Vehicle control device and vehicle control program

Abstract

To make it possible to determine whether an abnormality occurs in on-vehicle equipment while suppressing the cost increase of a system.SOLUTION: A travel control device 100 includes: a command unit M10 that generates a command value for an actuator and outputs the command value to a control unit, thereby allowing a vehicle to travel; a state amount acquisition unit M20 that acquires at least two vehicle state amounts out of a vehicle state amount ideal value PSW, vehicle state amount detected values PSS1 and PSS2, and a vehicle state amount operation value PSD; an event storage unit M30 that stores a plurality of events; an event acquisition unit M40 that acquires an event corresponding to the comparison result of the multiple vehicle state amounts acquired by the state amount acquisition unit M20; and an abnormality determination unit M50 that uses a Bayesian network with the probability of occurrence of the event acquired by the event acquisition unit M40 as a node, and determines whether an abnormality occurs in on-vehicle equipment.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a vehicle control device and a vehicle control program. [Background technology]

[0002] Patent Document 1 describes an example of an autonomous driving system that detects abnormalities in on-board devices. This system is equipped with a main monitoring device and an auxiliary monitoring device that monitor on-board devices that are the target of abnormality detection. If both the main monitoring device and the auxiliary monitoring device detect an abnormality in the on-board device, an alarm device warns the vehicle occupants. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2019-214336 Summary of the Invention [Problem to be solved by the invention]

[0004] In the above system, the process of determining whether an abnormality has occurred in the on-board unit is performed by both the main monitoring device and the auxiliary monitoring device. In other words, multiple monitoring devices that perform the same determination process are provided, which raises concerns about increased system costs. [Means for solving the problem]

[0005] A vehicle control device for solving the above problem is applied to a vehicle that includes, as an on-board device, an actuator related to the vehicle's driving, a control unit for the actuator, and a detection system that detects the state of the vehicle that changes due to the operation of the actuator. This vehicle control device includes: a command unit that generates command values ​​for the actuators based on requests from an application request unit regarding driving assistance functions and outputs the command values ​​to the control unit to drive the vehicle; a state quantity acquisition unit that acquires at least two vehicle state quantities from among an ideal vehicle state quantity value, which is a vehicle state quantity when the actuators operate normally in accordance with the command values; a vehicle state quantity detection value, which is a vehicle state quantity based on the detection results of the detection system; and a vehicle state quantity operation value, which is a vehicle state quantity corresponding to the operation quantity of the actuators; an event memory unit that stores multiple events that may occur when any of the on-board devices is not normal; an event acquisition unit that compares the multiple vehicle state quantities acquired by the state quantity acquisition unit and acquires an event from the multiple events corresponding to the result of the comparison; and an abnormality determination unit that uses a Bayesian network in which nodes represent the probability of occurrence of the event acquired by the event acquisition unit to determine whether an abnormality has occurred in the on-board device.

[0006] According to the above configuration, when a command value generated based on a request from the application request unit is output to the control unit, the control unit operates the actuator. As a result, the vehicle runs based on the request. In this case, at least two vehicle state quantities are acquired from among the vehicle state quantity ideal value, the vehicle state quantity detected value, and the vehicle state quantity operation value. An event corresponding to the result of comparing the acquired vehicle state quantities is acquired from multiple events stored in the event memory unit. Then, by using a Bayesian network in which the occurrence probability of the acquired event is represented as a node, it is determined whether or not an abnormality has occurred in the on-board device. In other words, it is possible to determine whether or not an abnormality has occurred in the on-board device without preparing multiple control devices that perform equivalent determination processing. Therefore, it is possible to determine whether or not an abnormality has occurred in the on-board device while suppressing an increase in system costs.

[0007] A vehicle control program for solving the above problem is a program executed by an execution device of a vehicle control device including, as an on-board device, an actuator related to vehicle driving, a control unit for the actuator, and a detection system that detects changes in a vehicle state due to operation of the actuator. The vehicle control program causes the execution device to execute: a command process for generating command values ​​for the actuator based on a request from an application request unit related to a driving assistance function and outputting the command values ​​to the control unit to drive the vehicle; a state quantity acquisition process for acquiring at least two vehicle state quantities from among a vehicle state quantity ideal value that is a vehicle state quantity when the actuator normally operates in accordance with the command value, a vehicle state quantity detected value that is a vehicle state quantity based on a detection result of the detection system, and a vehicle state quantity operation value that is a vehicle state quantity corresponding to an operation amount of the actuator; an event acquisition process for comparing the multiple vehicle state quantities acquired in the state quantity acquisition process and acquiring an event corresponding to a result of the comparison from multiple events that may occur when any of the on-board devices is abnormal; and an abnormality determination process for determining whether an abnormality has occurred in the on-board device using a Bayesian network in which nodes represent occurrence probabilities of the events acquired in the event acquisition process.

[0008] According to the above configuration, by having the execution device execute each process, it is possible to obtain the same functions and effects as the above vehicle control device. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing an outline of a vehicle equipped with a driving control device that is one embodiment of a vehicle control device. [Figure 2] FIG. 2 is a block diagram showing the functional configuration of the driving control device. [Figure 3] FIG. 3 is a diagram showing a plurality of events stored in the driving control device. [Figure 4] FIG. 4 is a timing chart showing when the difference between the two vehicle state quantities changes. [Figure 5]FIG. 5 is a diagram showing a first event and a second event among the plurality of events shown in FIG. [Figure 6] FIG. 6 is a flowchart illustrating a processing routine executed by the processing circuit of the driving control device. [Figure 7] FIG. 7 is a timing chart illustrating the correction of the command value when it is determined that the vehicle-mounted device may be malfunctioning. DETAILED DESCRIPTION OF THE INVENTION

[0010] An embodiment of a vehicle control device and a vehicle control program will be described below with reference to FIGS. FIG. 1 shows a part of a vehicle 10 to which a cruise control device 100, which is an example of a vehicle control device, is applied.

[0011] <Vehicle configuration> The vehicle 10 includes a plurality of wheels 20, friction brakes 30 in the same number as the wheels 20, a braking device 50, a driving device 40, a steering device 60, and an alarm device .

[0012] The friction brake 30 is a braking mechanism that generates a friction braking force on the wheel 20. The friction brake 30 has a rotating body 31 that rotates integrally with the wheel 20, a friction material 32, and a wheel cylinder 33. When WC pressure, which is a hydraulic pressure within the wheel cylinder 33, is generated, the friction material 32 is pressed against the rotating body 31. This applies a friction braking force to the wheel 20. In other words, the higher the WC pressure, the greater the force pressing the friction material 32 against the rotating body 31, and as a result, the greater the friction braking force.

[0013] The braking device 50 includes a brake actuator 51 that supplies brake fluid to the wheel cylinders 33 of the multiple friction brakes 30, and a brake control unit 52 that controls the brake actuator 51. The brake control unit 52 adjusts the WC pressure in the multiple wheel cylinders 33 by controlling the brake actuator 51. That is, the brake control unit 52 adjusts the friction braking force of the vehicle 10 by adjusting the WC pressure in the multiple wheel cylinders 33. The friction braking force of the vehicle 10 is the sum of the friction braking forces applied to the multiple wheels 20. In this embodiment, the brake actuator 51 is an example of an "actuator" related to the running of the vehicle, and the brake control unit 52 is an example of an "actuator control unit." The brake actuator 51 and the brake control unit 52 are also examples of an "on-vehicle device."

[0014] The drive unit 40 includes a motor generator 41 that functions as a power source for the vehicle 10, and a drive control unit 42 that controls the motor generator 41. The vehicle 10 travels by transmitting the driving force of the motor generator 41 to the wheels 20. Therefore, the motor generator 41 is an example of an "actuator" involved in the traveling of the vehicle, and the drive control unit 42 is an example of an "actuator control unit." Furthermore, the motor generator 41 and the drive control unit 42 are also examples of "on-board equipment."

[0015] Steering device 60 comprises steering actuator 61 that adjusts the steering angle of wheel 20, and steering control section 62 that controls steering actuator 61. When the steering angle of wheel 20 is adjusted by the output of steering actuator 61, vehicle 10 turns. Therefore, steering actuator 61 is an example of an "actuator" related to the running of the vehicle, and steering control section 62 is an example of an "actuator control section." Furthermore, steering actuator 61 and steering control section 62 are also examples of "on-vehicle equipment."

[0016] The notification device 70 notifies the occupants of the vehicle 10 of information output by the driving control device 100. As will be described in detail later, the driving control device 100 has a function of determining whether or not an abnormality has occurred in an on-board device. Therefore, when the driving control device 100 determines that an abnormality has occurred in one of the multiple on-board devices, the notification device 70 notifies the occupants of information related to the on-board device in which the abnormality has occurred. The notification device 70 may have a display screen, or may have a device for outputting sound such as a speaker or a buzzer.

[0017] <Vehicle detection system> The vehicle 10 is equipped with a detection system that detects the state of the vehicle 10 that changes while the vehicle 10 is traveling. Such a detection system is an example of an "on-vehicle device."

[0018] The detection system includes multiple sensors that detect vehicle conditions that may change while the vehicle 10 is traveling. For example, the detection system includes a wheel speed sensor SE1, a longitudinal acceleration sensor SE2, a yaw rate sensor SE3, an accelerator operation amount sensor SE4, a brake operation amount sensor SE5, and a steering angle sensor SE6. The wheel speed sensor SE1 detects the rotational speed of the wheels 20 as a wheel speed Vw. The longitudinal acceleration sensor SE2 detects the longitudinal acceleration Gs of the vehicle 10. The yaw rate sensor SE3 detects the yaw rate Yr of the vehicle 10. The accelerator operation amount sensor SE4 detects the accelerator operation amount AC, which is the amount of operation of the accelerator pedal 15 by the driver. The brake operation amount sensor SE5 detects the brake operation amount BP, which is the amount of operation of the brake pedal 16 by the driver. The steering angle sensor SE6 detects the steering angle Str of the steering wheel 17 by the driver. The various sensors SE1 to SE6 output signals according to their detection results to the cruise control device 100.

[0019] The detection system includes an exterior monitoring system 80. The exterior monitoring system 80 monitors the situation outside the vehicle 10. For example, the exterior monitoring system 80 includes an imaging device 81, a radar 82, and a GPS receiver 83. The imaging device 81 captures images of the outside of the vehicle 10. The radar 82 detects the distance between the vehicle 10 and other vehicles, the distance from the vehicle 10 to an obstacle, the distance from the vehicle 10 to a pedestrian, and the like. The GPS receiver 83 acquires the position of the vehicle 10.

[0020] The state of the vehicle 10 can be detected based on the information acquired by the exterior monitoring system 80. For example, consider a case where a stationary structure, such as a traffic light or a traffic sign, is captured in an image captured by the imaging device 81. In this case, by analyzing the images captured at predetermined time intervals, changes in the positional relationship between the vehicle 10 and the structure can be detected over time. Based on such time-series changes in the positional relationship between the vehicle 10 and the structure, the traveling speed, acceleration, yaw rate, etc. of the vehicle 10 can be detected as the state of the vehicle 10. Furthermore, for example, based on the temporal changes in the position of the vehicle 10 received by the GPS receiver 83, the traveling speed, acceleration, yaw rate, etc. of the vehicle 10 can be detected as the state of the vehicle 10.

[0021] <Vehicle control configuration> The vehicle 10 is equipped with a driving assistance device 200 in addition to the cruise control device 100 . (A1) Driving assistance device 200 The driving support device 200 includes a CPU and a memory. The memory stores a control program executed by the CPU.

[0022] The CPU executes the control program, causing the driving assistance device 200 to function as multiple types of application request units. The application request units are functional units for realizing driving assistance functions that assist the driver in driving the vehicle 10. The application request units output request values ​​for realizing the driving assistance functions to the driving control device 100.

[0023] In this embodiment, the driving assistance function is a driving assistance function that adjusts the longitudinal acceleration of the vehicle 10. Examples of such driving assistance functions include adaptive cruise control, lane keep assist, and automated driving.

[0024] For example, when the application request unit requests acceleration or deceleration of the vehicle 10, the request value output by the application request unit is a request value related to the longitudinal acceleration of the vehicle 10. The request value related to the longitudinal acceleration is, for example, a request value for longitudinal acceleration or a request value for longitudinal force of the vehicle 10. The longitudinal force is a force that adjusts the acceleration or deceleration of the vehicle 10. For example, when the vehicle 10 is to be accelerated, the longitudinal force is a positive value. On the other hand, when the vehicle 10 is to be decelerated, the longitudinal force is a negative value.

[0025] When the application request unit requests the vehicle 10 to turn, the request value output by the application request unit is a request value related to the yaw rate of the vehicle 10. The request value related to the yaw rate is, for example, a request value for the yaw rate or a request value for the lateral acceleration.

[0026] (A2) Driving control device 100 The driving control device 100 includes a processing circuit 110. The processing circuit 110 has a CPU 111 and a memory 112. The memory 112 stores a plurality of control programs to be executed by the CPU 111. In other words, the CPU 111 corresponds to an "execution device" that executes the control programs.

[0027] 2, when the CPU 111 executes the control program, the cruise control device 100 functions as a command unit M10, a state quantity acquisition unit M20, an event memory unit M30, an event acquisition unit M40, and an abnormality determination unit M50. The cruise control device 100 also functions as an update unit M60.

[0028] The command unit M10 generates command values ​​Fq for the actuators 41, 51, and 61 based on a request from the driving assistance device 200, i.e., a request from the application request unit. Then, the command unit M10 outputs the command values ​​Fq to the control units 42, 52, and 62 of the actuators, thereby causing the vehicle 10 to travel.

[0029] When the application request unit requests deceleration of the vehicle 10, the command unit M10 generates a braking force command value Fbq as the command value Fq and outputs the command value Fbq to the braking control unit 52. In this case, the braking control unit 52 operates the braking actuator 51 based on the command value Fbq. As a result, the vehicle 10 decelerates in accordance with the deceleration request from the application request unit.

[0030] When the application request unit requests acceleration of the vehicle 10, the command unit M10 generates a driving force command value Fdq as the command value Fq and outputs the command value Fdq to the drive control unit 42. In this case, the drive control unit 42 operates the motor generator 41 based on the command value Fdq. As a result, the vehicle 10 accelerates in accordance with the acceleration request from the application request unit.

[0031] When a turning request for vehicle 10 is received from the application request unit, command unit M10 generates a yaw rate command value Fyq as a command value Fq, and outputs command value Fyq to steering control unit 62. In this case, steering control unit 62 operates steering actuator 61 based on command value Fyq. As a result, vehicle 10 turns in accordance with the turning request from the application request unit.

[0032] As will be described in detail later, the abnormality determination unit M50 determines whether or not an abnormality has occurred in the vehicle-mounted device. The command unit M10 reflects the result of the determination by the abnormality determination unit M50 in the command value Fq.

[0033] When the control units 42, 52, 62 operate the actuators 41, 51, 61 in accordance with the command value Fq from the command unit M10 in this manner, the control units 42, 52, 62 output to the cruise control device 100 the operation amount of the actuators 41, 51, 61 or a parameter correlated with the operation amount.

[0034] The state quantity acquisition unit M20 acquires a vehicle state quantity when the vehicle 10 is traveling in accordance with the command value Fq generated by the command unit M10. The vehicle state quantity is a value that indicates the state of the vehicle 10 while traveling. The vehicle state quantity is, for example, the yaw rate, traveling speed, longitudinal acceleration, and lateral acceleration of the vehicle 10.

[0035] The state quantity acquisition section M20 includes an ideal value acquisition section M21, a detected value acquisition section M22, and an operating value acquisition section M23. The ideal value acquisition unit M21 acquires a vehicle state quantity ideal value PSW, which is a vehicle state quantity when the actuators 41, 51, and 61 operate normally in accordance with the command value Fq. Normal operation of the actuators refers to operation of the actuators as expected in design. For example, if the vehicle state quantity is a yaw rate, the ideal value acquisition unit M21 acquires, as the vehicle state quantity ideal value PSW, an estimated value of the yaw rate when it is assumed that the actuators 41, 51, and 61 operate normally. Such an estimated value of the yaw rate can be derived based on specifications of the vehicle 10, such as the stability factor, the weight of the vehicle 10, and the wheelbase length.

[0036] The detection value acquisition unit M22 acquires vehicle state quantity detection values, which are vehicle state quantities based on the detection results of the detection system. In this embodiment, the detection value acquisition unit M22 acquires a first vehicle state quantity detection value PSS1 and a second vehicle state quantity detection value PSS2 as the vehicle state quantity detection values. The first vehicle state quantity detection value PSS1 is a detection value of the on-board sensors SE1 to SE6 of the detection system, or a vehicle state quantity calculated from the detection value. An example of the vehicle state quantity calculated from the detection value is the traveling speed Vs of the vehicle 10. The traveling speed Vs is calculated based on at least one wheel speed Vw of the plurality of wheels 20.

[0037] The second vehicle state quantity detection value PSS2 is a vehicle state quantity derived based on information obtained by the vehicle exterior monitoring system 80, which is one of the detection systems. For example, the detection value acquisition unit M22 acquires, as the second vehicle state quantity detection value PSS2, a vehicle state quantity derived by analyzing images captured by the imaging device 81 at predetermined time intervals or by acquiring temporal changes in the position of the vehicle 10 received by the GPS receiver 83.

[0038] The operation value acquisition unit M23 acquires a vehicle state quantity operation value PSD, which is a vehicle state quantity corresponding to the operation amount of the actuators 41, 51, 61 that are operated based on a command from the command unit M10. In this embodiment, when the actuators 41, 51, 61 are operated based on a command from the command unit M10, the control units 42, 52, 62 of the actuators output the actual operation amount of the actuators 41, 51, 61 or a parameter correlated with the actual operation amount to the cruise control device 100. Therefore, the cruise control device 100 can acquire the actual operation amount of the actuators 41, 51, 61. Therefore, the operation value acquisition unit M23 derives the vehicle state quantity based on the actual operation amount of the actuators 41, 51, 61 as the vehicle state quantity operation value PSD. For example, when the motor generator 41 is driven, the operation value acquisition unit M23 acquires the longitudinal acceleration of the vehicle 10 derived based on the actual operation amount of the motor generator 41 as the vehicle state quantity operation value PSD. The actual operation amount of the motor generator 41 is, for example, the amount of rotation of the rotor of the motor generator 41.

[0039] The event storage unit M30 stores a plurality of events that may occur when any of the vehicle-mounted devices is not functioning normally. The contents stored in the event storage unit M30 will be described later. The event acquisition unit M40 compares the vehicle state quantities acquired by the state quantity acquisition unit M20. Then, the event acquisition unit M40 acquires an event according to the result of the comparison from the events stored in the event memory unit M30. The method of acquiring the event will be described later.

[0040] The abnormality determination unit M50 determines whether or not an abnormality has occurred in the on-board device based on the event acquired by the event acquisition unit M40. In this embodiment, when making this determination, the abnormality determination unit M50 uses a Bayesian network 500 in which nodes represent the occurrence probabilities of the events acquired by the event acquisition unit M40. The Bayesian network 500 receives the events acquired by the event acquisition unit M40 as input, and outputs an abnormality occurrence probability XA, which is the probability that an abnormality has occurred in the on-board device. The abnormality determination unit M50 then determines whether or not an abnormality has occurred in the on-board device based on the abnormality occurrence probability XA output from the Bayesian network 500.

[0041] If the abnormality determination unit M50 determines that an abnormality has occurred in the vehicle-mounted device, it causes the notification device 70 to notify the occupants of the vehicle 10 that an abnormality has occurred in the vehicle-mounted device. The update unit M60 performs Bayesian updating of the Bayesian network 500 based on the age of the vehicle 10 or information correlated with the age of the vehicle 10. The update unit M60 also performs Bayesian updating of the Bayesian network 500 in response to changes in the temperature of the on-board device. Furthermore, the update unit M60 performs Bayesian updating of the Bayesian network 500 when the on-board device is replaced or repaired.

[0042] <Multiple Events> A plurality of events stored in the event memory unit M30 will be described with reference to Fig. 3. Examples of events mentioned here include the following: The sensor detection value is different from the expected value. The actuator movement amount is different from the expected movement amount. Even if the images captured by the imaging device 81 of the vehicle exterior monitoring system 80 are analyzed, other vehicles, obstacles, and pedestrians around the vehicle 10 cannot be accurately identified.

[0043] 3 shows seven events WA, WB, WC, WD, WE, WF, and WG. For example, the seven events WA to WG are events that can occur when an abnormality occurs in the on-board device related to the operation of steering actuator 61 based on a command from command unit M10. In this embodiment, the on-board device related to the operation of steering actuator 61 based on a command from command unit M10 is steering actuator 61 and steering control unit 62.

[0044] First region R1 in Fig. 3 is a region indicating that an abnormality has occurred in steering actuator 61. Therefore, it can be said that the area outside first region R1 is a region indicating that no abnormality has occurred in steering actuator 61. Second region R2 in Fig. 3 is a region indicating that an abnormality has occurred in steering control unit 62. Therefore, it can be said that the area outside second region R2 is a region indicating that no abnormality has occurred in steering control unit 62.

[0045] The first event WA, the second event WB, and the third event WC can occur whether an abnormality occurs in the steering actuator 61 or whether the steering actuator 61 is normal. On the other hand, the first event WA, the second event WB, and the third event WC do not occur when an abnormality occurs in the steering control section 62.

[0046] The fourth event WD can occur when an abnormality occurs in at least one of the steering actuator 61 and the steering control section 62, or when both the steering actuator 61 and the steering control section 62 are normal.

[0047] The fifth event WE and the sixth event WF can occur whether an abnormality occurs in the steering control unit 62 or whether the steering control unit 62 is normal. On the other hand, the fifth event WE and the sixth event WF do not occur when an abnormality occurs in the steering actuator 61.

[0048] The seventh event WG can occur when an abnormality occurs in at least one of the multiple on-board devices. On the other hand, the seventh event WG does not occur when none of the multiple on-board devices are normal. <Method of acquiring events> The method for acquiring events will be described with reference to FIG.

[0049] The event acquisition unit M40 acquires an event from the plurality of events WA to WG, ... stored in the event memory unit M30. At this time, the event acquisition unit M40 executes a preliminary determination process using two vehicle state quantities among the plurality of vehicle state quantities acquired by the state quantity acquisition unit M20.

[0050] Here, the two vehicle state quantities used in the preliminary determination process are selected according to the on-board device that is to be determined whether or not an abnormality has occurred. For example, when an actuator is to be determined, it is advisable to select either the first vehicle state quantity detection value PSS1 or the second vehicle state quantity detection value PSS2, and the vehicle state quantity operation value PSD derived according to the actual operation amount of the actuator. For example, when the vehicle exterior monitoring system 80 is to be determined, it is advisable to select the first vehicle state quantity detection value PSS1 and the second vehicle state quantity detection value PSS2. For example, when the control unit of the actuator is to be determined, it is advisable to select the vehicle state quantity ideal value PSW and the vehicle state quantity operation value PSD.

[0051] As shown in FIG. 4C, in the preliminary determination process, the event acquirer M40 derives the difference between the two vehicle state quantities selected as described above, i.e., the difference ΔPS between the first vehicle state quantity and the second vehicle state quantity. If the difference ΔPS is equal to or greater than the first difference determination value ΔPSth1, the event acquirer M40 determines that an abnormality may have occurred in the vehicle-mounted device being determined. Specifically, if the duration of the state in which the difference ΔPS is equal to or greater than the first difference determination value ΔPSth1 exceeds the first determination time TMth1, the event acquirer M40 determines that an abnormality may have occurred in the vehicle-mounted device being determined. If it is determined that an abnormality may have occurred in the vehicle-mounted device in this way, the event acquirer M40 sets the abnormality flag FLG1 to ON, as shown in FIG. 4A. Note that if the difference ΔPS becomes less than the first difference determination value ΔPSth1, the event acquirer M40 sets the abnormality flag FLG1 to OFF.

[0052] In the preliminary determination process, when the difference ΔPS is less than a first difference determination value ΔPSth1, the event acquirer M40 determines whether the difference ΔPS is equal to or greater than a second difference determination value ΔPSth2. A value smaller than the first difference determination value ΔPSth1 is set as the second difference determination value ΔPSth2. When the difference ΔPS is less than the first difference determination value ΔPSth1 and equal to or greater than the second difference determination value ΔPSth2, the event acquirer M40 determines that the in-vehicle device being determined may be malfunctioning. Specifically, when the duration of the state in which the difference ΔPS is less than the first difference determination value ΔPSth1 and equal to or greater than the second difference determination value ΔPSth2 exceeds a second determination time TMth2, the event acquirer M40 determines that the in-vehicle device being determined may be malfunctioning. The second determination time TMth2 may or may not be the same as the first determination time TMth1. If it is determined that the vehicle-mounted device may be malfunctioning, the event acquisition unit M40 sets the malfunction flag FLG2 to ON, as shown in FIG. 4(B).

[0053] If the malfunction flag FLG2 is set to ON and the difference ΔPS becomes less than the second difference determination value ΔPSth2, the event acquiring unit M40 sets the malfunction flag FLG2 to OFF. Also, if the condition for setting the abnormality flag FLG1 to ON is met while the malfunction flag FLG2 is set to ON, the event acquiring unit M40 sets the malfunction flag FLG2 to OFF and sets the abnormality flag FLG1 to ON.

[0054] The event acquisition unit M40 executes an event selection process to acquire an event corresponding to the result of the preliminary determination process from among the multiple events WA to WG, .... For example, if the in-vehicle device to be determined is the steering actuator 61 and the abnormality flag FLG1 is set to ON, the event acquisition unit M40 acquires the first event WA in the event selection process. Also, for example, if the in-vehicle device to be determined is the steering actuator 61 and the malfunction flag FLG2 is set to ON, the event acquisition unit M40 acquires an event other than the first event WA, for example, the third event WC in the event selection process. Note that the number of events acquired by the event acquisition unit M40 in the event selection process is not limited to one. That is, depending on the result of the determination, the event acquisition unit M40 may acquire two or more events from the multiple events WA to WG, ....

[0055] <Bayesian Network> In the Bayesian network 500, the probabilities of occurrence of a plurality of events WA to WG, ... are used as nodes, and the relationships among the probabilities are used as links. The probabilities of occurrence of a plurality of events WA to WG, ... and the relationships among the probabilities are set in advance.

[0056] Fig. 5 is a diagram showing the probability that the first event WA will occur and the probability that the second event WB will occur. As shown in Fig. 5, in a situation where an abnormality has occurred in the steering actuator 61, the probability that the first event WA will occur is AA1 (%), while the probability that the first event WA will not occur is AA2 (%). On the other hand, in a situation where the steering actuator 61 is normal, the probability that the first event WA will occur is AN1 (%), while the probability that the first event WA will not occur is AN2 (%).

[0057] Similarly, in a situation where an abnormality has occurred in steering actuator 61, the probability that second event WB will occur is BA1 (%), while the probability that second event WB will not occur is BA2 (%). On the other hand, in a situation where steering actuator 61 is normal, the probability that second event WB will occur is BN1 (%), while the probability that second event WB will not occur is BN2 (%).

[0058] Here, an abnormality occurrence probability XA of steering actuator 61, which is output from Bayesian network 500 when first event WA and second event WB are acquired, will be described. The probability X1 of occurrence of the first event WA is calculated by the following relational expression (Equation 1). In relational expression (Equation 1), "Z1" is the probability that an abnormality will occur in the steering actuator 61, and "Z2" is the probability that an abnormality will not occur in the steering actuator 61. Z2 is the value obtained by subtracting Z1 from 100(%).

[0059]

number

[0060]

number

[0061]

number

[0062]

number

[0063]

number

[0064] <Bayesian updating of Bayesian networks> (B1) Bayesian update according to vehicle age. As the vehicle 10 continues to be used for a long time, the characteristics of the on-board device change over time. In the case of an actuator, the characteristics of the actuator change due to wear or a decrease in the durability of the actuator components. In the case of a control unit and a sensor, oxidation of parts can cause the control unit to generate heat more easily or the detection accuracy of the sensor to change.

[0065] Therefore, the update unit M60 performs a Bayesian update of the Bayesian network 500 according to the number of years of use of the vehicle 10. Specifically, the update unit M60 increases the probability of occurrence of events WA to WG, ... when an abnormality occurs in the on-board device so that the longer the number of years of use, the higher the probability XA of an abnormality occurring in the on-board device output from the Bayesian network 500. For example, in the case of the first event WA, the update unit M60 increases AA1 (%), which is the probability that the first event WA will occur, in a situation where an abnormality occurs in the steering actuator 61.

[0066] (B2) Bayesian update according to the temperature of the on-board device. Some on-board devices have a tendency for abnormalities to occur depending on the temperature. For example, if the temperature of the on-board device remains high for a long period of time, the on-board device is more likely to break down. Therefore, the update unit M60 performs Bayesian updating of the Bayesian network 500 in response to changes in the temperature of the on-board device. Specifically, when the temperature of the on-board device is within a temperature range in which the on-board device is prone to abnormalities, the update unit M60 adjusts the probability of occurrence of events WA to WG, ... when an abnormality occurs in the on-board device so that the abnormality occurrence probability XA of the on-board device output from the Bayesian network 500 is higher when the temperature of the on-board device is within a temperature range in which the on-board device is prone to abnormalities compared to when the temperature is not within that range.

[0067] (B3) Bayesian update when the on-board unit is replaced or repaired. If an abnormality such as a breakdown occurs in the on-board device, the on-board device is replaced or repaired. In other words, it can be assumed that an abnormality has occurred in the on-board device at the time the on-board device is replaced or repaired. Therefore, when the update unit M60 detects that the on-board device has been replaced or repaired, it adjusts the probability of occurrence of events WA to WG, ... when an abnormality has occurred in the on-board device so that the abnormality occurrence probability XA of the on-board device output from the Bayesian network 500 becomes higher.

[0068] <Processing flow when determining that an abnormality has occurred in the on-board device> 6, a processing routine executed by the processing circuit 110 of the driving control device 100 when determining whether or not an abnormality has occurred in the on-board device will be described. The processing circuit 110 executes this processing routine by having the CPU 111 execute a vehicle control program, which is one of the control programs stored in the memory 112 of the processing circuit 110. Therefore, it can be said that the CPU 111, which is an execution device, executes each step constituting this processing routine.

[0069] When the vehicle 10 travels due to the operation of the actuators 41, 51, and 61 based on commands from the travel control device 100, the processing circuit 110 repeatedly executes this processing routine for each predetermined control cycle.

[0070] In this processing routine, in step S11, the processing circuit 110 functions as the state quantity acquisition unit M20 to acquire the vehicle state quantity ideal value PSW, the first vehicle state quantity detected value PSS1, the second vehicle state quantity detected value PSS2, and the vehicle state quantity operation value PSD. In this embodiment, the processing of step S11 executed by the processing circuit 110 when functioning as the state quantity acquisition unit M20 corresponds to the "state quantity acquisition processing."

[0071] Next, in step S13, the processing circuit 110 functions as the event acquisition unit M40 to acquire an event from among a plurality of events WA to WG, ... that may occur when any of the on-board devices is not normal. In this embodiment, the processing of step S13 executed by the processing circuit 110 when functioning as the state quantity acquisition unit M20 corresponds to "event acquisition processing."

[0072] The process of step S13 includes the preliminary determination process of step S131 and the event selection process of step S133. In the preliminary determination process (S131), the processing circuit 110 compares the first vehicle state quantity and the second vehicle state quantity among the multiple vehicle state quantities acquired in step S11 to determine whether or not there is a possibility that an abnormality has occurred in the vehicle-mounted device to be determined. Also, the processing circuit 110 compares the first vehicle state quantity and the second vehicle state quantity to determine whether or not there is a possibility that the vehicle-mounted device to be determined is malfunctioning.

[0073] Then, in the event selection process (S133), the processing circuit 110 selects an event according to the result of the preliminary judgment process (S131) ​​from among the multiple events WA to WG, .... Note that if the preliminary judgment process results in both the abnormality flag FLG1 and the malfunction flag FLG2 being set to OFF, the processing circuit 110 does not select any events.

[0074] The event acquisition process will be described below when three vehicle state quantities are acquired in step S11. In this case, in the preliminary determination process (S131), the processing circuit 110 derives a first difference ΔPS1, which is the difference between the first vehicle state quantity and the second vehicle state quantity, among the three vehicle state quantities. The processing circuit 110 derives a second difference ΔPS2, which is the difference between the first vehicle state quantity and the third vehicle state quantity, among the three vehicle state quantities. The processing circuit 110 derives a third difference ΔPS3, which is the difference between the second vehicle state quantity and the third vehicle state quantity.

[0075] Next, in the event selection process (S133), if the processing circuit 110 sets the abnormality flag FLG1 or the malfunction flag FLG2 to ON because the first difference ΔPS1 is large as a result of comparing the first vehicle state quantity with the second vehicle state quantity, the processing circuit 110 selects an event corresponding to the first difference ΔPS1 from among the multiple events WA-WG, .... If the processing circuit 110 sets the abnormality flag FLG1 or the malfunction flag FLG2 to ON because the second difference ΔPS2 is large as a result of comparing the first vehicle state quantity with the third vehicle state quantity, the processing circuit 110 selects an event corresponding to the second difference ΔPS2 from among the multiple events WA-WG, .... If the processing circuit 110 sets the abnormality flag FLG1 or the malfunction flag FLG2 to ON because the third difference ΔPS3 is large as a result of comparing the second vehicle state quantity with the third vehicle state quantity, the processing circuit 110 selects an event corresponding to the third difference ΔPS3 from among the multiple events WA-WG, ....

[0076] In this embodiment, the event selected by the processing circuit 110 changes depending on whether the abnormality flag FLG1 is set to ON or the malfunction flag FLG2 is set to ON. The event selected when the abnormality flag FLG1 is set to ON is referred to as an abnormality-selected event, and the event selected when the malfunction flag FLG2 is set to ON is referred to as a malfunction-selected event. In this case, when an abnormality occurs in the in-vehicle device, the probability of the abnormality-selected event occurring is higher than the probability of the malfunction-selected event occurring.

[0077] When the event selected in the event selection process (S133) is acquired, the processing circuit 110 proceeds to step S15. In step S15, the processing circuit 110 functions as the abnormality determination unit M50 to determine whether or not an abnormality has occurred in the vehicle-mounted device to be determined. In this embodiment, the process of step S15 executed by the processing circuit 110 when functioning as the abnormality determination unit M50 corresponds to the "abnormality determination process." In the abnormality determination process, the processing circuit 110 inputs the event acquired in step S13 to the Bayesian network 500 and causes the Bayesian network 500 to output an abnormality occurrence probability XA. Then, if the abnormality occurrence probability XA is equal to or greater than a probability determination value, the processing circuit 110 determines that an abnormality has occurred in the vehicle-mounted device to be determined. On the other hand, if the abnormality occurrence probability XA is less than the probability determination value, the processing circuit 110 determines that no abnormality has occurred in the vehicle-mounted device to be determined. Also, even if no event is acquired in step S13, the processing circuit 110 determines that no abnormality has occurred in the vehicle-mounted device being determined.

[0078] In the next step S17, the processing circuit 110 determines whether or not the abnormality determination process has determined that an abnormality has occurred in the vehicle-mounted device being determined. If the abnormality determination process has determined that an abnormality has occurred in the vehicle-mounted device (S17: YES), the processing circuit 110 proceeds to step S19. On the other hand, if the abnormality determination process has determined that no abnormality has occurred in the vehicle-mounted device (S17: NO), the processing circuit 110 proceeds to step S21.

[0079] In step S19, the processing circuit 110 functions as the abnormality determination unit M50, thereby causing the alarm device 70 to notify the occupants of the vehicle 10 that an abnormality has occurred in the vehicle-mounted device being determined. Then, the processing circuit 110 transitions the process to step S21.

[0080] In step S21, the processing circuit 110 determines whether the preliminary determination process (S131) ​​has determined that the vehicle-mounted device to be determined may be malfunctioning. If the preliminary determination process has determined that the vehicle-mounted device may be malfunctioning (S21: YES), the processing circuit 110 proceeds to step S23. On the other hand, if the preliminary determination process has not determined that the vehicle-mounted device may be malfunctioning (S21: NO), the processing circuit 110 proceeds to step S25.

[0081] In step S23, the processing circuit 110 executes the second command process by functioning as the command unit M10. In the second command process, the processing circuit 110 generates a command value Fq. At this time, the processing circuit 110 generates the command value Fq based on a request from the driving support device 200 and the detection values ​​of the multiple sensors SE1 to SE6. Next, the processing circuit 110 corrects the command value Fq in a direction that increases the difference ΔPS. Then, the processing circuit 110 outputs the corrected command value Fq to the control units 42, 52, and 62 of the actuators 41, 51, and 61. After that, the processing circuit 110 temporarily ends this processing routine.

[0082] Referring to FIG. 7, a method for correcting the command value Fq when it is determined that the on-board device may be malfunctioning will be described in detail. As shown in FIG. 7A, the processing circuit 110 corrects the command value Fq when the elapsed time from when the malfunction flag FLG2 was turned on reaches a specified time TMa. As shown in FIG. 7B, the processing circuit 110 derives a correction amount CF for the command value Fq. In this case, the processing circuit 110 increases the absolute value of the correction amount CF in a direction that increases the difference ΔPS, and then changes the absolute value of the correction amount CF in a direction that decreases the difference ΔPS. As a result, the processing circuit 110 can correct the command value Fq as shown by the solid line in FIG. 7C. Note that the dashed line in FIG. 7C indicates the transition of the command value Fq before correction.

[0083] On the other hand, if the duration of the state in which the malfunction flag FLG2 is on is less than the specified time TMa, the processing circuit 110 does not correct the command value Fq. In this case, even if the malfunction flag FLG2 is set to on, the correction amount CF remains 0 (zero).

[0084] Returning to FIG. 6, in step S25, the processing circuit 110 executes the first command processing by functioning as the command unit M10. In the first command processing, the processing circuit 110 generates a command value Fq based on a request from the driving assistance device 200 and the detection values ​​of the multiple sensors SE1 to SE6. Then, the processing circuit 110 outputs the command value Fq to the control units 42, 52, and 62 of the actuators 41, 51, and 61. In this embodiment, the processing of step S25 also corresponds to the "command processing." After that, the processing circuit 110 temporarily ends this processing routine.

[0085] <Actions and Effects of the Present Embodiment> When the vehicle 10 is traveling by operating the actuators 41, 51, and 61 in response to a command from the cruise control device 100, the vehicle state quantity ideal value PSW, the vehicle state quantity detected values ​​PSS1 and PSS2, and the vehicle state quantity operation value PSD are acquired. Then, a comparison is made between the acquired vehicle state quantities. An event corresponding to the result of this comparison is acquired from the events WA to WG, .... Then, by using a Bayesian network 500 in which the occurrence probability of the acquired event is used as a node, it is determined whether or not an abnormality has occurred in the vehicle-mounted device to be determined. Specifically, when the acquired event is input to the Bayesian network 500, an abnormality occurrence probability XA of the vehicle-mounted device to be determined is output from the Bayesian network 500. Based on this abnormality occurrence probability XA, it is possible to determine whether or not an abnormality has occurred in the vehicle-mounted device.

[0086] In this embodiment, it is not necessary to prepare multiple control devices that perform the same determination process in order to determine whether an abnormality has occurred in the on-board device, so it is possible to determine whether an abnormality has occurred in the on-board device while suppressing an increase in system costs.

[0087] In this embodiment, the following effects can be further obtained. (1) In this embodiment, if the preliminary determination process determines that the on-board device may be malfunctioning, the command value Fq is corrected in a direction that increases the difference ΔPS. Then, the control unit operates the actuator based on the corrected command value Fq. If the difference ΔPS increases as a result of correcting the command value Fq, there is a high possibility that the abnormality flag FLG1 will be set to ON when the preliminary determination process is subsequently executed again. If the abnormality flag FLG1 is set to ON, the event acquired from the multiple events WA to WG, ... is changed. As a result, the abnormality occurrence probability XA of the on-board device output from the Bayesian network 500 increases. Therefore, it is possible to determine early that an abnormality has occurred in the on-board device.

[0088] Furthermore, if the command value Fq is corrected as described above when it is determined that the on-board device may be malfunctioning, it is possible to monitor changes in the behavior of the vehicle 10 resulting from the correction of the command value Fq. This makes it possible to determine whether or not the on-board device can be used even if it is malfunctioning.

[0089] (2) In this embodiment, Bayesian updating of the Bayesian network 500 is performed according to the age of the vehicle 10. As a result, the abnormality determination process can be performed taking into account changes in the characteristics of the on-board device over time. Therefore, it is possible to suppress a decrease in the determination accuracy of the abnormality determination process that occurs as the age of the vehicle 10 increases.

[0090] (3) In this embodiment, the Bayesian network 500 is updated in response to changes in the temperature of the vehicle-mounted device. As a result, it is possible to suppress a decrease in the accuracy of the abnormality determination process caused by changes in the temperature of the vehicle-mounted device.

[0091] (4) In this embodiment, when it is detected that an on-board device has been replaced or repaired, the Bayesian network 500 is updated so that the abnormality occurrence probability XA of the replaced or repaired on-board device increases. Therefore, the accuracy of the abnormality determination process can be improved by using the updated Bayesian network 500.

[0092] (Example of change) The above embodiment can be modified as follows: The above embodiment and the following modifications can be combined with each other within the scope of technical compatibility.

[0093] Even if the vehicle-mounted device is replaced or repaired, the Bayesian update of the Bayesian network 500 does not need to be performed. It is not necessary to perform Bayesian updating of the Bayesian network 500 according to the age of the vehicle 10.

[0094] It is not necessary to perform Bayesian updating of the Bayesian network 500 in response to temperature changes in the vehicle-mounted device. If the vehicle 10 can communicate with a server installed outside the vehicle, the function of the update unit M60 may be provided to the server. In this case, Bayesian updating of the Bayesian network 500 can be performed through communication between the server and the vehicle 10. With this configuration, the function of the update unit M60 can be omitted, thereby reducing the load on the driving control device 100.

[0095] If the preliminary determination process determines that the on-board device may be malfunctioning, the command value Fq does not need to be corrected. In this case, even if it is determined that the on-board device may be malfunctioning, the first command process is executed instead of the second command process.

[0096] In this way, if the second command process is not executed even when it is determined that the on-board device may be malfunctioning, the preliminary determination process does not need to determine whether the on-board device may be malfunctioning. In this case, only one of the first difference determination value ΔPSth1 and the second difference determination value ΔPSth2 may be used as the determination value in the preliminary determination process.

[0097] The events to be acquired do not necessarily have to be different depending on whether the malfunction flag FLG2 is set to ON or the abnormality flag FLG1 is set to ON. For example, a case where the first event WA is acquired will be described. In this case, when the abnormality flag FLG1 is set to ON, the probability AA1 that the first event WA will occur under a situation where an abnormality has occurred in the steering actuator 61 may be increased, while the probability AA2 that the first event WA will not occur may be decreased, compared to when the malfunction flag FLG2 is set to ON. Furthermore, when the abnormality flag FLG1 is set to ON, the probability AN1 that the first event WA will occur under a situation where the steering actuator 61 is normal may be decreased, compared to when the malfunction flag FLG2 is set to ON.

[0098] In the above embodiment, the actuators 41, 51, 61, the control units 42, 52, 62, the sensors SE1 to SE6, and the vehicle exterior monitoring system 80 are all in-vehicle devices that are targets of the abnormality determination process, but this is not limited to this. For example, if the actuators 41, 51, 61 are the targets of the determination, at least one of the control units 42, 52, 62, the sensors SE1 to SE6, and the vehicle exterior monitoring system 80 may not be the targets of the determination. Also, for example, if the control units 42, 52, 62 are the targets of the determination, at least one of the actuators 41, 51, 61, the sensors SE1 to SE6, and the vehicle exterior monitoring system 80 may not be the targets of the determination. Also, for example, if the sensors SE1 to SE6 are the targets of the determination, at least one of the actuators 41, 51, 61, the control units 42, 52, 62, and the vehicle exterior monitoring system 80 may not be the targets of the determination. Furthermore, for example, if the vehicle exterior monitoring system 80 is to be determined, at least one of the actuators 41, 51, 61, the control units 42, 52, 62, and the sensors SE1 to SE6 may not be the target of determination.

[0099] In the above embodiment, the state quantity acquisition unit M20 acquires all of the vehicle state quantity ideal value PSW, the vehicle state quantity detected values ​​PSS1 and PSS2, and the vehicle state quantity operation value PSD, but this is not limited to this. If the state quantity acquisition unit M20 acquires two or more vehicle state quantities, it is not necessary to acquire some of the vehicle state quantity ideal value PSW, the vehicle state quantity detected values ​​PSS1 and PSS2, and the vehicle state quantity operation value PSD.

[0100] If the abnormality determination process determines that an abnormality has occurred in the on-board device, information about the on-board device that has been determined to have an abnormality may be transmitted to a server outside the vehicle. The information about the on-board device includes information that can identify the on-board device, such as the type of on-board device.

[0101] The driving control device 100 is not limited to a device that includes a CPU and a ROM and executes software processing. In other words, the driving control device 100 may have any one of the following configurations (a) to (c). (a) Having one or more processors that execute various processes according to a computer program. The processor includes a CPU and memory such as RAM and ROM. The memory stores program code or instructions configured to cause the CPU to execute processes. Memory, i.e., computer-readable media, includes any available medium that can be accessed by a general-purpose or special-purpose computer. (b) It is equipped with one or more dedicated hardware circuits that perform various processes. Examples of dedicated hardware circuits include application-specific integrated circuits, i.e., ASIC or FPGA. ASIC is an abbreviation for "Application Specific Integrated Circuit." FPGA is an abbreviation for "Field Programmable Gate Array." (c) Equipped with a processor that executes part of the various processes in accordance with a computer program and dedicated hardware circuits that execute the remaining processes of the various processes.

[0102] The vehicle 10 may be a hybrid vehicle that has an engine in addition to the motor generator 41 as a power source, or may be a vehicle that has only an engine as a power source. (technical thought) Next, the technical ideas that can be understood from the above-described embodiment and modified examples will be described.

[0103] (A) A vehicle control method for a vehicle including an on-board device that includes an actuator related to vehicle driving, a control unit for the actuator, and a detection system that detects a state of the vehicle that changes due to the operation of the actuator, a command process for generating a command value for the actuator based on a request from an application request unit related to a driving assistance function, and outputting the command value to the control unit to cause the vehicle to travel; a state quantity acquisition process for acquiring at least two vehicle state quantities from a vehicle state quantity ideal value, which is a vehicle state quantity when the actuator normally operates in accordance with the command value, a vehicle state quantity detection value, which is a vehicle state quantity based on a detection result of the detection system, and a vehicle state quantity operation value, which is a vehicle state quantity corresponding to an operation amount of the actuator; an event acquisition process for comparing the vehicle state quantities acquired in the state quantity acquisition process and acquiring an event corresponding to a result of the comparison from among a plurality of events that may occur when any of the on-board devices is not normal; an abnormality determination process for determining whether an abnormality has occurred in the vehicle-mounted device by using a Bayesian network in which the occurrence probability of the event acquired in the event acquisition process is used as a node. [Explanation of symbols]

[0104] 10...Vehicle 41...Motor generator (an example of an actuator) 51...Braking actuator (an example of an actuator) 61...Steering actuator (an example of an actuator) 42, 52, 62...Control section 80...External vehicle monitoring system (an example of a detection system) 81...imaging device 82...Radar 83...GPS receiver 100...Travel control device (vehicle control device) 110...Processing circuit 111...CPU (an example of an execution device) 500...Bayesian network M10…Command unit M20: State quantity acquisition section M30: Event memory section M40: Event acquisition section M50...Abnormality determination section M60…Update section SE1 to SE6: Sensors (examples of detection systems)

Claims

1. A vehicle control device applied to a vehicle, the vehicle control device including, as an on-board device, an actuator related to vehicle running, a control unit for the actuator, and a detection system for detecting a state of the vehicle that changes due to an operation of the actuator, a command unit that generates a command value for the actuator based on a request from an application request unit regarding a driving assistance function, and outputs the command value to the control unit to drive the vehicle; a state quantity acquisition unit that acquires at least two vehicle state quantities from a vehicle state quantity ideal value that is a vehicle state quantity when the actuator normally operates in accordance with the command value, a vehicle state quantity detection value that is a vehicle state quantity based on a detection result of the detection system, and a vehicle state quantity operation value that is a vehicle state quantity corresponding to an operation quantity of the actuator; an event storage unit that stores a plurality of events that may occur when any of the vehicle-mounted devices is not normal; an event acquisition unit that compares the plurality of vehicle state quantities acquired by the state quantity acquisition unit and acquires an event corresponding to a result of the comparison from the plurality of events; an abnormality determination unit that determines whether an abnormality has occurred in the on-board device by using a Bayesian network in which the occurrence probability of the event acquired by the event acquisition unit is a node; The event acquisition unit a preliminary determination process is performed to determine that there is a possibility that an abnormality has occurred in the on-board device when a difference between a first vehicle state quantity and a second vehicle state quantity among the plurality of vehicle state quantities acquired by the state quantity acquisition unit is equal to or greater than a first difference determination value, and to determine that there is a possibility that the on-board device is malfunctioning when the difference is less than the first difference determination value and equal to or greater than a second difference determination value that is smaller than the first difference determination value; an event corresponding to a result of the preliminary determination process is acquired from the plurality of events; The command unit corrects the command value in a direction to increase the difference when it is determined in the preliminary determination process that the vehicle-mounted device may be malfunctioning. Vehicle control device.

2. an update unit that performs Bayesian updating of the Bayesian network in response to at least one of the age of the vehicle and a change in temperature of the vehicle-mounted device; The vehicle control device according to claim 1 .

3. An update unit that performs a Bayesian update of the Bayesian network when the on-board device is replaced or repaired. The vehicle control device according to claim 1 .

4. A vehicle control program executed by an execution device of a vehicle including an actuator related to vehicle running as an on-board device, a control unit of the actuator, and a detection system that detects a state of the vehicle that changes due to the operation of the actuator, The execution device, a command process for generating a command value for the actuator based on a request from an application request unit related to a driving assistance function, and outputting the command value to the control unit to cause the vehicle to travel; a state quantity acquisition process for acquiring at least two vehicle state quantities from a vehicle state quantity ideal value, which is a vehicle state quantity when the actuator normally operates in accordance with the command value, a vehicle state quantity detection value, which is a vehicle state quantity based on a detection result of the detection system, and a vehicle state quantity operation value, which is a vehicle state quantity corresponding to an operation amount of the actuator; an event acquisition process for comparing the vehicle state quantities acquired in the state quantity acquisition process and acquiring an event corresponding to a result of the comparison from among a plurality of events that may occur when any of the on-board devices is not normal; an abnormality determination process for determining whether or not an abnormality has occurred in the on-board device by using a Bayesian network in which the occurrence probability of the event acquired in the event acquisition process is used as a node; The event acquisition process includes: a preliminary determination process for determining that there is a possibility that an abnormality has occurred in the on-board device when a difference between a first vehicle state quantity and a second vehicle state quantity among the plurality of vehicle state quantities acquired in the state quantity acquisition process is equal to or greater than a first difference determination value, and for determining that there is a possibility that the on-board device is malfunctioning when the difference is less than the first difference determination value and equal to or greater than a second difference determination value smaller than the first difference determination value; an event selection process for acquiring an event corresponding to a result of the preliminary determination process from the plurality of events; The command processing includes correcting the command value in a direction to increase the difference when it is determined in the preliminary determination processing that the vehicle-mounted device may be malfunctioning. Vehicle control program.

Images