Automatic driving control device

Abstract

To provide an automatic driving control device which improves maintainability.SOLUTION: An automatic driving control device 3 includes: base boards 30 and 31 having base processors 301 and 311 and a plurality of blade connectors; sensing blades 33 and 35 which are configured so as to be attachable / detachable to / from the sensing connectors 304 and 314 as the blade connectors, and have sensing processors 331 and 351; and automatic driving blades 34 and 36 which are configured so as to be attachable / detachable to / from automatic driving connectors 305 an 315 different from the sensing connectors 304 and 314 as the blade connectors, and have automatic driving processors 341 and 361. The base processors 301 and 311 output an automatic driving command given to a vehicle based on a control request generated by the automatic driving processors 341 and 361, according to monitoring states of the sensing blades 33 and 35 and the automatic driving blades 34 and 36.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an automatic driving control device that controls automatic driving of a vehicle based on sensing data from sensors in the vehicle. [Background technology]

[0002] An automatic driving control device is disclosed, for example, in Patent Document 1. The automatic driving control device disclosed in Patent Document 1 includes a plurality of external sensors and microcomputers, and when an abnormality such as a failure occurs in any of the external sensors or microcomputers, the automatic driving control device performs evacuation driving using the remaining normal components. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-097352 Summary of the Invention [Problem to be solved by the invention]

[0004] In the automatic driving control device disclosed in Patent Document 1, multiple microcomputers are mounted on the same board. Therefore, if an abnormality occurs in one microcomputer, the entire board needs to be replaced or repaired, which may result in a lack of maintainability.

[0005] An object of the present disclosure is to provide an automatic driving control device that improves maintainability. [Means for solving the problem]

[0006] The technical means of the present disclosure for solving the problems will be described below. Note that the claims and the reference symbols in parentheses in this section indicate the correspondence with the specific means described in the embodiments described later in detail, and do not limit the technical scope of the present disclosure.

[0007] One aspect of the present disclosure is An automatic driving control device (3) that controls automatic driving of a vehicle (2) based on sensing data from a sensor (4), a baseboard (30, 31) having a base processor (301, 311) and a plurality of blade connectors (304, 305, 314, 315); a sensing blade (33, 35) configured to be detachable from a sensing connector (304, 314) as a blade connector and having a sensing processor (331, 351) that preprocesses sensing data from the sensor; an autonomous driving blade (34, 36) configured as a blade connector so as to be detachable from an autonomous driving connector (305, 315) different from the sensing connector, and having an autonomous driving processor (341, 361) that generates an autonomous driving control request for the vehicle based on sensing data preprocessed by the sensing processor; The base processor outputs an autonomous driving command to be given to the vehicle based on the control request generated by the autonomous driving processor, in accordance with the monitoring status of the sensing blade and the autonomous driving blade.

[0008] In this manner, in one aspect of the present disclosure, an autonomous driving control request for the vehicle is generated by the autonomous driving processor of the autonomous driving blade based on the sensing data preprocessed by the sensing processor of the sensing blade. Furthermore, in one aspect of the present disclosure, an autonomous driving command given to the vehicle based on the control request generated by the autonomous driving processor is output according to the monitoring status of the sensing blade and the autonomous driving blade.

[0009] Therefore, in order to perform these request generation and command output functions of the autonomous driving control device, the sensing blade and the autonomous driving blade according to one aspect of the present disclosure are configured to be detachable from the sensing connector and the autonomous driving connector, respectively, among multiple blade connectors on the baseboard. This allows the functionality of the autonomous driving control device to be easily restored by replacing or repairing the abnormal blade if an abnormality occurs in either the sensing blade or the autonomous driving blade. This improves the maintainability of the autonomous driving control device. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a schematic diagram showing a vehicle equipped with an automatic driving control device according to an embodiment; [Figure 2] 1 is a schematic diagram illustrating an automatic driving control device according to an embodiment; [Figure 3] 4 is a flowchart illustrating an automatic driving command generation process performed by the automatic driving control device according to an embodiment. [Figure 4] 10 is a flowchart showing an automatic driving command generation process in a normal state. [Figure 5] 10 is a flowchart illustrating an automatic operation command generation process when an abnormality occurs in the primary power supply. [Figure 6] 10 is a flowchart showing an automatic driving command generation process when a communication abnormality occurs between the primary baseboard and the in-vehicle control system. [Figure 7] 10 is a flowchart showing an automatic driving command generation process when an abnormality occurs in a primary periphery monitoring sensor. [Figure 8] 10 is a flowchart showing an automatic operation command generation process when an abnormality occurs in the primary sensing blade. [Figure 9] 10 is a flowchart illustrating an automatic operation command generation process when an abnormality occurs in a primary automatically operating blade. [Figure 10] 10 is a flowchart illustrating an automatic operation command generation process when an abnormality occurs in a secondary power supply. [Figure 11]10 is a flowchart showing an automatic driving command generation process when a communication abnormality occurs between the secondary baseboard and the in-vehicle control system. [Figure 12] 10 is a flowchart showing an automatic driving command generation process when an abnormality occurs in a secondary surroundings monitoring sensor. [Figure 13] 10 is a flowchart showing an automatic operation command generation process when an abnormality occurs in the secondary sensing blade. [Figure 14] 10 is a flowchart illustrating an automatic operation command generation process when an abnormality occurs in a secondary automatically operating blade. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present disclosure will be described with reference to the drawings.

[0012] 1 is mounted on a vehicle 2 together with an external sensor group 4 including a plurality of monitoring sensors 41, 42 and an in-vehicle control system 5. Based on sensing data from the external sensor group 4, the automatic driving control device 3 generates an automatic driving command for instructing the in-vehicle control system 5 to control the automatic driving of the vehicle 2.

[0013] Vehicle 2 is capable of implementing automated driving modes, which are divided into levels according to the degree of manual intervention by the occupant in the driving task. The automated driving mode may be realized by autonomous driving control, such as conditional automated driving, highly automated driving, or fully automated driving, in which the system performs all driving tasks when activated. The automated driving mode may also be realized by advanced driving assistance control, such as driving assistance or partial automated driving, in which the occupant performs some or all driving tasks. The automated driving mode may be realized by either, a combination of, or switching between the autonomous driving control and the advanced driving assistance control.

[0014] The monitoring sensors 41, 42 of the external sensor group 4 acquire sensor information of the external world, which is the surrounding environment of the vehicle 2. As shown in FIG. 1 , the external sensor group 4 has a plurality of periphery monitoring sensors 41 and a plurality of forward monitoring sensors 42 as the monitoring sensors 41, 42.

[0015] Each of the monitoring sensors 41, 42 is at least one type of sensor, such as LiDAR (Light Detection and Ranging / Laser Imaging Detection and Ranging), radar, or sonar, for acquiring sensor information of the external world that is the surrounding environment of the vehicle 2. Each of the monitoring sensors 41, 42 senses an area according to its installation position and field of view angle on the vehicle 2. Each of the monitoring sensors 41, 42 generates sensing data representing external world information that can be used for autonomous driving control of the vehicle 2 as a result of sensing, for each control cycle.

[0016] The autonomous driving control device 3 shown in FIG. 1 is connected to an external sensor group 4 and an in-vehicle control system 5 via at least one of, for example, a local area network (LAN) line, a wire harness, an internal bus, and a wireless communication line. The in-vehicle control system 5 includes internal sensors, a navigation device, a driving force control device, a braking force control device, a steering control device, etc. The in-vehicle control system 5 includes a route planning device that plans a planned driving route to a destination, internal sensors that acquire vehicle information such as motion information of the vehicle 2 and road information, a steering control device that controls the steering of the vehicle 2, a driving force control device that controls the driving force of the vehicle 2, a braking force control device that controls the braking force of the vehicle 2, etc. The in-vehicle control system 5 controls the autonomous driving of the vehicle 2 based on an autonomous driving command from the autonomous driving control device 3.

[0017] As shown in FIG. 2, the autonomous driving control device 3 includes a primary baseboard 30, a secondary baseboard 31, a primary sensing blade 33, a secondary sensing blade 35, a primary autonomous driving blade 34, and a secondary autonomous driving blade 36, each of which is equipped with at least one processor and one memory (not shown). These baseboards and blades 33-36 are communicatively connected to each other via at least one of a local area network (LAN) line, a wire harness, an internal bus, and a wireless communication line. Each processor includes at least one of a CPU, a GPU, a RISC-CPU, etc. as a core. Each memory is a non-transitory tangible storage medium, such as a semiconductor memory, that non-temporarily stores computer-readable programs and data.

[0018] As shown in FIG. 2, the primary baseboard 30 includes a primary base processor 301 as a base processor, a primary high-speed bus switch 302, and a primary power supply circuit 303. The primary base processor 301 and the primary high-speed bus switch 302 are powered by a primary power supply 6a via the primary power supply circuit 303. The primary base processor 301 directly or indirectly acquires sensing data from the monitoring sensors 41 and 42 and generates autonomous driving commands by post-processing control requests generated by the primary autonomous driving processor 341 or the secondary autonomous driving processor 361 (described later). Here, "direct acquisition of sensing data" refers to acquisition of sensing data from the monitoring sensors 41 and 42 without going through the secondary baseboard 31 and the blades 33 to 36. On the other hand, "indirect acquisition of sensing data" refers to acquisition of sensing data from the monitoring sensors 41 and 42 via at least one of the secondary baseboard 31 and the blades 33 to 36. The primary base processor 301 acquires sensing data from the primary forward monitoring sensor 42a out of the multiple forward monitoring sensors 42, and from the sensing data, recognizes targets present in front of the vehicle 2. Furthermore, the primary base processor 301 monitors abnormalities in the secondary base board 31, primary sensing blade 33, and primary autonomous driving blade 34, which are directly connected to the primary base board 30.

[0019] The primary baseboard 30 has a plurality of blade connectors (slots) into which predetermined blades can be plugged. The blade connectors of the primary baseboard 30 include a primary sensing connector 304 configured to allow the primary sensing blade 33 to be detachably attached, and a primary autonomous driving connector 305 configured to allow the primary autonomous driving blade 34 to be detachably attached.

[0020] The secondary base board 31 is equipped with a secondary base processor 311 as a base processor, a secondary high-speed bus switch 312, and a secondary power supply circuit 313. The secondary base processor 311 and the secondary high-speed bus switch 312 are powered by a secondary power supply 6b, which is different from the primary power supply 6a, via the secondary power supply circuit 313. The secondary base processor 311 is configured to directly or indirectly acquire sensing data from the monitoring sensors 41 and 42 and generate autonomous driving commands by post-processing control requests generated by the primary autonomous driving processor 341 or the secondary autonomous driving processor 361 (described later). Here, "direct acquisition of sensing data" refers to acquisition of sensing data from the monitoring sensors 41 and 42 without going through the primary base board 30 and the blades 33 to 36. On the other hand, "indirect acquisition of sensing data" refers to acquisition of sensing data from the monitoring sensors 41 and 42 via at least one of the secondary base board 31 and the blades 33 to 36. The secondary base processor 311 acquires sensing data from the secondary forward monitoring sensor 42b out of the multiple forward monitoring sensors 42, and recognizes targets present in front of the vehicle 2 from the sensing data. Furthermore, the secondary base processor 311 monitors abnormalities in the primary base board 30, secondary sensing blade 35, and secondary automatic driving blade 36, which are directly connected to the secondary base board 31. With this configuration, the secondary base board 31 assists the primary base board 30 in generating automatic driving commands.

[0021] The secondary baseboard 31 has a plurality of blade connectors (slots) into which predetermined blades can be inserted and connected. The blade connectors of the secondary baseboard 31 include a secondary sensing connector 314 configured to allow a secondary sensing blade 35 to be attached / detached, and a secondary automatic driving connector 315 configured to allow a secondary automatic driving blade 36 to be attached / detached.

[0022] The baseboards 30 and 31 described above are connected to each other via an inter-blade board connector 32 .

[0023] A primary sensing processor 331 is mounted on the primary sensing blade 33, which is detachably connected to the primary sensing connector 304. The primary sensing processor 331 acquires sensing data from the primary periphery monitoring sensor 41a, one of the multiple periphery monitoring sensors 41, via a communication interface (not shown), such as a deserializer, provided on the primary sensing blade 33. The primary sensing processor 331 then performs preprocessing, such as demosaic processing, on the acquired sensing data. The primary sensing processor 331 also detects an abnormality in the primary periphery monitoring sensor 41a based on a disruption of communication from the primary periphery monitoring sensor 41a. When an abnormality in the primary periphery monitoring sensor 41a is detected, the primary sensing processor 331 notifies the primary base processor 301 of the abnormality information.

[0024] A secondary sensing processor 351 is mounted on the secondary sensing blade 35, which is detachably connected to the secondary sensing connector 314. The secondary sensing processor 351 acquires sensing data from the secondary periphery monitoring sensor 41b, one of the multiple periphery monitoring sensors 41, via a communication interface (not shown), such as a deserializer, provided on the secondary sensing blade 35. The secondary sensing processor 351 then performs preprocessing, such as demosaic processing, on the acquired sensing data. The secondary sensing processor 351 also detects an abnormality in the secondary periphery monitoring sensor 41b based on a disruption of communication from the secondary periphery monitoring sensor 41b. If an abnormality in the secondary periphery monitoring sensor 41b is detected, the secondary sensing processor 351 notifies the secondary base processor 311 of the abnormality information.

[0025] The primary autonomous driving blade 34, which is detachably connected to the primary autonomous driving connector 305, is equipped with a primary autonomous driving processor 341. The primary autonomous driving processor 341 acquires sensing data preprocessed by the primary sensing processor 331 via the primary high-speed bus switch 302. The primary autonomous driving processor 341 also recognizes targets in the external world from the acquired sensing data. The primary autonomous driving processor 341 also acquires recognition results from the secondary autonomous driving processor 361 (described below) via the high-speed bus switches 302 and 312 on each base board. The primary autonomous driving processor 341 generates a driving plan (path plan) for the vehicle 2 based on its own recognition results and those acquired from the secondary autonomous driving processor 361. In the driving plan processing, the primary autonomous driving processor 341 acquires a planned driving route to the destination from the in-vehicle control system 5. Based on the generated driving plan, the primary autonomous driving processor 341 transmits a control request to the primary base processor 301 to implement driving control of the vehicle 2 in accordance with the driving plan. As described above, in order to perform relatively high-load processing such as external environment recognition processing and driving plan processing, the primary autonomous driving processor 341 includes a core with relatively high processing power, such as a GPU (graphics processing unit).

[0026] The secondary autonomous driving blade 36, which is detachably connected to the secondary autonomous driving connector 315, is equipped with a secondary autonomous driving processor 361. The secondary autonomous driving processor 361 acquires sensing data preprocessed by the secondary sensing processor 351 via the secondary high-speed bus switch 312. The secondary autonomous driving processor 361 also recognizes targets in the external world from the acquired sensing data. The secondary autonomous driving processor 361 is configured to generate a driving plan for the vehicle 2 based on its own recognition results. In the driving plan processing, the secondary autonomous driving processor 361 acquires a planned driving route to the destination from the in-vehicle control system 5. Based on the driving plan generated in this manner, the secondary autonomous driving processor 361 transmits a control request to the secondary base processor 311 to realize driving control of the vehicle 2 in accordance with the driving plan. As described above, in order to perform relatively high-load processing such as external world recognition processing and driving plan processing, the secondary autonomous driving processor 361 includes a core with relatively high processing power, such as a GPU.

[0027] The in-vehicle control system 5 acquires an automatic driving command through at least one of the primary base processor 301 and the secondary base processor 311, and realizes driving control of the vehicle 2 in accordance with the automatic driving command.

[0028] The flow of the method by which the automatic driving control device 3 generates an automatic driving command through cooperation of the above-described processors will be explained below with reference to Figures 3 to 14. Note that each "S" in this flow represents a plurality of steps executed by a plurality of instructions included in the automatic driving command generation program.

[0029] First, the main flow of the method realized by the cooperation of each processor will be described below with reference to FIG.

[0030] In S1, the primary base processor 301 and the secondary base processor 311 monitor the occurrence of abnormalities in the baseboards 30 and 31, the blades 33 to 36, and the periphery monitoring sensors 41a and 41b.

[0031] In S2, the automatic driving control device 3 performs automatic driving command generation processing according to the location of the abnormality detected in S1, and transmits the automatic driving command to the in-vehicle control system 5 of the vehicle 2. In each automatic driving control command generation processing, the base processors 301, 311 output automatic driving commands to be given to the vehicle 2 based on the control requests generated by the automatic driving processors 341, 361, according to the monitoring status of each base board 30, 31, each blade 33 to 36, and each periphery monitoring sensor 41a, 41b.

[0032] Next, we will explain the flow of the method for generating automatic driving commands in normal situations when no abnormality is detected in S1, and the flow of the method for generating automatic driving commands for each abnormality location.

[0033] <Normal time> First, the flow of the method for generating automatic driving commands in normal situations where it is determined in S1 that no abnormalities have occurred in any of the baseboards 30, 31, blades 33 to 36, or peripheral monitoring sensors 41a, 41b will be explained based on Figure 4.

[0034] In S201, the primary sensing processor 331 acquires sensing data from the primary periphery monitoring sensor 41a and performs preprocessing on the sensing data. Similarly, the secondary sensing processor 351 acquires sensing data from the secondary periphery monitoring sensor 41b and performs preprocessing on the sensing data.

[0035] In S202, the primary automatic driving processor 341 performs recognition processing on the sensing data preprocessed by the primary sensing processor 331. In the recognition processing, the primary automatic driving processor 341 acquires the driving state and road information of the vehicle 2 from the in-vehicle control system 5 via the primary base processor 301. Similarly, the secondary automatic driving processor 361 performs recognition processing on the sensing data preprocessed by the secondary sensing processor 351. In addition, in the recognition processing, the secondary automatic driving processor 361 acquires the driving state and road information of the vehicle 2 from the in-vehicle control system 5 via the secondary base processor 311.

[0036] In S203, the primary autonomous driving processor 341 executes a driving plan process and a control request generation process based on the recognition results of its own in S202 and the recognition results of the secondary autonomous driving processor 361.

[0037] In S204, the primary base processor 301 acquires sensing data from the primary forward monitoring sensor 42a and recognizes targets, including white lines of the driving lane, from the sensing data. Similarly, the secondary base processor 311 acquires sensing data from the secondary forward monitoring sensor 42b and recognizes targets, including white lines of the driving lane, from the sensing data. Furthermore, the secondary base processor 311 transmits its own recognition results to the primary base processor 301.

[0038] In S205, the primary base processor 301 calculates the movable area of the vehicle 2 based on the recognition results of itself in S204 and the recognition results of the secondary base processor 311. Specifically, the primary base processor 301 calculates the width of the lane in which the vehicle 2 is traveling, etc., as the movable area of the vehicle 2.

[0039] In S206, the primary base processor 301 generates an autonomous driving command by performing a consistency check process on the control request as post-processing for the control request generated by the primary autonomous driving processor 341. Specifically, as part of the consistency check process, the primary base processor 301 checks whether the control request, such as the driving speed and steering angle, is within an allowable range, and whether the change in the control request is within an allowable range. Furthermore, as part of the consistency check process, the primary base processor 301 checks whether the control request specifies driving outside the movable area. Furthermore, the primary base processor 301 restricts the control request as necessary so that the control request and the change in the control request are within an allowable range, and so that the vehicle driving in accordance with the control request is within the movable area. The consistency check process in S206 generates an autonomous driving command.

[0040] In S207, the primary base processor 301 transmits the automatic driving command generated in S206 to the in-vehicle control system 5. Upon receiving the automatic driving command, the in-vehicle control system 5 controls each part in accordance with the automatic driving command, thereby achieving automatic driving control of the vehicle 2.

[0041] <When primary power supply 6a is abnormal> Next, a case where the primary baseboard 30 completely stops functioning due to an abnormality in the primary power supply 6a will be described with reference to Figure 5. The secondary base processor 311 monitors the primary baseboard 30 for a communication interruption from the primary baseboard 30 in S1. The communication interruption is detected when there is no data communication from the primary base processor 301 to the secondary base processor 311 for a certain period of time or more.

[0042] If a functional failure of the primary baseboard 30 is detected, in S208 the secondary base processor 311 changes the operation mode of the automatic driving control device 3 to evacuation mode and notifies the secondary automatic driving processor 361 of the change. The evacuation mode is an operation mode that generates an automatic driving command to realize evacuation driving that causes the vehicle 2 to evacuate to the shoulder of the road. The evacuation mode is also an operation mode that outputs an automatic driving command to degrade the automatic driving of the vehicle 2.

[0043] In S209, the secondary sensing processor 351 acquires sensing data from the secondary periphery monitoring sensor 41b and performs pre-processing on the sensing data.

[0044] In S210, the secondary automatic driving processor 361 performs recognition processing on the sensing data preprocessed by the secondary sensing processor 351. In the recognition processing, the secondary automatic driving processor 361 acquires the driving state of the vehicle 2, road information, etc. from the in-vehicle control system 5 via the secondary base processor 311.

[0045] In S211, the secondary automatic driving processor 361 executes a driving plan process and a control request generation process based on its own recognition result in S209. Here, the secondary automatic driving processor 361 generates a control request to realize evacuation driving that stops the vehicle 2 on the shoulder of the road.

[0046] In S212, the secondary base processor 311 acquires sensing data from the secondary forward monitoring sensor 42b, and recognizes targets including white lines of the driving lane from the sensing data.

[0047] In S213, the secondary base processor 311 calculates the movable area of the vehicle 2 based on the recognition result obtained by itself in S212.

[0048] In S214, the secondary base processor 311 generates an automatic driving command by performing a consistency check process on the control request generated by the secondary automatic driving processor 361 as post-processing.

[0049] In S215, the secondary base processor 311 transmits the automatic driving command generated in S214 to the in-vehicle control system 5 on behalf of the primary base processor 301. Upon receiving the automatic driving command, the in-vehicle control system 5 controls each part in accordance with the automatic driving command, thereby achieving automatic driving control for realizing evacuation driving of the vehicle 2.

[0050] <When a communication error occurs between the primary baseboard 30 and the in-vehicle control system 5> Next, a case where a communication abnormality between the primary baseboard 30 and the in-vehicle control system 5 is detected as an abnormality in the primary baseboard 30 will be described with reference to Fig. 6. A communication abnormality between the primary baseboard 30 and the in-vehicle control system 5 is monitored by the primary base processor 301 based on a communication interruption from the in-vehicle control system 5 to the primary base processor 301 in S1. Here, a communication interruption is detected when there is no data communication from the in-vehicle control system 5 to the primary base processor 301 for a certain period of time or more.

[0051] If a communication abnormality between the primary base board 30 and the in-vehicle control system 5 is detected, in S216 the primary base processor 301 changes the operation mode of the automatic driving control device 3 to the first degenerate mode and notifies the primary automatic driving processor 341 of the change in operation mode. The primary base processor 301 also notifies the secondary base processor 311 of information about the detected abnormality. The first degenerate mode is an operation mode that generates an automatic driving command to degrade the maneuverability performance of the vehicle 2, such as lowering the upper limit of the vehicle's driving speed, and continue automatic driving to the destination. The first degenerate mode is also an operation mode that outputs an automatic driving command to degrade the automatic driving of the vehicle 2. The secondary base processor 311, which has been notified of the abnormality, provides the primary base processor 301 with vehicle information, road information, etc. obtained from the in-vehicle control system 5.

[0052] S201 and S202 following S216 are the same as S201 and S202 in the normal state.

[0053] In S217 following S202, the primary autonomous driving processor 341 executes a driving plan process and a control request generation process based on its own recognition results from S202 and the recognition results from the secondary autonomous driving processor 361. Here, the primary autonomous driving processor 341 calculates control requests that are more limited than control requests under normal conditions.

[0054] S204 and S205 following S217 are the same as S204 and S205 in the normal state.

[0055] In S218 following S205, the primary base processor 301 generates an autonomous driving command by performing a consistency check process on the control request as post-processing of the control request generated by the primary autonomous driving processor 341. Here, the primary base processor 301 limits the allowable range of the control request and the amount of change in the control request to a value lower than the allowable range under normal conditions.

[0056] In S219, the primary base processor 301 transmits the automatic driving command generated in S218 to the in-vehicle control system 5 via the secondary base processor 311. Upon receiving the automatic driving command, the in-vehicle control system 5 controls each part in accordance with the automatic driving command, thereby achieving automatic driving control of the vehicle 2.

[0057] <When the primary perimeter monitoring sensor 41a fails> Next, a case where at least one of the primary periphery monitoring sensors 41a fails will be described with reference to Fig. 7. A failure of the primary periphery monitoring sensor 41a is monitored in S1 based on a communication interruption from the primary monitoring sensor to the primary sensing processor 331. Here, a communication interruption is detected when there is no data communication from the primary periphery monitoring sensor 41a to the primary sensing processor 331 for a certain period of time or longer. Furthermore, when a failure of the primary periphery monitoring sensor 41a is detected, the primary IF processor transmits abnormality information indicating a failure of the primary periphery monitoring sensor 41a to the primary base processor 301.

[0058] If a failure of the primary periphery monitoring sensor 41a is detected, in S220 the primary base processor 301 changes the operation mode of the automatic driving control device 3 to the first degenerate mode and notifies the primary automatic driving processor 341 of the change in operation mode.

[0059] S201 and S202 following S220 are the same as S201 and S202 in the normal state. However, in S201 when a failure of the primary periphery monitoring sensor 41a is detected, the primary sensing processor 331 performs preprocessing only on the sensing data that has been acquired. In other words, the primary sensing processor 331 performs preprocessing on the sensing data acquired from the primary periphery monitoring sensor 41a that is not faulty.

[0060] S217 following S202 is the same as S217 when a communication abnormality is detected between the primary baseboard 30 and the in-vehicle control system 5, and S204 and S205 following S217 are the same as S204 and S205 during normal operation. Furthermore, S218 following S205 is the same as S218 when a communication abnormality is detected between the primary baseboard 30 and the in-vehicle control system 5, and S207 following S218 is the same as S207 during normal operation.

[0061] In S207, the in-vehicle control system 5 receives the automatic driving command transmitted from the primary base processor 301 and controls each part in accordance with the automatic driving command, thereby achieving automatic driving control of the vehicle 2.

[0062] <When an abnormality occurs in the primary sensing blade 33> Next, a case where an abnormality in the primary sensing blade 33 is detected will be described with reference to Fig. 8. An abnormality in the primary sensing blade 33 is monitored by the primary base processor 301 based on a communication interruption from the primary sensing processor 331 to the primary base processor 301 in S1. Here, a communication interruption is detected when, for example, there is no data communication from the primary sensing processor 331 to the primary base processor 301 for a certain period of time or more.

[0063] In S221 when an abnormality is detected in the primary sensing blade 33, the primary base processor 301 changes the operating mode of the automatic driving control device 3 to the second degenerate mode and notifies the secondary automatic driving processor 361 of the change in operating mode. The second degenerate mode is an operating mode that generates an automatic driving command to continue automatic driving to a predetermined base or the like after degrading the maneuverability performance of the vehicle 2, for example by further lowering the upper limit of the vehicle 2's driving speed compared to the first degenerate mode. The second degenerate mode is also an operating mode that outputs an automatic driving command to degrade the automatic driving of the vehicle 2.

[0064] In S222 following S221, the primary base processor 301 requests the in-vehicle control system 5 to reset the route to the base station or the like, and transmits the reset route to the secondary automatic driving processor 361.

[0065] In S223, the secondary sensing processor 351 acquires sensing data from the secondary periphery monitoring sensor 41b and performs pre-processing on the sensing data.

[0066] In S224, the secondary autonomous driving processor 361 acquires the sensing data preprocessed by the secondary sensing processor 351 via the secondary high-speed bus switch 312 and performs recognition processing.

[0067] In S225, the secondary autonomous driving processor 361 executes a driving plan process and a control request generation process based on its own recognition results in S224. Here, the secondary autonomous driving processor 361 generates control requests that are even more restricted than those in the first degenerate mode.

[0068] S204 and S205 following S225 are the same as S204 and S205 in the normal state.

[0069] In S226 following S205, the primary base processor 301 generates an autonomous driving command by performing a consistency check process on the control request as post-processing of the control request generated by the secondary autonomous driving processor 361. Here, the primary base processor 301 further restricts the allowable range of the control request and the amount of change in the control request than the allowable range in the first degenerate mode.

[0070] S207 following S226 is the same as S207 in the normal state. The control system that receives the automatic driving command controls each part in accordance with the automatic driving command, thereby achieving automatic driving control of the vehicle 2.

[0071] <When an abnormality occurs on the primary automatic operation blade 34> Next, a case where an abnormality in the primary autonomous driving blade 34 is detected will be described with reference to Fig. 9. An abnormality in the primary autonomous driving blade 34 is monitored by the primary base processor 301 based on a disruption of communication from the primary autonomous driving blade 34 to the primary base processor 301 in S1. Here, a disruption of communication is detected when, for example, there is no data communication from the primary autonomous driving processor 341 to the primary base processor 301 for a certain period of time or more.

[0072] In S227, if an abnormality is detected in the primary automatic driving blade 34, the primary base processor 301 changes the operating mode of the automatic driving control device 3 to the second degenerate mode and notifies the secondary automatic driving processor 361 of the change in operating mode via the secondary base processor 311.

[0073] In S228 following S227, the primary base processor 301 requests the in-vehicle control system 5 to reset the route to the base station or the like, and transmits the reset route to the secondary automatic driving processor 361.

[0074] S201 following S228 is the same as S201 in the normal state.

[0075] In S229 following S201, the secondary autonomous driving processor 361 acquires sensing data preprocessed by the primary sensing processor 331 via the primary high-speed bus switch 302 and the secondary high-speed bus switch 312, and performs recognition processing. Furthermore, the secondary autonomous driving processor 361 acquires sensing data preprocessed by the secondary sensing processor 351 via the secondary high-speed bus switch 312, and performs recognition processing.

[0076] S211 following S229 is the same as S211 when an abnormality occurs in the primary power supply 6a.

[0077] S204 and S205 following S211 are the same as S204 and S205 in the normal state.

[0078] In S230 following S205, the primary base processor 301 generates an autonomous driving command by performing a consistency check process on the control request as post-processing of the control request calculated by the primary autonomous driving processor 341. Here, the primary base processor 301 further restricts the allowable range of the control request and the amount of change in the control request than the allowable range in the first degenerate mode.

[0079] S207 following S230 is the same as S207 in the normal state. Upon receiving the automatic driving command, the in-vehicle control system 5 controls each part in accordance with the automatic driving command, thereby achieving automatic driving control of the vehicle 2.

[0080] <When secondary power supply 6b is abnormal> Next, a case where the secondary baseboard 31 completely stops functioning due to an abnormality in the secondary power supply 6b will be described with reference to Fig. 10. The primary base processor 301 monitors the secondary baseboard 31 for a communication interruption from the secondary baseboard 31 in S1. Here, a communication interruption is detected when there is no data communication from the secondary base processor 311 to the primary base processor 301 for a certain period of time or more.

[0081] In S231, when a functional failure of the secondary baseboard 31 is detected, the primary base processor 301 changes the operation mode of the automatic driving control device 3 to the evacuation mode and notifies the primary automatic driving blade 34 of the change in operation mode.

[0082] In S232, the primary sensing processor 331 acquires sensing data from the primary periphery monitoring sensor 41a and performs pre-processing on the sensing data.

[0083] In S233, the primary autonomous driving processor 341 performs recognition processing on the sensing data preprocessed by the primary sensing processor 331.

[0084] At S234, the primary autonomous driving processor 341 executes a driving plan process and a control request generation process based on its own recognition result at S233. Here, the primary autonomous driving processor 341 generates a control request to realize evacuation driving that stops the vehicle 2 on the shoulder of the road.

[0085] S204 and S205 following S234 are the same as S204 and S205 in the normal state.

[0086] In S235 following S205, the primary base processor 301 performs a consistency check process on the control request as post-processing of the control request calculated by the primary automatic driving processor 341, thereby generating an automatic driving command.

[0087] S207 following S235 is the same as S207 under normal circumstances. Upon receiving the automatic driving command, the in-vehicle control system 5 controls each part in accordance with the automatic driving command, thereby achieving automatic driving control for realizing evacuation travel of the vehicle 2.

[0088] <When a communication error occurs between the secondary baseboard 31 and the in-vehicle control system 5> Next, a case where a communication abnormality between the secondary base board 31 and the in-vehicle control system 5 is detected as an abnormality in the secondary base board 31 will be described with reference to Fig. 11. A communication abnormality between the secondary base board 31 and the in-vehicle control system 5 is monitored by the secondary base processor 311 based on a communication interruption from the in-vehicle control system 5 to the secondary base processor 311 in S1. Here, a communication interruption is detected when there is no data communication from the in-vehicle control system 5 to the secondary base processor 311 for a certain period of time or more.

[0089] If a communication abnormality between the secondary base board 31 and the in-vehicle control system 5 is detected, the secondary base processor 311 notifies the primary base processor 301 of the abnormality in S236.

[0090] Upon receiving the notification from the secondary base processor 311, the primary base processor 301 changes the operation mode of the automatic driving control device 3 to the first degenerate mode in S237, and notifies the primary automatic driving blade 34 of the change in operation mode.

[0091] S201 and S202 following S237 are the same as S201 and S202 in the normal state. Furthermore, S217 following S202 is the same as S217 when a communication abnormality between the primary baseboard 30 and the in-vehicle control system 5 is detected.

[0092] S204 and S205 following S217 are the same as S204 and S205 under normal conditions. Furthermore, S218 following S205 is the same as S218 when a communication abnormality is detected between the primary baseboard 30 and the in-vehicle control system 5. Furthermore, S207 following S218 is the same as S207 under normal conditions. Upon receiving an automatic driving command, the in-vehicle control system 5 controls each part in accordance with the automatic driving command, thereby achieving automatic driving control of the vehicle 2.

[0093] <When an abnormality occurs in the secondary periphery monitoring sensor 41b> Next, a case where at least one of the secondary periphery monitoring sensors 41b fails will be described with reference to Fig. 12. A failure of the secondary periphery monitoring sensor 41b is monitored in S1 based on a communication interruption from the secondary monitoring sensor to the secondary sensing processor 351. Here, a communication interruption is detected when there is no data communication from the secondary periphery monitoring sensor 41b to the secondary sensing processor 351 for a certain period of time or longer. Furthermore, when a failure of the secondary periphery monitoring sensor 41b is detected, the secondary IF processor transmits abnormality information indicating the failure of the secondary periphery monitoring sensor 41b to the secondary base processor 311.

[0094] If a failure of the secondary periphery monitoring sensor 41b is detected, in S239 the secondary base processor 311 notifies the primary base processor 301 of the abnormality of the secondary periphery monitoring sensor 41b.

[0095] S237 following S239 is the same as S237 when a communication abnormality between the secondary baseboard 31 and the in-vehicle control system 5 is detected.

[0096] S201 and S202 following S237 are the same as S201 and S202 in the normal state. However, in S201 when a failure of the secondary periphery monitoring sensor 41b is detected, the secondary sensing processor 351 performs preprocessing only on the sensing data that it has been able to acquire. In other words, the secondary sensing processor 351 performs preprocessing on the sensing data acquired from the non-failed secondary periphery monitoring sensor 41b.

[0097] S217 following S202 is the same as S217 when a communication abnormality between the primary baseboard 30 and the in-vehicle control system 5 is detected.

[0098] S204 and S205 following S217 are the same as S204 and S205 under normal conditions. Furthermore, S218 following S205 is the same as S218 when a communication abnormality is detected between the primary baseboard 30 and the in-vehicle control system 5. Furthermore, S207 following S218 is the same as S207 under normal conditions. Upon receiving an automatic driving command, the in-vehicle control system 5 controls each part in accordance with the automatic driving command, thereby achieving automatic driving control of the vehicle 2.

[0099] <When secondary sensing blade 35 is abnormal> Next, a case where an abnormality in the secondary sensing blade 35 is detected will be described with reference to Fig. 13. An abnormality in the secondary sensing blade 35 is monitored by the secondary base processor 311 based on a communication interruption from the secondary sensing processor 351 to the secondary base processor 311 in S1. Here, a communication interruption is detected when, for example, there is no data communication from the secondary sensing processor 351 to the primary base processor 301 for a certain period of time or more.

[0100] If an abnormality in the secondary sensing blade 35 is detected, the secondary base processor 311 notifies the primary base processor 301 of the abnormality in the secondary sensing blade 35 in S240.

[0101] S221 and S222 following S240 are similar to S221 and S222 when an abnormality occurs in the primary sensing blade 33. Furthermore, S232 and S233 following S222 are similar to S232 and S233 when an abnormality occurs in the secondary power supply 6b.

[0102] In S241 following S233, the primary autonomous driving processor 341 executes a driving plan process and a control request generation process based on its own recognition results in S233. Here, the primary autonomous driving processor 341 calculates control requests that are even more restricted than those in the first degenerate mode.

[0103] S204 and S205 following S241 are the same as S204 and S205 during normal operation. Furthermore, S226 following S205 is the same as S226 when the primary sensing blade 33 is abnormal.

[0104] S207 following S226 is the same as S207 in the normal state. Upon receiving the automatic driving command, the in-vehicle control system 5 controls each part in accordance with the automatic driving command, thereby achieving automatic driving control of the vehicle 2.

[0105] <When an abnormality occurs on the secondary automatic operation blade 36> Next, a case where an abnormality in the secondary automatically driving blade 36 is detected will be described with reference to Fig. 14. An abnormality in the secondary automatically driving blade 36 is monitored by the secondary base processor 311 based on a communication disruption from the secondary automatically driving blade 36 to the secondary base processor 311 in S1. Here, a communication disruption is detected when, for example, there is no data communication from the secondary automatically driving processor 361 to the secondary base processor 311 for a certain period of time or more.

[0106] If an abnormality in the secondary automatically operated blade 36 is detected, the secondary base processor 311 notifies the primary base processor 301 of the abnormality information in S242.

[0107] S221 and S222 following S242 are the same as S221 and S222 when an abnormality occurs in the primary sensing blade 33. Furthermore, S201 following S222 is the same as S201 during normal operation.

[0108] In S243 following S201, the primary autonomous driving processor 341 performs recognition processing on the sensing data preprocessed by the primary sensing processor 331. Furthermore, the primary base processor 301 acquires the sensing data preprocessed by the secondary sensing processor 351 via the secondary high-speed bus switch 312 and performs recognition processing on the sensing data.

[0109] S241 following S243 is the same as S241 when an abnormality occurs in the secondary sensing blade 35. S204 and S205 following S241 are the same as S204 and S205 during normal operation. S226 following S205 is the same as S226 when an abnormality occurs in the primary sensing blade 33.

[0110] S207 following S226 is the same as S207 in the normal state. Upon receiving the automatic driving command, the in-vehicle control system 5 controls each part in accordance with the automatic driving command, thereby achieving automatic driving control of the vehicle 2.

[0111] (Action and effect) The effects of the present embodiment described above will be explained below.

[0112] In this embodiment, an autonomous driving control request for the vehicle 2 is generated by the autonomous driving processors 341, 361 of the autonomous driving blades 34, 36 based on sensing data preprocessed by the sensing processors 331, 351 of the sensing blades 33, 35. Furthermore, in this embodiment, an autonomous driving command given to the vehicle 2 based on the control request generated by the autonomous driving processors 341, 361 is output according to the monitoring status of the sensing blades 33, 35 and the autonomous driving blades 34, 36.

[0113] Therefore, in order to perform these request generation and command output functions of the automatic driving control device 3, the sensing blades 33, 35 and the automatic driving blades 34, 36 according to this embodiment are configured to be detachable from the sensing connectors 304, 314 and the automatic driving connectors 305, 315, respectively, among the multiple connectors 304, 305, 314, 315 on the base boards 30, 31. As a result, if an abnormality occurs in either the sensing blades 33, 35 or the automatic driving blades 34, 36, the function of the automatic driving control device 3 can be easily restored by replacing or repairing the abnormal blade. Therefore, it is possible to improve the maintainability of the automatic driving control device 3.

[0114] According to the automatic driving control device 3 of this embodiment, the primary baseboard 30 and the secondary baseboard 31 are powered by different power supplies 6a and 6b, respectively. Furthermore, sensing blades 33 and 35 and automatic driving blades 34 and 36 are connected to each of the baseboards 30 and 31 via connectors 304, 305, 314, and 315, respectively. This allows the output of automatic driving commands to be maintained by the remaining baseboard, even if the primary baseboard 30 or the secondary baseboard 31 stops functioning due to an abnormality. This improves the reliability of the automatic driving control device 3 in addition to the maintainability.

[0115] According to the automatic driving control device 3 of this embodiment, when an abnormality occurs in the power supply 6a that supplies power to the primary baseboard 30, the secondary base processor 311 outputs an automatic driving command to degrade automatic driving to the primary base processor 301 instead. As a result, even if the function of the primary baseboard 30 stops due to an abnormality in the power supply 6a, the generation of an automatic driving command that instructs degeneration of automatic driving can continue. Therefore, in addition to maintainability, reliability can be improved.

[0116] According to the autonomous driving control device 3 of this embodiment, when an abnormality occurs in the primary sensing blade 33, the primary base processor 301 outputs an autonomous driving command to degrade autonomous driving based on a control request generated by the secondary autonomous driving processor 361. As a result, even if sensing data cannot be acquired due to an abnormality in the primary sensing blade 33, the generation of an autonomous driving command can continue to instruct degeneration of autonomous driving. This can improve reliability in addition to maintainability.

[0117] In the autonomous driving control device 3 of this embodiment, when an abnormality occurs in the primary autonomous driving blade 34, the secondary autonomous driving processor 361 generates a control request based on the sensing data preprocessed by the secondary sensing processor 351 and the sensing data preprocessed by the primary sensing processor 331. Therefore, according to the autonomous driving control device 3 of this embodiment, when an abnormality occurs in the primary autonomous driving blade 34, the primary base processor 301 outputs an autonomous driving command to degrade autonomous driving based on the control request generated by the secondary autonomous driving processor 361. As a result, even if a control request cannot be obtained due to an abnormality in the primary autonomous driving blade 34, the generation of an autonomous driving command can continue to instruct the degeneration of autonomous driving. This can improve reliability in addition to maintainability.

[0118] According to the autonomous driving control device 3 of this embodiment, when an abnormality occurs in the secondary baseboard 31 or when an abnormality occurs in the power supply 6b that supplies power to the secondary baseboard 31, the primary base processor 301 in at least one of the two outputs an autonomous driving command to degrade autonomous driving based on a control request generated by the primary autonomous driving processor 341. As a result, even if the function of the secondary baseboard 31 stops due to an abnormality in at least one of the secondary baseboard 31 and the power supply 6b that supplies power to the secondary baseboard 31, the generation of an autonomous driving command that instructs degeneration of autonomous driving can continue. Therefore, in addition to maintainability, reliability can be improved.

[0119] (Other embodiments) Although one embodiment has been described above, the present disclosure should not be construed as being limited to the embodiment described above, and can be applied to various embodiments within the scope that does not deviate from the gist of the present disclosure.

[0120] In a modified example, the dedicated computer constituting each processor of the automatic driving control device may have at least one of a digital circuit and an analog circuit as a processor. Here, the digital circuit is at least one of an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a system on a chip (SOC), a programmable gate array (PGA), and a complex programmable logic device (CPLD). Furthermore, such a digital circuit may have a memory that stores a program.

[0121] Although each of the baseboards 30, 31 in the embodiment has two blade connectors, each of the baseboards 30, 31 may have three or more blade connectors. For example, each of the baseboards 30, 31 may be provided with three or more blade connectors, with one connected to an autonomous driving blade and the remaining connected to sensing blades, each connected to sensors with different monitoring ranges. In this case, by distributing the functions of the sensing blades, it is possible to reduce the extent of degeneration when an abnormality occurs in one sensing blade. [Explanation of symbols]

[0122] 2: Vehicle, 4: Sensor, 3: Autonomous driving control device, 6a, 6b Power supply, 30, 31: Base board, 33, 35: Sensing blade, 34, 36: Autonomous driving blade 301, 311: Base processor, 304, 314: Sensing connector, 305, 315: Autonomous driving connector, 331, 351: Sensing processor, 341, 361: Autonomous driving processor

Claims

1. An automatic driving control device (3) that controls automatic driving of a vehicle (2) based on sensing data from a sensor (4), a baseboard (30, 31) having a base processor (301, 311) and a plurality of blade connectors (304, 305, 314, 315); a sensing blade (33, 35) configured to be detachable from the sensing connector (304, 314) as the blade connector and having a sensing processor (331, 351) that preprocesses the sensing data from the sensor; an autonomous driving blade (34, 36) configured as the blade connector to be detachably attached to an autonomous driving connector (305, 315) different from the sensing connector, and having an autonomous driving processor (341, 361) that generates a control request for the autonomous driving of the vehicle based on the sensing data preprocessed by the sensing processor; The base processor outputs an autonomous driving command to be given to the vehicle based on the control request generated by the autonomous driving processor, in accordance with the monitoring status of the sensing blade and the autonomous driving blade.

2. The baseboards include a primary baseboard (30) and a secondary baseboard (31) communicably connected to each other, The primary baseboard and the secondary baseboard are powered by different power sources (6a, 6b), A primary sensing blade (33) as the sensing blade is connected to the sensing connector of the primary baseboard, and a primary autonomous driving blade (34) as the autonomous driving blade is connected to the autonomous driving connector of the primary baseboard, The automatic driving control device of claim 1, wherein a secondary sensing blade (35) as the sensing blade is connected to the sensing connector of the secondary baseboard that assists the primary baseboard, and a secondary automatic driving blade (36) as the automatic driving blade is connected to the automatic driving connector of the secondary baseboard.

3. the primary sensing blade has a primary sensing processor as the sensing processor, and the primary autonomous driving blade has a primary autonomous driving processor as the autonomous driving processor that generates the control request based on the sensing data preprocessed by the primary sensing processor; the secondary sensing blade has a secondary sensing processor as the sensing processor, and the secondary autonomous driving blade has a secondary autonomous driving processor as the autonomous driving processor that generates the control request based on the sensing data preprocessed by the secondary sensing processor; a primary base processor that is the base processor of the primary baseboard monitors communication with the primary sensing blade and the primary autonomous driving blade, monitors communication with the secondary sensing blade and the secondary autonomous driving blade, and outputs the autonomous driving command according to the monitoring status; The automatic driving control device described in claim 2, wherein the secondary base processor, which is the base processor of the secondary base board, monitors communication with the secondary sensing blade and the secondary automatic driving blade, and when an abnormality occurs in the power supply supplying power to the primary base board, outputs the automatic driving command to degrade the automatic driving to the primary base processor instead.

4. The autonomous driving control device of claim 3, wherein the primary base processor outputs the autonomous driving command to degrade the autonomous driving based on the control request generated by the secondary autonomous driving processor when an abnormality occurs in the primary sensing blade.

5. When an abnormality occurs in the primary autonomous driving blade, the secondary autonomous driving processor generates the control request based on the sensing data preprocessed by the secondary sensing processor and the sensing data preprocessed by the primary sensing processor; 5. The automatic driving control device according to claim 3, wherein the primary base processor outputs the automatic driving command to degrade the automatic driving based on the control request generated by the secondary automatic driving processor when an abnormality occurs in the primary automatic driving blade.

6. The autonomous driving control device of claim 3 or 4, wherein the primary base processor outputs the autonomous driving command to degrade the autonomous driving based on the control request generated by the primary autonomous driving processor when an abnormality occurs in the secondary baseboard or when an abnormality occurs in the power supply that supplies power to the secondary baseboard.

Images