Control device, control method, and control program

Abstract

To provide a technique capable of reducing damages caused by suddenly stopping a vehicle about control for receiving satisfaction of a prescribed condition to suddenly stop the vehicle.SOLUTION: According to the present disclosure, a control device is configured so as to execute, in processing for suddenly stopping a vehicle, the acquisition of occupant information including at least one of a state and attributes of occupants of the vehicle, the acquisition of travel environment information of the vehicle, the calculation of an in-vehicle risk showing a risk of damages to be received by the occupants if first brake control decelerates the vehicle on the basis of the occupant information, the calculation of an external risk showing a risk of damages by the vehicle on the basis of the travel environment information, the braking of the vehicle due to second brake control having deceleration that is less than that of the first brake control while the in-vehicle risk is higher than the external risk, and the braking of the vehicle by the first brake control when the external risk becomes higher than the in-vehicle risk.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present disclosure relates to vehicle control, and more particularly to control of bringing a vehicle to an emergency stop when a predetermined condition is satisfied. [Background technology]

[0002] Patent Document 1 discloses a safe vehicle driving system that includes a safety determination unit that detects the state of a vehicle occupant and determines the occupant's safety against impact on multiple levels, and a driving control unit that imposes restrictions on driving operations such as acceleration / deceleration or steering according to the safety level. Patent Document 1 also discloses that the driving control unit prioritizes the execution of collision avoidance operations over restrictions on driving operations. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-062197 Summary of the Invention [Problem to be solved by the invention]

[0004] 2. Description of the Related Art In controlling vehicles such as autonomous vehicles and remotely driven vehicles, if a situation arises in which normal driving cannot be maintained, the vehicle is brought to an emergency stop.

[0005] Conventionally, in emergency stops, strong braking is applied to the vehicle to bring it to a swift stop, taking into account the surrounding traffic conditions. In this case, strong G-forces are applied inside the vehicle. This can cause serious injury to the vehicle occupants, such as if they fall over. However, depending on the surrounding traffic conditions, there are cases where it is not necessary to bring the vehicle to a swift stop.

[0006] By applying the technology disclosed in Patent Document 1, restrictions are placed on driving operations according to the level of safety for passengers against impacts. However, because priority is given to the execution of collision avoidance operations, strong braking is still applied to the vehicle even when it is not necessary to bring the vehicle to a halt early.

[0007] In view of the above-mentioned problems, one object of the present disclosure is to provide a technology for controlling an emergency stop of a vehicle that can reduce damage caused by the emergency stop of a vehicle. [Means for solving the problem]

[0008] The first disclosure relates to a vehicle control device.

[0009] The control device according to the first disclosure is configured to execute a process for bringing a vehicle to an emergency stop when a predetermined condition is satisfied, and the process for bringing the vehicle to an emergency stop includes acquiring occupant information including at least one of information on the status or attributes of the vehicle occupants, acquiring driving environment information including at least information on the vehicle's surrounding environment, calculating an in-vehicle risk indicating the risk of damage to the occupants if the vehicle is decelerated by a first braking control based on the occupant information, calculating an outside-vehicle risk indicating the risk of damage caused by the vehicle based on the driving environment information, braking the vehicle by a second braking control that decelerates less than the first braking control while the inside-vehicle risk is higher than the outside-vehicle risk, and braking the vehicle by the first braking control when the outside-vehicle risk becomes higher than the inside-vehicle risk.

[0010] The second disclosure relates to a vehicle control method.

[0011] The control method of the second disclosure includes making an emergency stop of a vehicle when a predetermined condition is satisfied, and making the vehicle come to an emergency stop includes acquiring occupant information including information on at least one of the status or attributes of the vehicle occupants, acquiring driving environment information including at least information on the vehicle's surrounding environment, calculating an in-vehicle risk indicating the risk of damage to the occupants if the vehicle is decelerated by a first braking control based on the occupant information, calculating an outside-vehicle risk indicating the risk of damage caused by the vehicle based on the driving environment information, braking the vehicle by a second braking control that decelerates less than the first braking control while the inside-vehicle risk is higher than the outside-vehicle risk, and braking the vehicle by the first braking control when the outside-vehicle risk becomes higher than the inside-vehicle risk.

[0012] The third disclosure relates to a control program that causes a computer to control a vehicle.

[0013] The control computer of the third disclosure is configured to cause the computer to execute a process for making an emergency stop of the vehicle when a predetermined condition is satisfied, and the process for making an emergency stop of the vehicle includes acquiring occupant information including information on at least one of the status or attributes of the vehicle occupants, acquiring driving environment information including at least information on the vehicle's surrounding environment, calculating an in-vehicle risk indicating the risk of damage to the occupants if the vehicle is decelerated by a first braking control based on the occupant information, calculating an outside-vehicle risk indicating the risk of damage caused by the vehicle based on the driving environment information, braking the vehicle by a second braking control that decelerates less than the first braking control while the inside-vehicle risk is higher than the outside-vehicle risk, and braking the vehicle by the first braking control when the outside-vehicle risk becomes higher than the inside-vehicle risk. [Effects of the Invention]

[0014] According to the present disclosure, while the risk inside the vehicle is higher than the risk outside the vehicle, the vehicle is braked by a second braking control that decelerates less than the first braking control. The second braking control is expected to cause less impact to occupants than the first braking control. Therefore, while the risk inside the vehicle is higher than the risk outside the vehicle, the vehicle can be braked with priority given to reducing damage to occupants. On the other hand, when the risk outside the vehicle becomes higher than the risk inside the vehicle, the vehicle can be braked with priority given to reducing damage caused by the vehicle. Ultimately, damage caused by making an emergency stop of the vehicle can be appropriately reduced depending on a comparison between the risk inside the vehicle and the risk outside the vehicle. [Brief explanation of the drawings]

[0015] [Figure 1] FIG. 2 is a block diagram for explaining the configuration of a control device according to the present embodiment. [Figure 2] FIG. 10 is a diagram showing an example of a table for calculating a risk inside a vehicle and a risk outside a vehicle. [Figure 3] FIG. 1 is a conceptual diagram illustrating an example according to the present embodiment. [Figure 4] FIG. 1 is a conceptual diagram illustrating an example according to the present embodiment. [Figure 5] FIG. 4 is a diagram illustrating an example of processing executed by the control device according to the present embodiment. [Figure 6] FIG. 4 is a diagram illustrating an example of processing executed by the control device according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0016] Hereinafter, this embodiment will be described with reference to the drawings.

[0017] 1. Configuration 1 is a block diagram for explaining the configuration of a control device 100 according to this embodiment. The control device 100 according to this embodiment is a computer that is provided in a vehicle and executes processes related to vehicle control.

[0018] Here, examples of vehicles equipped with the control device 100 according to this embodiment include an autonomous vehicle and a remotely driven vehicle. When the vehicle is an autonomous vehicle, the control device 100 can be considered as a computer that executes processing related to the autonomous driving function. For example, the control device 100 controls the vehicle according to commands received from an autonomous driving kit provided in the autonomous vehicle. When the vehicle is a remotely driven vehicle, the control device 100 can be considered as a computer that executes processing related to the remote driving function. For example, the control device 100 controls the vehicle according to commands received from a remote driving device connected to the remotely driven vehicle. However, the control device 100 according to this embodiment can also be applied to more general vehicles.

[0019] In the following description, the term "vehicle" refers to a vehicle that is equipped with the control device 100 according to this embodiment and that is an object of control by the control device 100 according to this embodiment.

[0020] The control device 100 is connected so as to be able to communicate with an in-vehicle environment detection sensor 210, an ambient environment detection sensor 220, a driving state detection sensor 230, an HMI 400, and an actuator 500. For example, the control device 100 is connected to these devices via an in-vehicle network configured by a CAN (Control Area Network) or the like.

[0021] The interior environment detection sensor 210 detects the environment inside the vehicle. In particular, the interior environment detection sensor 210 detects and outputs at least one of information on the state or attributes of the vehicle occupants (occupant information 123). Here, the state of the occupants may be, for example, whether they are seated or standing, whether they are wearing a seat belt, etc. Furthermore, the attributes of the occupants may be given as classifications such as infants, elderly people, priority persons (pregnant women, injured or ill people, physically disabled people, etc.), and general.

[0022] Examples of the in-vehicle environment detection sensor 210 include an in-vehicle camera, a seating sensor, a seat belt sensor, etc. The in-vehicle environment detection sensor 210 can be configured to detect the occupant information 123 by, for example, image recognition of an image captured by the in-vehicle camera. Furthermore, the in-vehicle environment detection sensor 210 can be configured to detect the occupant information 123 by combining information on the detection state of the seating sensor and the detection state of the seat belt sensor.

[0023] The surrounding environment detection sensor 220 detects and outputs information about the surrounding environment of the vehicle (surrounding vehicles, pedestrians, surrounding objects, lanes, etc.). The surrounding environment information detected by the surrounding environment detection sensor 220 is one type of information indicating the traveling environment of the vehicle (traveling environment information 124). Examples of the surrounding environment detection sensor 220 include an external camera, millimeter wave radar, and LiDAR (Light Detection and Ranging).

[0024] The running condition detection sensor 230 detects and outputs information on the running condition of the vehicle (vehicle speed, acceleration, yaw rate, etc.). The running condition information detected by the running condition detection sensor 230 is one type of running environment information 124. Examples of the running condition detection sensor 230 include a wheel speed sensor and an IMU (Inertial Measurement Unit).

[0025] The HMI 400 provides a human machine interface (HMI) function. Examples of the HMI 400 include a display, a speaker, a touch panel, and an indicator.

[0026] The actuator 500 operates in accordance with a control signal obtained from the control device 100. Examples of the actuator 500 include an actuator related to the operation of a power unit (internal combustion engine, electric motor, etc.), an actuator related to the operation of a brake mechanism, an actuator related to the operation of a steering mechanism, etc.

[0027] The control device 100 includes one or more processors 110 (hereinafter simply referred to as processors 110), one or more storage devices 120 (hereinafter simply referred to as storage devices 120), and a control interface 130. The processor 110 executes various processes and outputs control signals. The processor 110 may be configured, for example, as a central processing unit (CPU) including an arithmetic unit, registers, etc. The storage device 120 is coupled to the processor 110 and stores various information required for the processor 110 to execute its processes. The storage device 120 may be configured, for example, as a recording medium such as a read-only memory (ROM), a random access memory (RAM), a hard disk drive (HDD), or a solid state drive (SSD). The control interface 130 establishes connections between the control device 100 and each device and transmits and receives information to and from the processor 110 or the storage device 120. The control device 100 communicates with each device via the control interface 130.

[0028] The storage device 120 stores a computer program 121, passenger information 123, and driving environment information 124.

[0029] The computer program 121 is made up of a plurality of instructions 122. The computer program 121 is configured to cause the processor 110 to execute various processes. In other words, the processor 110 operates in accordance with the plurality of instructions 122 to execute various processes. The computer program 121 may be stored in a computer-readable recording medium.

[0030] The passenger information 123 is received from the vehicle interior environment detection sensor 210. The driving environment information 124 is received from the surrounding environment detection sensor 220 and the driving state detection sensor 230.

[0031] 2. Processing The control device 100 (more specifically, the processor 110) is configured to execute a process for bringing the vehicle to an emergency stop (hereinafter simply referred to as "emergency stop process") when a predetermined condition is satisfied. The predetermined condition is typically a condition indicating that the vehicle cannot maintain normal driving. For example, if the vehicle is an autonomous vehicle, the predetermined condition may be a loss of duplex communication with the autonomous driving kit. Alternatively, if the vehicle is a remotely driven vehicle, the predetermined condition may be a loss of communication with the remote driving device. The predetermined condition may be set appropriately depending on the environment in which this embodiment is applied.

[0032] The emergency stop processing executed by the control device 100 will be described below.

[0033] First, the control device 100 calculates, based on the passenger information 123, the risk of injury to the passenger (hereinafter referred to as "in-vehicle risk") when the vehicle is decelerated by a predetermined braking control (hereinafter referred to as "first braking control"). Here, the first braking control is typically a control that applies the brakes to the vehicle so as to bring the vehicle to an early stop. In particular, the first braking control may be a conventional braking control that brings the vehicle to an emergency stop. The injury to the passenger is expected to be damage caused by G-forces applied inside the vehicle due to the deceleration of the vehicle. For example, the injury to the passenger may include the passenger falling and injuries caused by the fall, injuries or deterioration of physical condition caused by shock due to deceleration, etc.

[0034] It is expected that the risk inside a vehicle is strongly influenced by the state and attributes of the passengers. For example, if the passengers are standing, the risk inside the vehicle is expected to be higher than if they are seated. Also, if the passengers' attributes are young children or elderly people, the risk inside the vehicle is expected to be higher than for the general population.

[0035] Therefore, the control device 100 can be configured to calculate the in-vehicle risk according to the type of occupant identified based on the occupant information 123. Hereinafter, the calculation of the in-vehicle risk according to the type of occupant will be described with reference to (A) of Fig. 2.

[0036] FIG. 2(A) is a table that defines scores for each type of passenger. In FIG. 2(A), the type of passenger is a combination of the passenger's state and attributes. The control device 100 can refer to the table shown in FIG. 2(A) to calculate the score defined for the type of passenger as the in-vehicle risk. For example, when the type of passenger is an elderly person standing, the control device 100 calculates the in-vehicle risk to be 8. The table shown in FIG. 2(A) may be provided in advance as the computer program 121.

[0037] Next, the control device 100 calculates the risk of damage caused by the vehicle (hereinafter referred to as "external vehicle risk") based on the driving environment information 124. Types of damage caused by the vehicle include traffic disruption, minor contact with surrounding objects, and collision with other vehicles. Here, it is considered reasonable that the external vehicle risk when the damage caused by the vehicle is a "collision with other vehicles" is significantly greater than the external vehicle risk when the damage caused by the vehicle is a "traffic disruption." Furthermore, the external vehicle risk also serves as an indicator of the likelihood of vehicle damage occurring. For example, when the likelihood of "minor contact with surrounding objects" occurring is 10%, the external vehicle risk is considered not to be that great.

[0038] Therefore, the control device 100 calculates the probability of occurrence of multiple types of damage caused by the vehicle based on the driving environment information 124. A suitable known technology may be used to calculate the probability of occurrence. For example, it is possible to calculate the probability of occurrence of "traffic disruption" or "minor contact with surrounding objects" based on the relative distance to the surrounding objects detected by the surrounding environment detection sensor 220 and the driving state of the vehicle detected by the driving state detection sensor 230. The control device 100 can then be configured to calculate the outside-vehicle risk based on the calculated probability of occurrence of each of the multiple types. Below, with reference to FIG. 2(B), the calculation of the outside-vehicle risk based on the probability of occurrence of each of the multiple types will be described.

[0039] FIG. 2B is a table that defines scores for each of multiple types of vehicle-related damage. The control device 100 can calculate the vehicle exterior risk as a weighted sum of the scores for each type defined in the table shown in FIG. 2B, using the calculated likelihood of occurrence for each type as a weight. For example, if the likelihood of "traffic disruption" is 80% and the likelihood of "minor contact with surrounding objects" is 60%, the control device 100 calculates the vehicle exterior risk as 2×0.8+5×0.6=4.6. Alternatively, the control device 100 can be configured to refer to the table shown in FIG. 2B and calculate the score for the type with the highest calculated likelihood as the vehicle exterior risk. The table shown in FIG. 2B may be provided in advance as the computer program 121. It is desirable that the scores defined in the table be appropriate in relation to the vehicle interior risk described above. In other words, it is necessary to ensure the validity of the comparison between the calculated vehicle interior risk and the vehicle exterior risk. The validity can be ensured by analyzing past data and experimental data on changes in surrounding traffic conditions and the status of passengers due to emergency braking.

[0040] Next, the control device 100 starts braking the vehicle. Here, when the risk inside the vehicle is higher than the risk outside the vehicle, the control device 100 brakes the vehicle using braking control (hereinafter referred to as "second braking control") that decelerates less than the first braking control. An example of the second braking control is performing preliminary minor braking before performing main braking to stop the vehicle. Furthermore, the second braking control may be performing main braking with a smaller deceleration than the first braking control. On the other hand, when the risk outside the vehicle is higher than the risk inside the vehicle, the control device 100 brakes the vehicle using the first braking control.

[0041] The control device 100 generates and outputs a control signal corresponding to the first braking control or the second braking control by executing the emergency stop processing. Then, the actuator 500 operates in accordance with the generated control signal, thereby realizing braking of the vehicle in accordance with the first braking control or the second braking control. The control device 100 may also generate and output a control signal to the HMI 400 to notify the occupant of the execution of the emergency stop processing. In this case, the HMI 4000 operates in accordance with the generated control signal, thereby realizing notification to the occupant in accordance with the first braking control or the second braking control (such as a display on a display or a sound from a speaker).

[0042] Incidentally, even after braking of the vehicle is initiated, the risk outside the vehicle is expected to change from moment to moment depending on changes in the surrounding environment and the braking situation of the vehicle. For this reason, the control device 100 may be configured to calculate the risk outside the vehicle in a timely manner even after braking of the vehicle is initiated. In this case, when the risk outside the vehicle becomes higher than the risk inside the vehicle after braking of the vehicle is initiated, the control device 100 may be configured to switch from the second braking control to the first braking control and brake the vehicle.

[0043] In this way, while the risk inside the vehicle is higher than the risk outside the vehicle, the control device 100 brakes the vehicle using the second braking control, which decelerates less than the first braking control. The second braking control is expected to cause less impact to the occupants than the first braking control. Therefore, according to this embodiment, while the risk inside the vehicle is higher than the risk outside the vehicle, the vehicle can be braked with priority given to reducing damage to the occupants. On the other hand, when the risk outside the vehicle becomes higher than the risk inside the vehicle, the vehicle can be braked with priority given to reducing damage caused by the vehicle. Ultimately, the damage caused by making an emergency stop of the vehicle can be appropriately reduced depending on the comparison between the risk inside the vehicle and the risk outside the vehicle.

[0044] Furthermore, the control device 100 may be configured to decelerate the vehicle at a lower deceleration in the second braking control as the in-vehicle risk increases. For example, the control device 100 sets the minor braking and the deceleration in the main braking in the second braking control according to the identified type of occupant. In this case, the control device 100 may be configured to set a lower deceleration as the in-vehicle risk calculated for the type of occupant increases. By configuring in this way, the second braking control can brake the vehicle taking into account the level of the in-vehicle risk. Ultimately, the damage suffered by occupants can be more appropriately reduced.

[0045] 3 and 4 show an example of the emergency stop processing executed by the control device 100. FIG. 3 shows three patterns that differ in the type of occupant and the likelihood of damage caused by the vehicle. FIG. 3 also shows the in-vehicle risk and the outside-vehicle risk calculated for each of the three patterns. Here, the in-vehicle risk and the outside-vehicle risk shown in FIG. 3 are calculated based on the table shown in FIG. 2. FIG. 4 shows the state of braking control and the change in vehicle speed for each of the three patterns, corresponding to the three patterns shown in FIG. 3.

[0046] As shown in FIG. 3, patterns 1 and 2 have a higher risk inside the vehicle than outside the vehicle, and pattern 3 has a higher risk outside the vehicle than inside the vehicle. As shown in FIG. 4, patterns 1 and 2 brake the vehicle using the second braking control, and pattern 3 brakes the vehicle using the first braking control. As a result, patterns 1 and 2 have a gradual change in vehicle speed, which can reduce the impact on passengers. Pattern 1 also has a higher risk inside the vehicle than pattern 2. As shown in FIG. 4, pattern 1 has a smaller deceleration rate for light braking and main braking than pattern 2. As a result, pattern 1 can further reduce the impact on passengers than pattern 2.

[0047] Fig. 5 is a flowchart showing an example of the emergency stop process executed by processor 110. The flowchart shown in Fig. 5 starts when a predetermined condition is satisfied.

[0048] In step S100, processor 110 acquires occupant information 123. Thereafter, in step S200, processor 110 calculates an in-vehicle risk based on occupant information 123.

[0049] In step S300, processor 110 acquires driving environment information 124. Thereafter, in step S400, processor 110 calculates an outside-vehicle risk based on driving environment information 124.

[0050] In step S500, processor 110 compares the in-vehicle risk calculated in step S200 with the outside-vehicle risk calculated in step S400. If the in-vehicle risk is higher than the outside-vehicle risk (step S500; No), processor 110 executes the second braking control (step S600). If the outside-vehicle risk is higher than the in-vehicle risk (step S500; Yes), processor 110 executes the first braking control (step S700).

[0051] In this way, in the emergency stop processing, processor 110 executes the processing. Furthermore, the vehicle control method according to this embodiment is realized by processor 110 executing the processing in this way. Furthermore, by configuring computer program 121 that causes processor 110 to execute the processing in this way, the control program according to this embodiment is realized.

[0052] Processor 110 may be configured to repeatedly execute the process of step S500 at a predetermined control period after executing the second braking control (step S600). Processor 110 may be configured to switch from the second braking control to the first braking control when the risk outside the vehicle becomes higher than the risk inside the vehicle (step S500; Yes).

[0053] Fig. 6 is a flowchart showing an example of processing executed by processor 110 when setting the deceleration of the second braking control according to the type of occupant. The flowchart shown in Fig. 6 is executed repeatedly at predetermined intervals, for example, when the second braking control is executed. In Fig. 6, it is assumed that the deceleration for "standing" is smaller than the deceleration for "seated (seat belt not fastened)", and that the deceleration for "seated (seat belt not fastened)" is smaller than the deceleration for "seated and seat belt fastened".

[0054] In step S710, processor 110 determines whether the passenger is seated. If the passenger is not seated (step S710; No), processor 110 sets the deceleration for "standing" (step S720). If the passenger is seated (step S710; Yes), the process proceeds to step S730.

[0055] In step S730, processor 110 determines whether the occupant is in a seat belt state. If the occupant is not in a seat belt state (step S730; No), processor 110 sets the deceleration rate for "seated (seat belt not fastened)." If the occupant is in a seat belt state (step S730; Yes), processor 110 sets the deceleration rate for "seated and seat belt fastened."

[0056] By executing the process in this manner, processor 110 can execute the second braking control so that the vehicle is decelerated at a smaller deceleration as the in-vehicle risk increases. [Explanation of symbols]

[0057] 100 control device, 110 processor, 120 storage device, 121 computer program, 123 passenger information, 124 driving environment information

Claims

1. A vehicle control device configured to execute a process of bringing the vehicle to an emergency stop when a predetermined condition is satisfied, The process of bringing the vehicle to an emergency stop includes: Acquiring passenger information including information on the status and attributes of passengers of the vehicle; acquiring driving environment information including at least a relative distance between the vehicle and a surrounding object and a driving state of the vehicle; Calculating an in-vehicle risk indicating a risk of injury to the occupant when the vehicle is decelerated by the first braking control based on the occupant information; Calculating an outside-vehicle risk indicating a risk of damage caused by the vehicle based on the driving environment information; While the risk inside the vehicle is higher than the risk outside the vehicle, braking of the vehicle is performed by a second braking control that causes less deceleration than the first braking control. When the risk outside the vehicle becomes higher than the risk inside the vehicle, braking the vehicle by the first braking control. Contains A control device characterized by:

2. The control device according to claim 1, The second braking control includes decelerating the vehicle at a smaller deceleration rate as the in-vehicle risk increases. A control device characterized by:

3. The control device according to claim 1 or 2, Calculating the in-vehicle risk includes: Identifying the type of passenger based on a combination of the type of passenger and an attribute of the passenger; Calculating a predetermined score for the identified type of occupant as the in-vehicle risk; Including, Calculating the outside-vehicle risk includes: Calculating the likelihood of occurrence of a plurality of types of damage caused by the vehicle based on the driving environment information; Calculating the outside-vehicle risk based on a predetermined score for each of the plurality of types and the calculated occurrence probability for each of the plurality of types; Contains A control device characterized by:

4. A control device according to claim 1 or claim 2, The process of making an emergency stop of the vehicle includes: recalculating the outside-vehicle risk even after braking of the vehicle is started; switching from the second braking control to the first braking control when the recalculated outside risk becomes higher than the inside risk after starting braking of the vehicle; Including, A control device characterized by:

5. A method for controlling a vehicle, comprising bringing the vehicle to an emergency stop in response to a predetermined condition being satisfied, Bringing the vehicle to an emergency stop Acquiring passenger information including information on the status and attributes of passengers of the vehicle; acquiring driving environment information including at least a relative distance between the vehicle and a surrounding object and a driving state of the vehicle; Calculating an in-vehicle risk indicating a risk of injury to the occupant when the vehicle is decelerated by the first braking control based on the occupant information; Calculating an outside-vehicle risk indicating a risk of damage caused by the vehicle based on the driving environment information; While the risk inside the vehicle is higher than the risk outside the vehicle, braking of the vehicle is performed by a second braking control that causes less deceleration than the first braking control. When the risk outside the vehicle becomes higher than the risk inside the vehicle, braking the vehicle by the first braking control. Contains A control method comprising:

6. A control program for causing a computer to control a vehicle, the control program being configured to cause the computer to execute a process for bringing the vehicle to an emergency stop when a predetermined condition is satisfied, The process of bringing the vehicle to an emergency stop includes: Acquiring passenger information including information on the status and attributes of passengers of the vehicle; acquiring driving environment information including at least a relative distance between the vehicle and a surrounding object and a driving state of the vehicle; Calculating an in-vehicle risk indicating a risk of injury to the occupant when the vehicle is decelerated by the first braking control based on the occupant information; Calculating an outside-vehicle risk indicating a risk of damage caused by the vehicle based on the driving environment information; While the risk inside the vehicle is higher than the risk outside the vehicle, braking of the vehicle is performed by a second braking control that causes less deceleration than the first braking control. When the risk outside the vehicle becomes higher than the risk inside the vehicle, braking the vehicle by the first braking control. Contains A control program comprising:

Images