Vehicle control device, control method, and program

Abstract

To improve convenience of a vehicle control function.SOLUTION: A control device for a vehicle includes: a reception section which receives, from a server, first authority information indicating whether a user of the vehicle has authority to use a specific vehicle control function; an update section which, on the basis of the first authority information, updates second authority information indicating whether the user has the authority to use the specific vehicle control function, the second authority information being stored in a storage device of the vehicle; and a vehicle control section which executes the vehicle control function at least partly on the basis that the second authority information indicates that the user has the use authority.SELECTED DRAWING: Figure 4

Description

Technical Field

[0001] The present invention relates to a vehicle control device, a control method, and a program.

Background Art

[0002] In recent years, efforts have been actively made to provide access to a sustainable transport system that takes into account people in vulnerable positions among traffic participants. Toward this realization, research and development focusing on further improving traffic safety and convenience through research and development of driving support technologies has been carried out. A business model is known in which a specific function of a vehicle can be executed only when a user has the right to use it. Patent Document 1 describes that a function can be used in a plurality of vehicles based on user license data.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] A configuration in which a server centrally manages whether a user has the right to use a specific vehicle control function can be considered. In a configuration where a vehicle always inquires of the server about the right to use, if the vehicle cannot access the server, the vehicle cannot determine whether the user has the right to use, and the user cannot use the vehicle control function. The present application aims to achieve a technology for improving the convenience of vehicle control functions in order to solve the above problems. And, by extension, it contributes to the development of a sustainable transport system.

Means for Solving the Problems

[0005] According to an embodiment, there is provided a vehicle control device including: a receiving unit configured to receive from a server first authority information indicating whether a user of the vehicle has a usage right to a specific vehicle control function; an updating unit configured to update second authority information indicating whether the user has the usage right to the specific vehicle control function, the second authority information being stored in a storage device of the vehicle, based on the first authority information; and a vehicle control unit configured to execute the vehicle control function based at least in part on the second authority information indicating that the user has the usage right. When the first authority information indicates that the user does not have the usage authority, the update means waits for the update of the second authority information until the driving of the vehicle ends. , a control device is provided.

Advantages of the Invention

[0006] According to an embodiment, the convenience of a vehicle control function is improved.

Brief Description of the Drawings

[0007]

Figure 1

Figure 2

Figure 3

Figure 4

Modes for Carrying Out the Invention

[0008] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. It should be noted that the following embodiments do not limit the invention according to the claims, and not all combinations of the features described in the embodiments are essential for the invention. Two or more of the features described in the embodiments may be arbitrarily combined. Also, the same or similar configurations are denoted by the same reference numerals, and redundant descriptions are omitted.

[0009] FIG. 1 is a block diagram of a control device CNT according to an embodiment of the present invention and a schematic diagram of a vehicle V as an application example thereof. In FIG. 1, the outline of the vehicle V is shown in a plan view and a side view. The vehicle V of the present embodiment is, as an example, a four-wheel sedan-type passenger car and can be, for example, a parallel hybrid vehicle. The vehicle V is not limited to a four-wheel passenger car and may be a saddle-riding type vehicle (motorcycle, three-wheeled vehicle) or a large vehicle such as a truck or a bus.

[0010] The control device CNT includes a controller 1 which is an electronic circuit that executes control of the vehicle V including driving support of the vehicle V. The controller 1 includes a plurality of ECUs (Electronic Control Units). The ECUs are provided, for example, for each function of the control device CNT. Each ECU includes a processor represented by a CPU (Central Processing Unit), a storage device such as a semiconductor memory, and an interface with an external device. Programs executed by the processor and data used by the processor for processing are stored in the storage device. The interface includes an input / output interface and a communication interface. Each ECU may include a plurality of processors, a plurality of storage devices, and a plurality of interfaces. The programs stored in the storage device may be stored in the storage device by being installed in the control device CNT using a storage medium such as a CD-ROM. In addition to or instead of this, the programs stored in the storage device may be downloaded from an external server through wireless communication.

[0011] The controller 1 controls the driving (acceleration) of the vehicle V by controlling the power unit (power plant) 2. The power unit 2 is a traveling drive unit that outputs a driving force for rotating the drive wheels of the vehicle V and can include an internal combustion engine, a motor, and an automatic transmission. The motor can be used as a drive source for accelerating the vehicle V and can also be used as a generator during deceleration (regenerative braking).

[0012] In the case of this embodiment, the controller 1 controls the output of the internal combustion engine or the motor and switches the gear position of the automatic transmission in response to the driving operation of the driver detected by the operation detection sensor 2a provided on the accelerator pedal AP or the operation detection sensor 2b provided on the brake pedal BP, and the vehicle speed of the vehicle V detected by the rotation speed sensor 2c. The automatic transmission is provided with a rotation speed sensor 2c that detects the rotation speed of the output shaft of the automatic transmission as a sensor for detecting the running state of the vehicle V. The vehicle speed of the vehicle V can be calculated from the detection result of the rotation speed sensor 2c.

[0013] The controller 1 controls the braking (deceleration) of the vehicle V by controlling the hydraulic device 3. The braking operation of the driver on the brake pedal BP is converted into hydraulic pressure in the brake master cylinder BM and transmitted to the hydraulic device 3. The hydraulic device 3 is an actuator capable of controlling the hydraulic pressure of the hydraulic oil supplied to the brake devices 3a (for example, disk brake devices) provided on the four wheels based on the hydraulic pressure transmitted from the brake master cylinder BM.

[0014] The controller 1 can control the braking of the vehicle V by performing drive control of solenoid valves and the like provided in the hydraulic device 3. Further, the controller 1 can also configure an electric servo brake system by controlling the distribution of the braking force by the brake device 3a and the braking force by the regenerative braking of the motor provided in the power unit 2. The controller 1 may turn on the brake lamp 3b during braking.

[0015] The controller 1 controls the steering of the vehicle V by controlling the electric power steering device 4. The electric power steering device 4 includes a mechanism for steering the front wheels in response to a driving operation (steering operation) of the driver with respect to the steering wheel ST. The electric power steering device 4 includes a drive unit 4a that exerts a driving force (sometimes referred to as steering assist torque) for assisting the steering operation or automatically steering the front wheels of the vehicle V. The drive unit 4a includes a motor as a drive source. Further, the electric power steering device 4 includes a steering angle sensor 4b for detecting the steering angle, a torque sensor 4c for detecting the steering torque borne by the driver (referred to as steering load torque and distinguished from the steering assist torque), and the like.

[0016] The controller 1 controls the electric parking brake device 3c provided on the rear wheels of the vehicle V. The electric parking brake device 3c includes a mechanism for locking the rear wheels. The controller 1 can control the locking and unlocking of the rear wheels by the electric parking brake device 3c.

[0017] The controller 1 controls the information output device 5 for notifying information inside the vehicle. The information output device 5 includes, for example, a display device 5a for notifying the driver of information by an image and / or a voice output device 5b for notifying the driver of information by voice. The display device 5a includes, for example, a display device provided on the instrument panel and a display device provided on the steering wheel ST. Further, the display device 5a may include a head-up display. The information output device 5 may notify the passengers of information by vibration or light.

[0018] The controller 1 receives an instruction input from a passenger (e.g., the driver) via the input device 6. The input device 6 is arranged at a position operable by the driver and includes, for example, a switch group 6a for the driver to give an instruction to the vehicle V and / or a turn signal lever 6b for operating the turn signal (winker).

[0019] The controller 1 recognizes and determines the current position and route (posture) of the vehicle V. In the case of this embodiment, the vehicle V is provided with a gyro sensor 7a, a GNSS (Global Navigation Satellite System) sensor 7b, and a communication device 7c. The gyro sensor 7a detects the rotational movement (yaw rate) of the vehicle V. The GNSS sensor 7b detects the current position of the vehicle V. Further, the communication device 7c performs wireless communication with a server that provides map information and traffic information, and acquires these information. In the case of this embodiment, the controller 1 determines the route of the vehicle V based on the detection results of the gyro sensor 7a and the GNSS sensor 7b, and sequentially acquires map information regarding the route from the server via the communication device 7c and stores it in a database 7d (storage device). The vehicle V may be provided with other sensors for detecting the state of the vehicle V, such as an acceleration sensor that detects the acceleration of the vehicle V.

[0020] The controller 1 executes driving support for the vehicle V based on the detection results of various detection units provided in the vehicle V. The vehicle V is provided with ambient detection units 8a to 8b that are external sensors (surrounding situation) for detecting the outside of the vehicle V, and in-vehicle detection units 9a to 9b that are in-vehicle sensors for detecting the situation inside the vehicle (the state of the occupant (especially the driver)). The controller 1 can grasp the surrounding situation of the vehicle V based on the detection results of the ambient detection units 8a to 8b and execute driving support according to the surrounding situation. Further, the controller 1 can determine whether the driver is performing a predetermined operation obligation imposed on the driver when executing driving support based on the detection results of the in-vehicle detection units 9a to 9b.

[0021] The ambient detection unit 8a is an imaging device that captures the front of the vehicle V (hereinafter, may be referred to as the front camera 8a), and is attached, for example, to the vehicle interior side of the front window at the front part of the roof of the vehicle V. The controller 1 can extract the contour of the target and the lane dividing lines (white lines, etc.) on the road by analyzing the image captured by the front camera 8a.

[0022] The surrounding detection unit 8b is a millimeter-wave radar (hereinafter sometimes referred to as radar 8b), which uses radio waves to detect targets around the vehicle V, and detects (measures) the distance to the target and the direction (azimuth) of the target with respect to the vehicle V. In the example shown in FIG. 1, five radars 8b are provided, one at the center of the front part of the vehicle V, one at each of the left and right front corners, and one at each of the left and right rear corners.

[0023] The surrounding detection unit provided in the vehicle V is not limited to the above configuration, and the number of cameras and the number of radars may be changed, or a lidar (Light Detection and Ranging) for detecting targets around the vehicle V may be provided.

[0024] The in-vehicle detection unit 9a is an imaging device for photographing the interior of the vehicle (hereinafter sometimes referred to as in-vehicle camera 9a), and is attached, for example, to the inside of the vehicle compartment at the front part of the roof of the vehicle V. In the case of this embodiment, the in-vehicle camera 9a is a driver monitoring camera for photographing the driver (for example, the driver's eyes and face). The controller 1 can determine the driver's line of sight and the direction of the face by analyzing the image (driver's face image) captured by the in-vehicle camera 9a.

[0025] The in-vehicle detection unit 9b is a grip sensor for detecting the driver's grip on the steering wheel ST (hereinafter sometimes referred to as grip sensor 9b), and is provided, for example, on at least a part of the steering wheel ST. As the in-vehicle detection unit, a torque sensor 4c for detecting the driver's steering torque may be used.

[0026] As driving support for the driver of the vehicle V, for example, acceleration / deceleration support, lane keeping support, and lane change support are included. The acceleration / deceleration support is a driving support (ACC: Adaptive Cruise Control) that automatically controls the acceleration and deceleration of the vehicle V within a predetermined vehicle speed by the controller 1 automatically controlling the power unit 2 and the hydraulic device 3 based on the detection results of the surrounding detection unit 8 and the map information. In ACC, when there is a preceding vehicle, it is also possible to accelerate and decelerate the vehicle V so as to maintain the inter-vehicle distance from the preceding vehicle. By ACC, the driver's operation burden of acceleration / deceleration operations (operations on the accelerator pedal AP and the brake pedal BP) is reduced.

[0027] The lane keeping support is a driving support (LKAS: Lane Keeping Assist System) that maintains the vehicle V inside the lane by the controller 1 automatically controlling the electric power steering device 4 based on the detection results of the surrounding detection unit 8 and the map information. By LKAS, the driver's operation burden of steering operations (operations on the steering wheel ST) during straight driving of the vehicle V is reduced.

[0028] The lane change support is a driving support (ALC: Auto Lane Changing, ALCA: Active Lane Change Assist) that automatically changes the traveling lane of the vehicle V to an adjacent lane by the controller 1 automatically controlling the power unit 2, the hydraulic device 3, and the electric power steering device 4 based on the detection results of the surrounding detection unit 8 and the map information. ALC is a lane change support based on system requirements, and ALCA is a lane change support based on passenger requirements. Examples of system requirements include when a navigation system that guides the route of the vehicle V to the destination requests a lane change of the vehicle V, or when overtaking a preceding vehicle regardless of the presence or absence of route guidance. When making a passenger request, the driver operates an input device (for example, the turn signal lever 6b) to instruct a lane change. By ALC or ACLA, the driver's operation burden of acceleration / deceleration operations and steering operations of the vehicle V during lane change is reduced.

[0029] As another example of driving support control, for example, by controlling the hydraulic device 3, a collision mitigation brake, an ABS function, traction control, and / or attitude control of the vehicle V that assist in avoiding collisions with objects on the road (e.g., pedestrians, other vehicles, or obstacles) may be included.

[0030] In some embodiments, the controller 1 selectively executes one of three modes 1 to 3 with different driving support contents. The mode may be called a state. Hereinafter, the case where ACC, LKAS, ALC, or ACLA is provided as driving support will be described. However, the driving support contents of each of the modes 1 to 3 are not limited to ACC, LKAS, ALC, or ACLA, and may include other driving support contents. Also, only one of ALC and ACLA may be used.

[0031] Mode 1 is a manual driving mode in which none of ACC, LKAS, ALC, and ACLA are executed, and is a mode based on the driver's manual driving operation. It is the mode first set when the vehicle V is started.

[0032] Modes 2 and 3 are modes set on the condition that the occupant gives a driving support instruction in Mode 1. Mode 2 is a normal support mode in which ACC and LKAS can be executed. In Mode 2, ALC and ACLA are not executed.

[0033] Mode 3 is an extended support mode in which all of ACC, LKAS, ALC, and ACLA can be executed. The extended support mode may also be called the AHD (Advanced Highway Driving) mode. Mode 3 is a mode on the premise that the controller 1 has acquired high-precision map information including information on the road (travel route) on which the vehicle V is traveling. The high-precision map information is map information having higher-precision information on road information than the map information (sometimes called normal map information) used for route guidance to the destination. Specifically, the high-precision map information may have at least the position information within the lane. This can be used to control the position of the vehicle V in the vehicle width direction. The high-precision map information may further include information on the detailed shape of the road, such as the presence or absence of curves and their curvatures, the increase or decrease of lanes, and gradients. The high-precision map information is prepared, for example, for each region or road section, and there may be regions or road sections where the high-precision map information is not deployed.

[0034] In Mode 3, lane change support (ALC and ACLA) is performed by using this high-precision map information. By utilizing the position information within the lane included in the high-precision map information and the current position of the vehicle V detected by the GNSS sensor 7b, while recognizing surrounding other vehicles from the external detection results of the detection units 8a to 8b, highly reliable and smooth lane change support can be performed. The lane change support may be performed without using the high-precision map information.

[0035] Both Mode 2 and Mode 3 are modes in which ACC and LKAS can be executed. However, in Mode 3, ACC and LKAS using high-precision map information can be executed. The controller 1 can anticipate the road information ahead of the vehicle V from the high-precision map information and perform acceleration / deceleration and left / right position control of the vehicle V, and can provide the passengers with more reliable and smooth ACC and LKAS.

[0036] Vehicle control functions such as the driving support functions according to the above-mentioned Mode 2 and Mode 3 may be made executable by a provider of the vehicle control function (for example, the manufacturer of vehicle V) adding the use right of the vehicle control function to the user of vehicle V. The user of vehicle V may be called an occupant of vehicle V when riding in vehicle V. Also, the user of vehicle V may be called a driver of vehicle V when driving vehicle V. In the following description, the user of vehicle V will simply be referred to as the user. The use right of the vehicle control function may be granted, for example, by the user concluding a contract with the provider of the vehicle control function after the start of use of vehicle V. With reference to FIG. 2, a configuration example of a function providing system 200 for providing a vehicle control function that requires a use right will be described.

[0037] The function providing system 200 may include, for example, vehicle V, a user management server 201, a map distribution server 202, and a user device 203. In the example of FIG. 2, only one vehicle V is shown, but the function providing system 200 may include a plurality of vehicles. Similarly, the function providing system 200 may include a plurality of user devices 203. Vehicle V, the user management server 201, the map distribution server 202, and the user device 203 may be communicable through a network 204. The network 204 may include a local area network (LAN), a wide area network (WAN), the Internet, a cellular network, or any combination thereof. The communication between vehicle V and the network 204 is typically wireless communication.

[0038] The user management server 201 manages user information. For example, the user management server 201 may grant the use right of the vehicle control function to the user in response to a request from the user. The request for granting the use right may be made by the user using the user device 203. The user device 203 is a device used by the user and may be, for example, a personal computer, a mobile phone, a smartphone, a tablet computer, or the like. The request for granting the use right may also be made by the user using vehicle V.

[0039] The request for granting the usage authority may include the user's account information and the identification information of the vehicle (e.g., vehicle V) for which the vehicle control function is to be executable. The user's account information is information for the user management server 201 to uniquely identify the user. The identification information of the vehicle may be a vehicle identification number (VIN). The request for granting the usage authority may include a designation of the type of vehicle control function for which the usage authority is to be granted. The vehicle control function for which the usage authority is to be granted may be the entire AHD described above, a part of the functions therein (e.g., ALC or ALCA), another driving assistance function, or a function other than the driving assistance function.

[0040] In response to a request from a user, the user management server 201 grants the user the right to use a vehicle control function specified by the user for a vehicle (e.g., vehicle V) specified by the user. The granting of the right to use may be for a fee or free of charge. The user management server 201 may set an expiration date for the right to use. When the expiration date has passed, the right to use is cancelled. The user may be able to extend the expiration date by updating the right to use before it expires. The user management server 201 may store, for each user to be managed, the user's account information, the vehicle identification information, the vehicle control functions that the user has the right to use, and the expiration date of the right to use (if set), in association with each other.

[0041] Vehicle V (specifically, its controller 1, and the same applies hereinafter) may inquire the server as to whether the user has the right to use a specific vehicle control function. This inquiry may include the user's account information and the identification information of vehicle V. In response to receiving an inquiry including the user's account information and the identification information of vehicle V, user management server 201 refers to the user information it manages and determines whether the user has the usage rights associated with this information. When the user has the usage rights, user management server 201 transmits information indicating the vehicle control functions that the user has the usage rights to vehicle V. When an expiration date is set for this usage right, user management server 201 also transmits this expiration date to vehicle V. When the user does not have the usage rights, user management server 201 may transmit information indicating that the user does not have any vehicle control functions that the user has the usage rights to vehicle V. In this way, vehicle V obtains from user management server 201 information indicating whether the user has the right to use a specific vehicle control function, and the expiration date if it is set. Vehicle V may store this information and use it for subsequent processing.

[0042] Vehicle V may transmit information indicating the state of vehicle V to user management server 201. The information indicating the state of vehicle V may include, for example, information regarding a failure occurring in vehicle V. User management server 201 may use the information indicating the state of vehicle V to notify user device 203. For example, when user management server 201 receives information from vehicle V indicating that a failure has occurred in vehicle V, it may notify user device 203 of this fact.

[0043] Map distribution server 202 is an example of a server that provides information used by vehicle V to execute a specific vehicle control function. Map distribution server 202 may provide map information (for example, high-precision map information as described above) as such information. Map distribution server 202 may provide map information to vehicle V at least based on the fact that the user has the right to use the map information.

[0044] For example, in order for the vehicle V to acquire map information from the map distribution server 202, the user may transmit information indicating that the user has the right to use the map information to the map distribution server 202. This information may be a token provided by the user management server 201. When the map distribution server 202 determines that the user has the right to use the map information, the map distribution server 202 may transmit the map information to the vehicle V.

[0045] Referring to FIG. 3, an example of a method for the controller 1 of the vehicle V to start executing a specific vehicle control function will be described. Each step of the method in FIG. 3 may be performed by a processor of the controller 1 executing a program stored in the memory of the controller 1. Alternatively, some or all of the steps of the method in FIG. 3 may be performed by a dedicated integrated circuit such as an application specific integrated circuit (ASIC).

[0046] The method in FIG. 3 may be started in response to the power supply (for example, the ignition power supply) of the vehicle V being turned on. Further, the method in FIG. 3 may be started in response to the user logging in to the vehicle V using his or her account information. For example, the user may input his or her account information to the input device 6. The controller 1 may determine whether the account information input by the user matches the account information registered in the vehicle V. When these account information match, the controller 1 may execute subsequent processing using the matched account information. Thereby, it is possible to suppress the execution of the vehicle control function when a person other than the user having the right to use uses the vehicle V.

[0047] In S301, the controller 1 determines whether it has received an instruction from the user to execute a specific vehicle control function. If the controller 1 determines that it has received an instruction from the user to execute a specific vehicle control function (i.e., "YES" in S301), the process transitions to S302. Otherwise (i.e., "NO" in S301), S301 is repeated. In this way, the controller 1 waits for an instruction to execute a specific vehicle control function. The specific vehicle control function may be, for example, a driving assistance function of the vehicle V, and may be, for example, ACC, LKAS, ALC, ACLA, as described above, or a combination thereof.

[0048] In S302, the controller 1 determines whether the user has the right to use the instructed vehicle control function. If the controller 1 determines that the user has the right to use the instructed vehicle control function (i.e., "YES" in S302), the process transitions to S303. Otherwise (i.e., "NO" in S302), the process transitions to S307. If it is determined that the user does not have the right to use the instructed vehicle control function, in S307, the controller 1 notifies the user that the instructed vehicle control function cannot be executed. Further, the controller 1 may notify the user that the user does not have the authority. In this case, the controller 1 may guide the user on how to obtain the authority (for example, the method of applying for a usage contract).

[0049] Before S301 is executed, the controller 1 may obtain information indicating whether the user has the right to use a specific vehicle control function from the user management server 201 and store it in the memory of the controller 1. For example, the controller 1 may send an inquiry to the user management server 201 regarding whether the user has the right to use a specific vehicle control function in response to the ignition power of the vehicle V being turned on. The controller 1 may determine that the user does not have the right to use if the expiration date of the right to use has passed. The program for realizing a specific vehicle control function may be stored in the vehicle V in advance (for example, at the time of manufacturing the vehicle V), or may be downloaded to the vehicle V after the right to use this function is granted to the user.

[0050] In S303, the controller 1 determines whether the user has consented to the controller 1 using personal information. When it is determined that the user has consented to the use of personal information ( "YES" in S303), the process proceeds to S304, and in other cases ( "NO" in S303), the process proceeds to S307. If it cannot be confirmed that the user has consented to the use of personal information, the controller 1 notifies the user in S307 that the instructed vehicle control function cannot be executed. Further, the controller 1 may notify the user that it could not be confirmed that the user has consented to the use of personal information. In this case, the controller 1 may guide the user on how to consent to the use of personal information (for example, present a screen for the user to consent to the use of personal information).

[0051] Consent regarding the use of personal information may be given to the vehicle V, and the controller 1 may store the fact of consent in the memory and use it for subsequent processing. Instead of or in addition to this, consent regarding the use of personal information may be given to the user management server 201 through the user device 203. The controller 1 may obtain information indicating that the user has consented to the use of personal information from the user management server 201 and store it in the memory for subsequent processing.

[0052] Depending on the content of the vehicle control function, personal information of the user may be used. For example, when using highly accurate map information as described above, the current position of the vehicle V is provided to the map distribution server 202. Since the current position of the vehicle V coincides with the current position of the user, it may correspond to personal information. Also, an image of the user captured by the in-vehicle camera 9a may also correspond to personal information. In order to use such personal information, depending on the country, consent of the user may be required by law. If the instructed vehicle control function does not use personal information, S303 may be omitted. When the vehicle V is used in a country that does not have a law requiring consent of the user to use personal information, S303 may be omitted.

[0053] In S304, the controller 1 determines whether it is preset by the user to enable the execution of the instructed vehicle control function. When the controller 1 determines that it is preset by the user to enable the execution of the instructed vehicle control function ( "YES" in S304), the process transitions to S305, and in other cases ( "NO" in S304), it transitions to S307. When it is determined that it is not preset by the user to enable the execution of the instructed vehicle control function, the controller 1 notifies the user in S307 that the instructed vehicle control function cannot be executed. Further, the controller 1 may notify the user that the setting to enable the execution of the instructed vehicle control function is not set. In this case, the controller 1 may guide the user on a method for setting to enable the execution of the instructed vehicle control function (for example, present a screen for setting to enable the execution of the instructed vehicle control function to the user).

[0054] Information indicating whether it is set to enable the execution of the indicated vehicle control function may be stored in the memory of the controller 1, and the processor of the controller 1 may refer to this information. In S301, the user may inadvertently give an instruction to execute a specific vehicle control function (for example, accidentally touch a button for giving an instruction). Therefore, the controller 1 may regard it as a prerequisite for executing this function that the user has previously set to enable the execution of a specific vehicle control function. If such a prerequisite is not necessary, S304 may be omitted.

[0055] In S305, the controller 1 determines whether the indicated vehicle control function is in an executable state. When it is determined that the indicated vehicle control function is in an executable state (in S305, "YES"), the controller 1 transitions the process to S306, and in other cases (in S305, "NO"), it transitions to S307. When it is determined that the indicated vehicle control function is not in an executable state, in S307, the controller 1 notifies the user that the indicated vehicle control function cannot be executed. Further, the controller 1 may notify the user that the indicated vehicle control function is not in an executable state.

[0056] For example, when the indicated vehicle control function requires high-precision map information and the high-precision map information is not in a usable state, the controller 1 may determine that this function is not in an executable state. When the indicated vehicle control function is executable only in a specific driving environment (for example, a highway) and the vehicle V is not in such a driving environment, the controller 1 may determine that this function is not in an executable state. When the indicated vehicle control function requires an initial check of a sensor (for example, a radar) and such an initial check has not been completed, the controller 1 may determine that this function is not in an executable state.

[0057] In S306, the controller 1 executes the instructed vehicle control function. Thereafter, the controller 1 controls the vehicle V according to the vehicle control function. When the vehicle control function is terminated according to the user's instruction or the change of the driving environment, the controller 1 may execute the method of FIG. 3 again and wait for an instruction to execute a specific vehicle control function. The instructed vehicle control function may use the map information provided by the map distribution server 202. The controller 1 may receive map information from the map distribution server 202 during the execution of the vehicle control function.

[0058] The above determination in S302 (that is, the determination as to whether the user has the use right of the instructed vehicle control function) may be made based on the authority information stored in the storage device of the vehicle V (for example, the memory of the controller 1). The authority information may be information indicating whether the user has the use right of a specific vehicle control function. In the following description, the authority information stored in the storage device of the vehicle V is referred to as internal authority information. For example, when the internal authority information indicates that the user has the use right, the controller 1 may determine "YES" in S302, and when the internal authority information indicates that the user does not have the use right, the controller 1 may determine "NO" in S302. Therefore, as described above in FIG. 3, the controller 1 may execute a specific vehicle control function at least partially based on the internal authority information indicating that the user has the use right. Thus, even when the controller 1 cannot communicate with the user management server 201 at the time of receiving the instruction in S301, the controller 1 can execute a specific vehicle control function by satisfying the conditions of S302 to S305.

[0059] The controller 1 may update the internal permission information based on the permission information received from the user management server 201. In the following description, the permission information received from the user management server 201 is referred to as external permission information. The external permission information is information indicating whether a user has the right to use a specific vehicle control function, and may be information managed by the user management server 201. The user management server 201 may update the external permission information so as to indicate that the user has the right to use it in response to granting the user the right to use it in response to a request from the user. The user management server 201 may revoke the user's right to use it in response to a request from the user or when the expiration date of the right to use has passed, and update the external permission information so as to indicate that the user does not have the right to use it.

[0060] Referring to FIG. 4, an example of a method for the controller 1 of the vehicle V to manage the internal permission information will be described. Each step of the method in FIG. 4 may be performed by a processor of the controller 1 executing a program stored in the memory of the controller 1. Alternatively, some or all of the steps of the method in FIG. 4 may be performed by a dedicated integrated circuit such as an ASIC. The method in FIG. 4 may be started in response to the power supply (e.g., ignition power supply) of the vehicle V being turned on. Before the start of the method in FIG. 4, an initial value may be set in the internal permission information. The initial value may indicate that the user does not have the right to use it.

[0061] In S401, the controller 1 determines whether it has received external permission information from the user management server 201. If the controller 1 determines that it has received external permission information from the user management server 201 (i.e., "YES" in S401), the process transitions to S402. Otherwise (i.e., "NO" in S401), the process transitions to S406. The controller 1 may inquire of the user management server 201 about external permission information at a predetermined timing, and may receive external permission information as a response to this inquiry. For example, the controller 1 may inquire about external permission information in response to the power supply (e.g., ignition power supply) of the vehicle V being turned on, may inquire about external permission information periodically, or may inquire about external permission information in response to a predetermined length (e.g., three days) until the expiration date of the usage permission.

[0062] The user management server 201 may transmit external permission information to the vehicle V mainly (i.e., regardless of an inquiry from the vehicle V), and the vehicle V may receive this external permission information. The user management server 201 may transmit external permission information to the vehicle V periodically, or may transmit external permission information to the vehicle V in response to the external permission information being updated (e.g., in response to granting a usage permission to a user or revoking a user's usage permission).

[0063] In S402, the controller 1 determines whether the external permission information received in S401 matches the internal permission information. If the controller 1 determines that the external permission information and the internal permission information match (i.e., "YES" in S402), the process transitions to S401. Otherwise (i.e., "NO" in S402), the process transitions to S403. When the external permission information and the internal permission information match, there is no need to update the internal permission information, so the controller 1 transitions to S401 and waits to receive new external permission information.

[0064] In S403, the controller 1 determines whether the external authority information indicates that the user does not have the usage authority. When it is determined that the external authority information indicates that the user does not have the usage authority ( "YES" in S403), the process transitions to S404, and in other cases ( "NO" in S403), the process transitions to S405.

[0065] When the external authority information indicates that the user has the usage authority and the internal authority information indicates that the user does not have the usage authority, in S405, the controller updates the internal authority information so as to indicate that the user has the usage authority. Such an update to grant the usage authority may be executed immediately without executing S404.

[0066] In S404, the controller 1 determines whether the vehicle V is in motion. When it is determined that the vehicle V is in motion ( "YES" in S404), S404 is repeated, and in other cases ( "NO" in S404), the process transitions to S405. When the vehicle V is in motion, the controller 1 waits for the transition to S405 until the running of the vehicle V ends.

[0067] The controller 1 may determine whether the running of the vehicle V has ended based on at least one of the vehicle V's speed becoming zero, the vehicle V's shift position becoming the parking range, the vehicle V's parking brake being actuated, and the vehicle V's power source (for example, the ignition power source) being turned off. These conditions may be arbitrarily combined. For example, the controller 1 may determine that the running of the vehicle V has ended based on the vehicle V's shift position becoming the parking range and the vehicle V's parking brake being actuated.

[0068] When the external authority information indicates that the user does not have the usage authority and the internal authority information indicates that the user has the usage authority, in S405, the controller updates the internal authority information so as to indicate that the user does not have the usage authority. In this way, the controller 1 may wait for an update to release the usage authority until the driving of the vehicle V ends. This can prevent the user from being confused due to the inability to execute a specific vehicle control function during driving.

[0069] In S406, the controller 1 determines whether the failure to receive the external authority information is due to the user's behavior. When it is determined that the failure to receive the external authority information is due to the user's behavior ( "YES" in S406), the process transitions to S404, and in other cases ( "NO" in S406), the process transitions to S401.

[0070] As described above, the determination of whether the user has the usage authority is made based on the internal authority information, and the internal authority information is updated based on the external authority information. Therefore, even if the usage authority is released by the user management server 201, if the controller 1 cannot receive the external authority information, the user can continue to use the vehicle control function. Thus, in some embodiments, when the failure to receive the external authority information is due to the user's behavior, the controller 1 executes the processes after S404. That is, the controller 1 updates the internal authority information so as to indicate that the user does not have the usage authority. On the other hand, when the failure to receive the external authority information is not due to the user's behavior, the controller 1 transitions the process to S401 and waits for the reception of new external authority information.

[0071] User actions to prevent receiving external permission information may include at least one of not consenting to provide personal information to the user management server 201 and putting the communication device 7c of the vehicle V in a state outside the communication range. For example, the user management server 201 may provide external permission information to the vehicle V in response to obtaining the user's personal information from the vehicle V. In such a case, if the controller 1 cannot send the personal information to the user management server 201, the controller 1 cannot receive the external permission information. Therefore, the controller 1 may determine "YES" in S406 when the state of not consenting to provide personal information to the user management server 201 continues for a predetermined period (e.g., one week or one month). The personal information sent to the user management server 201 may include the user's account information, the identification information of the vehicle V (e.g., VIN), etc.

[0072] The user management server 201 may determine "YES" in S406 when the state where the communication device 7c of the vehicle V is outside the communication range continues for a predetermined period (e.g., one week or one month). Such a situation may occur when the user manually turns off the communication device 7c or continues to use the vehicle V outside the communication service range.

[0073] In the method of FIG. 4 described above, S403 and S404 may be omitted. In this case, when the controller 1 determines "NO" in S402, the process may transition to S405. In the method of FIG. 4 described above, S406 may be omitted. In this case, when the controller 1 determines "NO" in S401, S401 may be repeated.

[0074] <Summary of the Embodiment> <Item 1> A control device (1) of a vehicle (V), a receiving means (1) for receiving from a server (201) first permission information indicating whether a user of the vehicle has the right to use a specific vehicle control function; Updating means (1) for updating second authority information stored in a storage device of the vehicle, which is second authority information indicating whether the user has the right to use the specific vehicle control function, based on the first authority information. Vehicle control means (1) for executing the vehicle control function based at least in part on the second authority information indicating that the user has the right to use the function. A control device comprising the same. According to this item, even when the server cannot be accessed, the vehicle control function can be executed by referring to the authority information stored in the storage device, thus improving the convenience of the vehicle control function. <Item 2> The updating means according to item 1, wherein when the first authority information indicates that the user does not have the right to use the function, the updating of the second authority information is waited until the vehicle stops running. According to this item, since the right to use is not revoked during the vehicle's running, the user's confusion can be suppressed. <Item 3> The updating means according to item 2, for determining whether the vehicle has stopped running based on at least one of the vehicle speed becoming zero, the shift position of the vehicle becoming the parking range, the parking brake of the vehicle being activated, and the power supply of the vehicle being turned off. According to this item, the end of the vehicle's running can be appropriately determined. <Item 4> The updating means according to item 2, for updating the second authority information to indicate that the user does not have the right to use the function based on the fact that the first authority information cannot be received from the server due to the user's actions. According to this item, the use of the vehicle control function by a user who does not have the right to use it can be suppressed. <Item 5> The user's actions according to item 4 include at least one of not agreeing to provide personal information to the server and putting the communication device of the vehicle in a state outside the communication range. According to this item, it is possible to appropriately determine whether the inability to receive permission information from the server is due to the user's actions. <Item 6> A program for causing a computer to function as each means of the control device according to any one of Items 1 to 5. According to this item, a program that can realize the control device of the above item is provided. <Item 7> A method for controlling a vehicle (V), A receiving step (S401) of receiving, from a server (201), first permission information indicating whether a user of the vehicle has the right to use a specific vehicle control function; An updating step (S405) of updating second permission information, which is second permission information indicating whether the user has the right to use the specific vehicle control function and is stored in a storage device of the vehicle, based on the first permission information; A vehicle control step (S306) of executing the vehicle control function based at least in part on the second permission information indicating that the user has the right to use; a control method comprising. According to this item, even when the server cannot be accessed, the vehicle control function can be executed by referring to the permission information stored in the storage device, so the convenience of the vehicle control function is improved.

[0075] According to this item, consent regarding the use of personal information can be efficiently confirmed.

[0076] The invention is not limited to the above embodiments, and various modifications and changes are possible within the scope of the gist of the invention.

Explanation of Reference Numerals

[0077] V Vehicle, 1 Controller, 201 User Management Server, 202 Map Distribution Server

Claims

1. A control device for a vehicle, comprising: a receiving means for receiving from a server first authority information indicating whether a user of the vehicle has the right to use a specific vehicle control function; an updating means for updating second authority information indicating whether the user has the right to use the specific vehicle control function, which is stored in a storage device of the vehicle, based on the first authority information; a vehicle control means for executing the vehicle control function at least partially based on the second authority information indicating that the user has the right to use the function. The updating means is a control device that waits for updating of the second authority information until the vehicle stops running when the first authority information indicates that the user does not have the right to use the function.

2. The control device according to claim 1, wherein the updating means determines whether the vehicle has stopped running based on at least one of the vehicle speed becoming zero, the shift position of the vehicle becoming in the parking range, the parking brake of the vehicle being actuated, and the power supply of the vehicle being turned off.

3. The control device according to claim 1, wherein the updating means updates the second authority information to indicate that the user does not have the right to use the function based on the fact that the first authority information cannot be received from the server due to the user's actions.

4. The control device according to claim 3, wherein the user's actions include at least one of not consenting to providing personal information to the server and putting the communication device of the vehicle in a state outside the communication range.

5. A program for causing a computer to function as each means of the control device according to any one of claims 1 to 4.

6. A vehicle control method, comprising: a receiving step of receiving from a server first authority information indicating whether a user of the vehicle has the right to use a specific vehicle control function; an updating step of updating second authority information indicating whether the user has the right to use the specific vehicle control function, which is stored in a storage device of the vehicle, based on the first authority information; a vehicle control step of executing the vehicle control function at least partially based on the second authority information indicating that the user has the right to use the function. A control method for waiting for an update of the second authority information until the vehicle stops running when the first authority information indicates that the user does not have the usage authority in the update process.

Images