g., the blinker lever 6b). The ALC or ACLA reduces the driver's operational burden of accelerating, decelerating, and steering the vehicle V when changing lanes.

[0025] In some embodiments, the controller 1 selectively executes one of three modes 1 to 3 having different driving assistance contents. The mode may be called a state. In the following, a case where ACC, LKAS, ALC, or ACLA is provided as driving assistance will be described, but the driving assistance contents of each of the modes 1 to 3 are not limited to ACC, LKAS, ALC, or ACLA, and may include other driving assistance contents. Also, only one of ALC and ACLA may be provided.

[0026] Mode 1 is a manual driving mode in which none of ACC, LKAS, ALC, and ACLA are executed, and is a mode based on the manual driving operation of the driver. It is the mode that is initially set when the vehicle V is started. In mode 1, an abnormality deceleration function and a collision mitigation brake function may be executed.

[0027] Mode 2 and Mode 3 are modes that are set on the condition that the occupant issues a driving assistance command in Mode 1. Mode 2 is a normal assistance mode in which ACC and LKAS can be executed. ALC and ACLA are not executed in Mode 2. In Mode 2, an abnormality deceleration function and a collision mitigation brake function may be executed.

[0028] Mode 3 is an extended assistance mode in which all of ACC, LKAS, ALC, and ACLA can be executed. Mode 3 is a mode premised on the assumption that the controller 1 has acquired high-precision map information including information on the road (traveling path) on which the vehicle V travels. The high-precision map information is map information having more accurate information on road information than map information (sometimes called normal map information) used for route guidance to a destination. Specifically, the high-precision map information may have at least position information within a lane. This can be used to control the position of the vehicle V in the vehicle width direction. The high-precision map information may further include information on the detailed shape of the road, such as the presence or absence of a curve, the curvature, the increase or decrease of lanes, and the gradient. The high-precision map information is prepared for each region or road section, for example, and there may be regions or road sections in which high-precision map information is not provided.

[0029] In mode 3, lane change assistance (ALC and ACLA) is performed by using this high-precision map information. ALCA may be performed using normal map information instead of high-precision map information. By utilizing position information within the lane included in the high-precision map information and the current position of the vehicle V detected by the GNSS sensor 7b, reliable and smooth lane change assistance can be performed while recognizing other vehicles in the vicinity from the external detection results of the detection units 8a to 8b. Lane change assistance may be performed without using high-precision map information.

[0030] Both mode 2 and mode 3 are modes in which ACC and LKAS can be executed, but in mode 3, ACC and LKAS using high-precision map information can be executed. The transition to mode 3 may require that an image of the driver captured by the in-vehicle camera 9a (i.e., the driver monitor camera) can be used. Therefore, if the driver agrees to the use of the position information of the vehicle V but does not agree to the use of the driver's image, the transition to mode 3 may be suppressed. The controller 1 can obtain road information of the vehicle V's destination from the high-precision map information in advance, and perform acceleration / deceleration and lateral position control of the vehicle V, thereby providing the occupants with more reliable and smooth ACC and LKAS. In mode 3, an abnormality deceleration function, a collision mitigation brake function, and a curve deceleration function may be executed.

[0031] With reference to FIG. 2, an example of a functional configuration of the controller 1 of the vehicle V will be described. The functional units 201-208 may be realized by a processor of the controller 1 executing a program stored in a memory of the controller 1. Alternatively, at least some of the functional units 201-208 may be realized by a dedicated integrated circuit such as an ASIC (Application Specific Integrated Circuit). The controller 1 may include a functional unit not shown in FIG. 2, or may not include some of the functional units shown in FIG. 2. Each of the functional units 201-208 may be realized by a single ECU, or may be realized in a distributed manner across multiple ECUs. Two or more of the functional units 201-208 may be realized by the same ECU.

[0032] The driving control unit 201 provides multiple driving assistance functions related to the driving of the vehicle V by automatically controlling at least one of the acceleration, deceleration, and steering of the vehicle V. The multiple driving assistance functions may include an extended assistance function in mode 3 as described above, a lane change function, a following function, and the like.

[0033] The consent management unit 202 manages consent information regarding whether the driver consents to the vehicle V (specifically, the controller 1) using specific personal information of the driver acquired by a sensor of the vehicle V. Examples of personal information will be described later.

[0034] The user authentication unit 203 performs personal authentication of the driver of the vehicle V. For example, the user authentication unit 203 may obtain a user identifier and a password from the driver and determine whether they match the authentication information 213 stored in the controller 1. Alternatively or in addition to this, the user authentication unit 203 may obtain biometric information of the driver and perform user authentication based on this biometric information.

[0035] The user interface (UI) control unit 204 controls the UI (e.g., display device 5a, audio output device 5b, input device 6) of the vehicle V to obtain input from a user (e.g., a driver) of the vehicle V and output information to the user of the vehicle V.

[0036] The position acquisition unit 205 acquires position information of the vehicle V acquired by the GNSS sensor 7b. The position information may be expressed, for example, by latitude and longitude. The position information of the vehicle V indicates the location of the driver, and therefore may be personal information of the driver.

[0037] The image acquisition unit 206 acquires camera information acquired by a camera (for example, the in-vehicle camera 9a) mounted on the vehicle V. The camera information may include an image of the driver. Therefore, the camera information may be personal information of the driver.

[0038] The voice acquisition unit 207 acquires microphone information acquired by a microphone (for example, the in-vehicle microphone 9c) mounted on the vehicle V. The microphone information may include the driver's voice. Therefore, the microphone information may be personal information of the driver.

[0039] The map acquisition unit 208 acquires map information from an external server. As described above, the map information can be used for the driving assistance function in mode 3.

[0040] The controller 1 may include a storage device 210. The storage device 210 may be a memory of one or more ECUs included in the controller 1, or may be another storage device. The storage device 210 may store the information shown in FIG. 2. The storage device 210 may store some of the information shown in FIG. 2, or may store information not shown in FIG. 2. Instead of using the information stored in the storage device 210, the controller 1 may use information stored in another storage device (which may be included in the vehicle V or may be a device outside the vehicle).

[0041] The vehicle information 211 is information about the vehicle V. The vehicle information 211 may include a vehicle identification number (VIN). The VIN may be personal information of the driver because it identifies the vehicle V that the driver is driving. The vehicle information 211 may be stored in the storage device 210 by the manufacturer of the vehicle V during the manufacture of the vehicle V.

[0042] The required consent information 212 indicates the type of personal information for which the driver's consent is required for the controller 1 to provide a driving assistance function. The required consent information 212 is shown with reference to FIG. 2. In the example of FIG. 2, the required consent information 212 is expressed in a table format. Alternatively, the required consent information 212 may be expressed in other formats.

[0043] Column 301 represents a plurality of driving assistance functions provided by the vehicle V (e.g., the driving control unit 201). The driving assistance functions shown in column 301 are examples. The necessary consent information 212 may include information of other driving assistance functions not shown in FIG. 2, or may not include some of the driving assistance functions shown in FIG. 2.

[0044] Column 302 indicates whether the driver's consent is required for the particular driving assistance function to use the VIN. The VIN may be included in the vehicle information 211 as described above. Column 303 indicates whether the driver's consent is required for the particular driving assistance function to use microphone information. The microphone information is acquired, for example, by the audio acquisition unit 207. Column 304 indicates whether the driver's consent is required for the particular driving assistance function to use camera information. The camera information is acquired, for example, by the image acquisition unit 206. Column 305 indicates whether the driver's consent is required for the particular driving assistance function to use location information. The location information is acquired, for example, by the location acquisition unit 205.

[0045] In FIG. 3, "Required" indicates that the driver's consent is required, and "Not Required" indicates that the driver's consent is not required. Whether the driver's consent is required for a particular driving assistance function to use particular personal information may vary depending on the policy of the manufacturer of the vehicle V and the laws and regulations of the country in which the vehicle V is used. The required consent information 212 may be set, for example, by the manufacturer of the vehicle V and stored in the storage device 210 during the manufacture of the vehicle V. Alternatively, the required consent information 212 may be obtained from an external server after the user purchases the vehicle V.

[0046] As shown in FIG. 3, the number of functions that can be executed when the driver does not consent to the use of specific personal information among the multiple driving assistance functions is smaller than the number of functions that can be executed when the driver consents to the use of specific personal information among the multiple driving assistance functions. For example, in the example of FIG. 3, the number of functions that can be executed (5) among the eight driving assistance functions when the driver does not consent to the use of camera information is smaller than the number of functions that can be executed (8) among the eight driving assistance functions when the driver consents to the use of camera information. In this way, the driver's personal information is appropriately protected by requiring the driver's consent to execute some functions that use specific personal information among the multiple driving assistance functions provided by vehicle V.

[0047] The type of personal information used by the vehicle V may differ for each driving assistance function. For example, the multiple driving assistance functions may include functions that can be executed when the driver consents to the use of camera information and location information (e.g., an extended assistance function in mode 3 and a lane change function in mode 3). As described above, in mode 3, the driving assistance function is executed using the location information and high-precision map information of the vehicle V. Furthermore, mode 3 may be executed on the condition that the driver is monitoring the surroundings. The controller 1 may use the camera information to determine whether the driver is monitoring the surroundings.

[0048] The driving assistance functions may include a function (e.g., a deceleration function in the event of an abnormality) that is executable when the driver has consented to the use of the camera information, regardless of whether the driver has consented to the use of the location information. The controller 1 may use the camera information to determine whether the driver is normal or abnormal.

[0049] The driving assistance functions may include a function (e.g., a curve deceleration function) that is executable when the driver has consented to the use of the position information, regardless of whether the driver has consented to the use of the camera information. The controller 1 may use the position information to determine whether there is a curve ahead of the vehicle V.

[0050] The authentication information 213 is information (e.g., a pair of a user identifier and a password) used by the user authentication unit 203 to authenticate a user. The authentication information 213 may include a value derived from a password instead of a password. The authentication information 213 may be stored in the storage device 210 by a user of the vehicle V setting his / her user identifier and password in the controller 1.

[0051] The consent information 214 is information indicating whether the driver has consented to the vehicle V using specific personal information. The consent management unit 202 may acquire an instruction from the driver that the driver consents or does not consent to the vehicle V using specific personal information, and update the consent information 214 in response to this instruction. The consent information 214 may store whether the driver has consented or not for each of a plurality of types of personal information individually.

[0052] Referring to FIG. 4, an example of a setting screen 400 used by the vehicle V (e.g., the UI control unit 204) to obtain an instruction from the driver to consent or not consent to the use of specific personal information is shown. The setting screen 400 is displayed, for example, on the display device 5a. The setting screen 400 includes a plurality of toggle switches 401-405 for giving an instruction regarding consent to the use of personal information. In the example of FIG. 4, toggle switches are used as an example of a graphical object for giving an instruction, but other objects such as buttons may also be used.

[0053] The toggle switch 401 is a graphical object for the driver to indicate whether or not he / she agrees to the use of the VIN. The toggle switch 401 is a graphical object for the driver to indicate whether or not he / she agrees to the use of the VIN. The toggle switch 402 is a graphical object for the driver to indicate whether or not he / she agrees to the use of the microphone information. The toggle switch 403 is a graphical object for the driver to indicate whether or not he / she agrees to the use of the camera information. The toggle switch 404 is a graphical object for the driver to indicate whether or not he / she agrees to the use of the location information. The toggle switch 405 is a graphical object for the driver to indicate whether or not he / she agrees to the provision of personal information to a third party. In this way, using the setting screen 400, the consent management unit 202 may individually manage whether or not the driver agrees to the use of each type of personal information. Alternatively, the consent management unit 202 may collectively manage whether or not the driver agrees to the use of personal information regardless of the type of personal information.

[0054] The personal settings information 215 is information about settings associated with a particular user. Each user's personal settings may be stored in association with the driver's user identifier. The personal settings information 215 may include information indicating whether a particular user has consented to the vehicle V using certain personal information. The personal settings information 215 may be set by the user of the vehicle V.

[0055] The change permission flag 216 is information indicating whether to permit or prohibit the driver from changing the consent information 214. For example, when it is determined that the vehicle V is not stopped, the consent management unit 202 may prohibit the driver from changing the consent information 214. On the other hand, when it is determined that the vehicle V is stopped, the consent management unit 202 may permit the driver to change the consent information 214.

[0056] With reference to FIG. 5, an example of a method for the controller 1 of the vehicle V to activate a specific driving assistance function will be described. Activating the specific driving assistance function may be a state in which an instruction to start the specific driving assistance function can be accepted, or may be starting the specific driving assistance function. Each step of the method of FIG. 5 may be performed by the processor of the controller 1 executing a program stored in the memory of the controller 1. Alternatively, some or all of the steps of the method of FIG. 5 may be executed by a dedicated integrated circuit such as an ASIC. The method of FIG. 5 may be started in response to the power supply (e.g., ignition power supply) of the vehicle V being turned on. The method of FIG. 5 may be ended in response to the power supply (e.g., ignition power supply) of the vehicle V being turned off.

[0057] In S501, the controller 1 (e.g., the consent management unit 202) initializes the consent information 214 stored in the storage device 210. For example, the controller 1 may initialize the use of all types of personal information included in the consent information 214 to non-consent. The driver of the vehicle V may be different between the previous use of the vehicle V and the current use of the vehicle V. Therefore, by initializing the consent information 214 when the vehicle V is started, it is possible to prevent personal information from being used against the will of the current driver.

[0058] In S502, the controller 1 (for example, the user authentication unit 203) judges whether the personal authentication of the driver has been successful. If it is judged that the personal authentication of the driver has been successful ("YES" in S502), the controller 1 transitions the process to S503, and otherwise ("NO" in S502), transitions the process to S504. The controller 1 may determine that the personal authentication of the driver has been successful in response to the driver inputting a pair of a user identifier and a password stored in the authentication information 213. Alternatively, the controller 1 may acquire biometric information of the driver, and judge that the personal authentication of the driver has been successful in the case where the biometric information is stored in the authentication information 213.

[0059] In S503, the controller 1 (e.g., the consent management unit 202) reads out the personal setting information 215 stored in association with the user identified by the personal authentication from the storage device 210. If the personal setting information 215 includes a setting regarding consent to the use of personal information, the controller 1 reflects this setting in the consent information 214. By thus performing personal authentication of the driver when starting the vehicle V, the driver can use the consent setting that he or she previously set.

[0060] In S504, the controller 1 (for example, the UI control unit 204) determines whether an instruction to enable a specific driving support function has been acquired from the driver. If it is determined that an instruction to enable a specific driving support function has been acquired from the driver ("YES" in S504), the controller 1 transitions the process to S505, and otherwise ("NO" in S504) repeats S504. The specific driving support function instructed to be enabled in S504 may be any of the driving support functions shown in column 301 of FIG. 3, or may be another driving support function. The instruction to enable a specific driving support function may be acquired in any manner. For example, the driver may give the instruction by pressing a specific button, or may give the instruction by voice.

[0061] In S505, the controller 1 (for example, the driving control unit 201) determines whether consent to the use of specific personal information is required to execute a specific driving support function. If it is determined that consent to the use of specific personal information is required to execute a specific driving support function ("YES" in S505), the controller 1 transitions the process to S506, and otherwise ("NO" in S505) transitions the process to S507. The controller 1 may determine whether consent to the use of specific personal information is required to execute a specific driving support function based on the necessary consent information 212. For example, when the specific driving support function instructed by the driver is an extended support function in mode 3, the controller 1 determines that consent to the use of camera information and position information is required.

[0062] In S506, the controller 1 (for example, the driving control unit 201) determines whether the driver has consented to the controller 1 using the specific personal information. If it is determined that the driver has consented to the controller 1 using the specific personal information ("YES" in S506), the controller 1 transitions the process to S507, and otherwise ("NO" in S506), transitions the process to S508. The controller 1 may determine whether the driver has consented to the controller 1 using the specific personal information based on, for example, the consent information 214. For example, when the specific driving assistance function instructed by the driver is an extended assistance function in mode 3, if the driver has consented to the use of both the camera information and the position information, the controller 1 determines that the driver has consented to the controller 1 using the specific personal information.

[0063] In S507, the controller 1 (for example, the driving control unit 201) activates the instructed driving assistance function. S507 is executed when the instructed driving assistance function does not require consent to the use of specific personal information and when the instructed driving assistance function requires consent to the use of specific personal information and the driver consents to this use.

[0064] S508 is executed when an instruction to enable a specific driving support function is given in a state where the driver has not consented to the use of specific personal information. In S508, the controller 1 (e.g., the UI control unit 204) notifies the driver that consent to the use of specific personal information is required to enable the instructed driving support function. This notification may be given, for example, by displaying a message on the display device 5a or outputting a sound from the audio output device 5b. The controller 1 may notify the driver of the type of personal information (e.g., camera information or location information) for which consent is required.

[0065] In response to this notification, the driver may consent to the use of the personal information through the setting screen 400. Thereafter, in response to the driver giving another instruction to enable a specific driving assistance function, the controller 1 executes steps S504 to S507 to enable the instructed driving assistance function.

[0066] With reference to Fig. 6, an example of a method for the controller 1 of the vehicle V to switch between permission and prohibition of a change operation of the consent information 214 will be described. Each step of the method of Fig. 6 may be performed by a processor of the controller 1 executing a program stored in a memory of the controller 1. Alternatively, some or all of the steps of the method of Fig. 6 may be executed by a dedicated integrated circuit such as an ASIC. The method of Fig. 6 may be started in response to the power supply (e.g., ignition power supply) of the vehicle V being turned on. The method of Fig. 6 may be ended in response to the power supply (e.g., ignition power supply) of the vehicle V being turned off.

[0067] In S601, the controller 1 (e.g., the driving control unit 201) determines whether the vehicle V has started. If it is determined that the vehicle V has started ("YES" in S601), the controller 1 transitions the process to S602, and otherwise ("NO" in S601) repeats S601. The controller 1 may determine that the vehicle V has started when the speed of the vehicle V exceeds a threshold value. The threshold value used in the determination of S601 may be zero or a positive value (e.g., 6 km / h).

[0068] In S602, the controller 1 (for example, the consent management unit 202) prohibits the driver from changing the consent information 214. For example, the controller 1 may set the change permission flag 216 to "prohibited."

[0069] In S603, the controller 1 (e.g., the driving control unit 201) determines whether the vehicle V has stopped. If it is determined that the vehicle V has stopped ("YES" in S603), the controller 1 transitions the process to S604, and otherwise ("NO" in S603) repeats S603. The controller 1 may determine that the vehicle V has stopped when the speed of the vehicle V becomes equal to or lower than a threshold. The threshold used in the determination of S603 may be zero or a positive value (e.g., 2 km / h). In order to provide hysteresis, the threshold used in the determination of S603 may be smaller than the threshold used in the determination of S601. Alternatively, these thresholds may be the same value.

[0070] In S604, the controller 1 (for example, the consent management unit 202) permits the driver to change the consent information 214. For example, the controller 1 may set the change permission flag 216 to "permitted".

[0071] With reference to Fig. 7, an example of a method for the controller 1 of the vehicle V to update the consent information 214 will be described. Each step of the method of Fig. 7 may be performed by the processor of the controller 1 executing a program stored in the memory of the controller 1. Alternatively, some or all of the steps of the method of Fig. 7 may be performed by a dedicated integrated circuit such as an ASIC. The method of Fig. 7 may be started in response to the power supply (e.g., ignition power supply) of the vehicle V being turned on. The method of Fig. 7 may be ended in response to the power supply (e.g., ignition power supply) of the vehicle V being turned off.

[0072] In S701, the controller 1 (for example, the UI control unit 204) determines whether or not a change operation for the consent information 214 has been performed. If it is determined that a change operation for the consent information 214 has been performed ("YES" in S701), the controller 1 transitions the process to S702, and otherwise ("NO" in S701) repeats S701. The change operation for the consent information 214 may be an operation for consenting to the use of personal information, or an operation for canceling consent to the use of the consent information 214. The change operation for the consent information 214 may be an operation of any of the toggle switches 401 to 405 on the setting screen 400, or may be an operation for displaying the setting screen 400.

[0073] In S702, the controller 1 (for example, the consent management unit 202) determines whether or not the change operation of the consent information 214 is permitted. If it is determined that the change operation of the consent information 214 is permitted ("YES" in S702), the controller 1 transitions the process to S703, and otherwise ("NO" in S702), transitions the process to S704. The controller 1 may determine whether or not the change operation of the consent information 214 is permitted based on, for example, the change permission flag 216.

[0074] In S703, the controller 1 (e.g., the consent management unit 202) changes the consent information 214 in accordance with the change operation by the driver. In S704, the controller 1 (e.g., the UI control unit 204) notifies the driver that the change operation of the consent information 214 is prohibited. This notification may be performed, for example, by displaying a message on the display device 5a or outputting a sound from the audio output device 5b. The controller 1 may notify the driver that the vehicle V needs to be stopped in order to perform the change operation.

[0075] In S705, the controller 1 (e.g., the consent management unit 202) determines whether user authentication was performed when the vehicle V was started. If it is determined that user authentication was performed when the vehicle V was started ("YES" in S705), the controller 1 transitions the process to S706, and otherwise ("NO" in S705), transitions the process to S701.

[0076] In S706, the controller 1 (for example, the consent management unit 202) updates the consent settings included in the personal setting information 215 in accordance with the change operation by the driver. This allows the driver to use the changed consent settings by performing user authentication the next time the driver uses the vehicle V.

[0077] In the above embodiment, when it is determined that the vehicle is not stopped, the controller 1 prohibits the driver from changing the consent information 214. Alternatively, the controller 1 may permit the driver to change the consent information 214 regardless of whether the vehicle is stopped or not.

[0078] In the above embodiment, when the user authentication is successful, the controller 1 uses the consent setting included in the personal setting information. Alternatively, the controller 1 may not perform the user authentication, or may not use the consent setting included in the personal setting information when the user authentication is successful.

[0079] In the above embodiment, the controller 1 performs the notification in S508 and S704. Alternatively, the controller 1 may not perform this notification.

[0080] <Summary of the embodiment> [Item 1] A control device (1) for controlling a vehicle (V), A driving control means (201) for providing a plurality of functions related to the driving of the vehicle; a management means (202) for managing consent information (214) relating to whether or not the driver of the vehicle has consented to the vehicle using specific personal information acquired by the vehicle's sensors (9a, 9c, 7b); A control device, wherein the number of functions that can be executed when the driver has not consented to the use of the specific personal information among the plurality of functions is less than the number of functions that can be executed when the driver has consented to the use of the specific personal information among the plurality of functions. According to this article, the driver's consent is required to perform certain functions that use personal information, thereby ensuring adequate protection of the vehicle driver's personal information. [Item 2] The specific personal information includes camera information acquired by a camera (9a) mounted on the vehicle and position information of the vehicle acquired by a positioning sensor (7b) mounted on the vehicle, 2. The control device according to item 1, wherein the management means allows the driver to select whether or not to consent to the use of the camera information and whether or not to consent to the use of the location information. This item ensures that sensitive personal information is properly protected. [Item 3] The functions include: A first function that is executable when the driver consents to the use of the camera information and the use of the location information; a second function executable if the driver has consented to the use of the camera information, regardless of whether the driver has consented to the use of the location information; and a third function that is executable when the driver has consented to the use of the location information, regardless of whether the driver has consented to the use of the camera information. According to this item, the execution of the function is restricted to the extent necessary. [Item 4] The first function is a lane keeping feature that uses the location information to maintain the lane in which the vehicle is traveling; and a lane change function that uses the position information to change the lane in which the vehicle is traveling; The second function is an abnormality deceleration function for decelerating the vehicle in response to an abnormality occurring to the driver; The third function is 4. The control device according to item 3, including a curve deceleration function for decelerating the vehicle before a curve. According to this item, the execution of the function is restricted to the extent necessary. [Item 5] The control device includes an authentication means (203) for performing personal authentication of the driver when the vehicle is started, The management means reads out the consent information stored in association with the driver from a storage device (210); 2. The control device according to claim 1, wherein the driving control means determines whether each of the plurality of functions is executable based on the read consent information. This option allows the driver to use any previously agreed settings. [Item 6] 2. The control device according to claim 1, wherein the management means prohibits the driver from changing the consent information when it is determined that the vehicle is not stopped. According to this item, the influence of the change operation on the driving operation can be reduced. [Item 7] An acquisition means (204) for acquiring an instruction to enable a function that uses the specific personal information from the driver; The control device described in item 1 further comprises a notification means (204) for notifying the driver that consent to the use of the specific personal information is required when the activation instruction is given in a state in which the driver has not consented to the use of the specific personal information. This item lets the driver know that consent is required. [Item 8] A program for causing a computer to function as the control device according to any one of items 1 to 7. According to this item, a program having the above-mentioned advantages is provided. [Item 9] A vehicle (V) equipped with a control device according to any one of items 1 to 7. According to this item, a vehicle is provided having the advantages discussed above. [Item 10] A control method for controlling a vehicle (V), comprising: A driving control step (S507) for providing a plurality of functions related to the driving of the vehicle; A management step (S703) of managing consent information regarding whether or not the driver of the vehicle has consented to the vehicle using specific personal information acquired by a sensor of the vehicle, A control method, wherein the number of functions among the plurality of functions that can be executed when the driver has not consented to the use of the specific personal information is less than the number of functions among the plurality of functions that can be executed when the driver has consented to the use of the specific personal information. According to this article, the driver's consent is required to perform certain functions that use personal information, thereby ensuring adequate protection of the vehicle driver's personal information.

[0081] The invention is not limited to the above-described embodiment, and various modifications and variations are possible within the scope of the gist of the invention. [Explanation of symbols]

[0082] V vehicle, 1 controller, 201 driving control unit, 202 consent management unit, 214 consent information

Claims

1. A control device for controlling a vehicle, A driving control means for providing a plurality of functions related to the driving of the vehicle; A management means for managing consent information regarding whether or not a driver of the vehicle has consented to the vehicle using specific personal information acquired by a sensor of the vehicle, The number of functions that can be executed when the driver has not consented to the use of the specific personal information among the plurality of functions is smaller than the number of functions that can be executed when the driver has consented to the use of the specific personal information among the plurality of functions; The specific personal information includes camera information acquired by a camera mounted on the vehicle and position information of the vehicle acquired by a positioning sensor mounted on the vehicle, A control device, wherein the management means allows the driver to select whether or not to consent to the use of the camera information and whether or not to consent to the use of the location information.

2. The functions include: a first function executable when the driver consents to the use of the camera information and the use of the location information; a second function executable if the driver has consented to the use of the camera information, regardless of whether the driver has consented to the use of the location information; and a third function executable if the driver has consented to the use of the location information, regardless of whether the driver has consented to the use of the camera information.

3. The first function is a lane keeping feature that uses the location information to maintain the lane in which the vehicle is traveling; and a lane change function that uses the position information to change a lane in which the vehicle is traveling; The second function is an abnormality deceleration function for decelerating the vehicle in response to an abnormality occurring to the driver; The third function is The control device according to claim 2 , further comprising a curve deceleration function for decelerating the vehicle before a curve.

4. The control device includes an authentication means for performing personal authentication of the driver when the vehicle is started, The management means reads out the consent information stored in association with the driver from a storage device, The control device according to claim 1 , wherein the driving control means determines whether each of the plurality of functions is executable based on the read consent information.

5. The control device according to claim 1 , wherein the management means prohibits the driver from changing the consent information when it is determined that the vehicle is not stopped.

6. An acquisition means for acquiring an instruction to enable a function that uses the specific personal information from the driver; The control device as described in claim 1, further comprising a notification means for notifying the driver that consent to the use of the specific personal information is required when the activation instruction is given without the driver having consented to the use of the specific personal information.

7. A control device for controlling a vehicle, comprising: A driving control means for providing a plurality of functions related to the driving of the vehicle; A management means for managing consent information regarding whether or not a driver of the vehicle has consented to the vehicle using specific personal information acquired by a sensor of the vehicle, When a function among the plurality of functions that requires the specific personal information that the driver has not consented to be used by the vehicle in order to provide the function is enabled, the execution of the function is suppressed by suppressing the enablement of the function; The specific personal information includes camera information acquired by a camera mounted on the vehicle and position information of the vehicle acquired by a positioning sensor mounted on the vehicle, A control device, wherein the management means allows the driver to select whether or not to consent to the use of the camera information and whether or not to consent to the use of the location information.

8. A program for causing a computer to function as the control device according to any one of claims 1 to 7.

9. A vehicle comprising the control device according to any one of claims 1 to 7.

10. 1. A control method for controlling a vehicle, comprising: A driving control process for providing a plurality of functions related to driving of the vehicle; A management step of managing consent information regarding whether or not a driver of the vehicle has consented to the vehicle using specific personal information acquired by a sensor of the vehicle, The number of functions that can be executed when the driver has not consented to the use of the specific personal information among the plurality of functions is smaller than the number of functions that can be executed when the driver has consented to the use of the specific personal information among the plurality of functions; The specific personal information includes camera information acquired by a camera mounted on the vehicle and position information of the vehicle acquired by a positioning sensor mounted on the vehicle, A control method in which, in the management step, the driver can select whether or not to consent to the use of the camera information and whether or not to consent to the use of the location information.

11. A control method for controlling a vehicle, comprising: A driving control process for providing a plurality of functions related to driving of the vehicle; A management step of managing consent information regarding whether or not a driver of the vehicle has consented to the vehicle using specific personal information acquired by a sensor of the vehicle, When a function among the plurality of functions that requires the specific personal information that the driver has not consented to be used by the vehicle in order to provide the function is enabled, the execution of the function is suppressed by suppressing the enablement of the function; The specific personal information includes camera information acquired by a camera mounted on the vehicle and position information of the vehicle acquired by a positioning sensor mounted on the vehicle, A control method in which, in the management step, the driver can select whether or not to consent to the use of the camera information and whether or not to consent to the use of the location information.

Images