Vehicle control device, inquiry method, program, and vehicle control system

Abstract

Provided is a vehicle control device. The vehicle control device comprises an acceptance determination unit (711, S11), an output unit (711, S103), a period determination unit (713, S13), and a notification unit (713, S105). The notification unit is configured to, if there is the first command having been determined to be unacceptable for at least a predetermined period and the first command is not classified as a preset function related to the safety of a vehicle, inquire with a user whether or not to execute the operation of an application of interest, the application of interest being an application that has output the first command.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This international application claims priority based on Japanese Patent Application No. 2022-123424, filed with the Japan Patent Office on August 2, 2022, the entire contents of which are incorporated herein by reference. [Technical Field]

[0002] The present disclosure relates to a vehicle control device. [Background technology]

[0003] Patent Document 1 below discloses a vehicle arbitration system that includes a main manager and a sub-manager and controls vehicle operation by arbitrating requests from multiple applications. The main manager accepts requests from a first application execution unit and determines a request for the sub-manager. The main manager selects one request from the multiple accepted requests, sets the execution order of the multiple accepted requests, and rejects requests. The sub-manager arbitrates between a request from a second application execution unit and a request determined by the main manager. When conflicting requests are input simultaneously, the sub-manager selects one of the requests based on pre-prepared selection criteria. In the vehicle arbitration system, when a new function is added to the vehicle, functionality can be easily expanded by adding an application that realizes the new function and a first application execution unit that executes the application to the main manager. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2020-64489 Summary of the Invention

[0005] However, as a result of detailed investigation by the inventors, it was found that the vehicle arbitration system described in Patent Document 1 has a problem in that the application desired by the user may always lose arbitration in the main manager or sub-manager and not be executed. However, if priority is simply given to executing the application desired by the user, it may not be possible to maintain the safety of the vehicle.

[0006] One aspect of the present disclosure provides a vehicle control device that can prioritize execution of an application desired by a user while maintaining the safety of the vehicle.

[0007] One aspect of the present disclosure is a vehicle control device mounted on a vehicle and configured to control the vehicle, the vehicle control device including an acceptance determination unit, an output unit, a period determination unit, and a notification unit. The acceptance determination unit is configured to determine whether a first command from at least one application is acceptable when the first command is input. The output unit is configured to output a second command based on the first command determined to be acceptable to an operation control unit for controlling a controlled object, for a first command determined to be acceptable. The period determination unit determines whether there is a first command determined to be unacceptable for a predetermined period or longer. If there is a first command that is unacceptable for a predetermined period or longer and the first command is not classified as a function related to the vehicle's safety that has been preset, the notification unit asks the user whether or not to execute the operation of a target app. The application that outputs the first command is referred to as the target app.

[0008] With this configuration, it is possible to maintain the safety of the vehicle while giving priority to executing an application desired by the user. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram showing a configuration of a vehicle control system. [Figure 2] 3 is a ladder chart showing basic operations executed in a vehicle control system in an embodiment. [Figure 3]FIG. 10 is a conceptual diagram of a priority order table. [Figure 4] 10 is a ladder chart showing basic operations when an application that executes an operation request for a vehicle function related to a non-safety function is added. [Figure 5] 1 is a ladder chart showing basic operations when an application that executes operational requests for vehicle functions related to high-level safety functions is added. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings.

[0011] [1. Embodiment] [1-1. Correspondence between the configuration of the embodiment and the configuration of the present disclosure] In the following embodiments, the ECUA 10 corresponds to the vehicle control device in the present disclosure. The processing of the request arbitration unit 711 in the embodiments corresponds to the functions of the acceptance determination unit, output control unit, and execution priority unit in the present disclosure. The processing of the arbitration priority management unit 712 in the embodiments corresponds to the functions of the table append unit and table change unit in the present disclosure. The processing of the arbitration result management unit 713 in the embodiments corresponds to the functions of the period determination unit and notification unit in the present disclosure.

[0012] [1-2.Configuration] 1 is mounted on a vehicle such as a passenger car, and includes a plurality of ECUs 10, 15, 41 to 49 (hereinafter referred to as a number of ECUs 10, etc.). The vehicle control system 1 may include a center 35 outside the vehicle. The number of ECUs 10, etc. are connected to each other so as to be able to communicate via a network within the vehicle centered around the ECU 10. The center 35 is also connected to each other so as to be able to communicate via the network within the vehicle.

[0013] The center 35 is configured as a server that can provide functions to vehicles. For example, the center 35 can provide functions related to automatic driving and the like to vehicles.

[0014] The numerous ECUs 10 and the center 35 are each configured around a well-known microcomputer having CPUs 11, 16, 36, 41A to 49A (hereinafter referred to as CPUs 11 to 49A) and semiconductor memories 12, 17, 37, 41B to 49B (hereinafter referred to as memories 12 to 49B) such as RAM, ROM, and flash memory. ECU stands for electronic control unit.

[0015] The ECUA 10 among the many ECUs 10 includes a communication unit 13 configured as a communication module such as a well-known transceiver. The ECUA 10 has a relay function that relays communication between other devices (e.g., other ECUs) in the vehicle connected to the ECU 10A using the communication unit 13.

[0016] The ECU 10A communicates with and controls a large number of ECUs 10, etc., thereby achieving coordinated control of the entire vehicle. The large number of ECUs 10, etc. are provided for each domain, which is divided according to the vehicle's functions, and the ECU 10A mainly controls a plurality of ECUs present in that domain. The ECU 10A is connected to its subordinate ECUs 41 to 49 via a lower layer network, for example, that communicates using CAN. CAN is an abbreviation for Controller Area Network. CAN is a registered trademark. The domains are, for example, the powertrain, body, chassis, and cockpit.

[0017] ECUs belonging to the powertrain domain may include, for example, an ECU that controls the engine, an ECU that controls the motor, an ECU that controls the battery, and the like.

[0018] The ECUs belonging to the body domain include, for example, ECUJ 48 that controls the air conditioner and ECUK 49 that controls the seats. The ECUs belonging to the body domain may also include ECUs that control the doors.

[0019] The ECUs belonging to the chassis domain include, for example, the ECUE 43 that controls the brakes, the ECUF 44 that controls the steering, and the like.

[0020] The multiple ECUs 10 and the center 35 are configured to control controlled objects mounted on the vehicle based on the second command output from the processing unit 71. The controlled objects include, for example, the engine, brakes, motors, various lights, display devices, air conditioners, seats, horns, generators, etc. The controlled objects are not shown in the drawings.

[0021] The controlled objects are individually controlled by ECUs 41 to 49, which are operation control devices. The ECUs 41 to 49 include an ECUC 41 having a camera control unit 91, an ECUD 42 having a millimeter wave control unit 92, an ECUE 43 having a brake control unit 93, and an ECUF 44 having a steering control unit 94. They also include an ECUG 45 having a display control unit 95, an ECUH 46 having a sound control unit 96, an ECUI 47 having a light control unit 97, an ECUJ 48 having an HVAC control unit 98, and an ECUK 49 having a seat control unit 99.

[0022] Each of the control units 91 to 99 includes an operation control unit for operating the controlled object. .mosquito The camera control unit 91 acquires images captured by the vehicle-mounted camera and controls the exposure of the vehicle-mounted camera, etc. The millimeter-wave control unit 92 controls the millimeter-wave radar installed in the vehicle and acquires the detection results obtained by the millimeter-wave radar.

[0023] The brake control unit 93 controls the brakes. The steering control unit 94 controls the steering. The display control unit 95 controls indicators such as meters and warning lights. The sound control unit 96 controls sounds such as warning sounds and voices emitted from speakers. The light control unit 97 controls various lights mounted on the vehicle.

[0024] The HVAC control unit 98 controls the vehicle air conditioner. HVAC is an abbreviation for Heating, Ventilation and Air-Conditioning. The seat control unit 99 controls the vehicle's electric power seats.

[0025] The various functions of the multiple ECUs 10, etc. and the center 35 are realized by CPUs 11-49A executing programs stored in non-transitory tangible recording media. In this example, memories 12-49B correspond to non-transitory tangible recording media storing the programs. Execution of these programs results in the execution of methods corresponding to the programs. Note that the term "non-transitory tangible recording media" refers to recording media excluding electromagnetic waves. The number of microcomputers constituting the multiple ECUs 10, etc. and the center 35 may be one or more.

[0026] The ECUA 10 executes a program to realize functions as applications (hereinafter referred to as apps) 61 and 62 and a processing unit 71. The ECUB 15 realizes functions as an app 63. The center 35 realizes functions as an app 64.

[0027] The applications 61 to 64 are programs for providing services to the vehicle user. The applications 61 to 64 indirectly send commands to controlled objects and operate the controlled objects to provide the user with useful functions. These applications 61 to 64 may be installed in the ECU A 10, the ECUB 15, or the center 35.

[0028] More specifically, the applications 61 to 64 are configured to generate a first command, which is a command that does not specify any of the control units 91 to 99 (described later), to the processing unit 71. The "command" includes, among the data used by the processing unit 71, commands such as operation requests, commands such as arguments, function calls, etc. The "command" may also include priority information indicating which command should be given priority in processing.

[0029] The applications 61-64 are not programs created specifically for a particular vehicle model, grade, etc., but are general-purpose programs that can be used with many vehicle models, grades, etc. Therefore, the applications 61-64 cannot specify how the vehicle in which they are installed will control the controlled object. For this reason, the applications 61-64 output commands that do not specify the amount of control of a specific controlled object, in other words, the control units 91-99 used by the processing unit 71. On the other hand, the applications 61-64 generate abstract desired operation content. For example, the applications 61-64 simply issue a command to turn on the lights, without specifying which lights to turn on.

[0030] In the following description, at least one of the applications 61 to 64 will also be referred to as a service application 6.

[0031] Unlike the applications 61 to 64, the processing unit 71 has a program created specifically for the vehicle type, grade, etc. In other words, the processing unit 71 has a program that absorbs differences in the vehicle type, grade, etc. so that the applications 61 to 64 do not need to be aware of differences in the vehicle type, grade, etc.

[0032] The processing unit 71 is mounted on the ECU A 10. The processing unit 71 receives commands from the ECU A 10 itself, the ECUB 15 which is another ECU, and a plurality of applications 61 to 64 mounted on the center .

[0033] The processing unit 71 includes, as functional blocks realized by the CPU 11 executing a program, i.e., as virtual components, a request arbitration unit 711, an arbitration priority management unit 712, and an arbitration result management unit 713. The processes performed by the request arbitration unit 711, the arbitration priority management unit 712, and the arbitration result management unit 713 will be described in detail later.

[0034] The processing unit 71 is also a program for controlling the controlled object. For example, the processing unit 71 calculates the amount of actuation of an actuator, which is the controlled object, and sends a command including the amount of actuation to the various control units 91-99. That is, when an abstract first command is input, the processing unit 71 has a function of generating a second command that embodies the first command. For example, when a first command to turn on the lights is input from the apps 61-64, the processing unit 71 generates a specific second command indicating which lights to turn on. More specifically, for example, the processing unit 71 recognizes what equipment the vehicle is equipped with and selects the types of lights to turn on depending on the types of equipment equipped on the vehicle. Then, the processing unit 71 sets a lighting pattern (e.g., a blinking interval) for each selected light and sends a second command including the lighting pattern to each control unit 91-99 that controls the lights to be turned on.

[0035] The processing unit 71 is also a program for sending data obtained from sensors and the like to the service application 6. In other words, the processing unit 71 realizes a "status recognition" function and an "equipment control" function. In the status recognition function, sensor data obtained from each of the control units 91 to 99, which will be described later, is converted into a format suitable for the processing unit 71. In the equipment control function, drive instructions from the processing unit 71 are distributed to each of the control units 91 to 99.

[0036] The state recognition function realizes the function to classify the raw data acquired from the vehicle sensors into data by sensing target that is easy to use by the service application 6. It also integrates the data and converts it into more abstract information.

[0037] For example, in the state recognition function, each of the control units 91 to 99 acquires individual information such as the vehicle speed being 0 km / h, the shift position being P, and the driver not being present in the vehicle, and outputs information indicating that the vehicle is parked based on this information. This information is transmitted to the service application 6.

[0038] For example, when the service application 6 makes a request regarding the car finder, the processing unit 71 may combine an ack from the light and an ack from the horn, which are responses to the light and horn control request, into a single operation result and respond to the service application 6. The car finder is a function of an application that notifies the user of the location of the vehicle in a parking lot or the like in an easy-to-understand manner.

[0039] The equipment control function selects each of the control units 91 to 99 (for example, engine, steering, shift, doors, windows, air conditioner, etc.) that are optimal for implementing the vehicle operation request from the service application 6. Then, the data is converted into a format that each of the control units 91 to 99 can accept, and the data is distributed taking into consideration the order in which it is to be transmitted.

[0040] For example, if the vehicle operation request is "Turn the vehicle left with a radius of 200 m and accelerate at 0.3 G," the equipment control function outputs "a request to output 1000 Nm to the engine and a request to output -0.1 rad to the steering."

[0041] For example, if the vehicle operation request is "to shift to parking state," the equipment control function outputs "a request to shift to P, a request to turn off the air conditioner, a request to fully close the windows, and when the above requests are completed and there are no occupants, a request to lock the doors and a request to shift to parking state."

[0042] [1-3. Processing] Next, basic processing executed by the vehicle control system 1 will be described using the ladder chart of FIG. 2. This processing is performed when different service applications 6 transmit operation requests for vehicle functions i related to non-safety functions. Here, the classification of functions as safety or non-safety is performed using, for example, the Automotive Safety Level (hereinafter referred to as ASIL). ASIL is a risk classification system defined by the ISO 26262 standard for functional safety of vehicles traveling on roads. ASIL is determined by three parameters: probability of exposure, controllability, and severity, and is expressed in four levels, A to D. A corresponds to the lowest level, and D corresponds to the highest level. In this embodiment, ASIL A is classified as vehicle function i related to non-safety functions, ASIL D is classified as vehicle function ii related to high-level safety functions, and ASIL B and ASIL C are classified as vehicle function iii related to safety functions at or below the high level. Note that ASIL does not necessarily have to be used to classify safety functions; any safety level defined to have multiple levels will suffice. Therefore, the safety level does not need to be four levels from A to D, but may be three levels or less, or five levels or more. Note that, hereinafter, "safety function" is also referred to as "function related to vehicle safety."

[0043] In S101, the application 61 having the application A transmits an operation request for the vehicle function i (i.e., a first command in this disclosure) to the request arbitration unit 711. At approximately the same time, in S102, the application 63 having the application B also transmits an operation request for the vehicle function i to the request arbitration unit 711.

[0044] In S11, the request arbitration unit 711 determines which first commands can be accepted. Specifically, the request arbitration unit 711 determines which first commands can be executed by referring to a priority order table. The priority order table is a table in which a priority order is associated with each application or each type of request from an application.

[0045] For example, as shown in FIG. 3A, the priority order table manages the priority order of vehicle functions requested by applications for each scene. Scenes are classified, for example, by driving state. Note that scenes may also be classified by the power state of vehicle equipment, driving load, automation level, etc. Furthermore, vehicle functions i requested by applications are classified, for example, by the type of request from the application (e.g., application A request i, application A request ii, etc.).

[0046] The request arbitration unit 711 determines that the first command can be received for the vehicle function i with a higher priority. That is, the vehicle function i with a higher priority is set to have a higher priority when the corresponding application is executed.

[0047] 3A is a table in which a priority is associated with each type of request from an application. Therefore, it is possible that after some of the requests from one application are executed, the execution of other requests may be put on hold. In this case, other processes with higher priority can be completed more quickly during this waiting period.

[0048] Note that a table in which priority is associated not for each request type but for each application as in Fig. 3B may be provided, and this table may be used in conjunction with the table shown in Fig. 3A. When the table shown in Fig. 3B is used, the request arbitration unit 711 can execute processing according to the priority set for each application. In this case, it is possible to prevent multiple application processes from being interrupted midway.

[0049] For the first command determined to be acceptable in S103, the request arbitration unit 711 outputs a second command based on the first command to an operation control unit for controlling the control target. In this embodiment, the request arbitration unit 711 determines that the operation request for vehicle function i transmitted from the application 61 is acceptable, and outputs the second command to the vehicle function i.

[0050] Furthermore, in S104, the request arbitration unit 711 transmits the arbitration result that the first command of the application 61 is acceptable and the first command of the application 63 is unacceptable to the arbitration result management unit 713.

[0051] The arbitration result management unit 713 records the arbitration result in S12. At this time, the arbitration result management unit 713 counts the number of times the first command of the application 63 cannot be accepted, and stores the number in the memory 12.

[0052] Next, in S13, the arbitration result management unit 713 determines whether or not there is a first command that has been determined to be unacceptable for a predetermined period of time or more. In this embodiment, the arbitration result management unit 713 determines whether or not there is a first command that has been determined to be unacceptable for a predetermined number of times or more, which is the predetermined period of time.

[0053] Note that the predetermined period is not limited to a predetermined number of times, but may be a predetermined period. Furthermore, the predetermined period may be set to a different value for each application, each command from an application, etc. Furthermore, the predetermined period may be set each time by performing calculations based on the conditions when the arbitration result management unit 713 executes processing, such as an application or a command from an application.

[0054] If there is a first command determined in S105 to be unacceptable for a predetermined period of time or longer and the first command is not classified as a preset function related to vehicle safety, the arbitration result management unit 713 queries the user as to whether or not to execute the target application. Note that the application that output the first command is the target application. In this embodiment, the arbitration result management unit 713 queries the user as to whether or not to execute the target application, assuming that application B is the target application. As an example, the query is executed while the vehicle is stopped. This is to enable the user to more safely respond to the query.

[0055] In S14, if the user accepts the response to the inquiry and responds that he / she will execute the target application, the information terminal 81 requests that other applications that conflict with the target application be stopped in S106. In this embodiment, the information terminal 81 requests that application A be stopped, and the application 61 stops the operation request of vehicle function i for application A in S15.

[0056] In S16, the request arbitration unit 711 again determines whether or not any of the first commands can be accepted.

[0057] In S107, for the first command that is determined to be acceptable as a result of the second determination, the request arbitration unit 711 outputs a second command based on the first command to an operation control unit for controlling the control target. In this embodiment, the request arbitration unit 711 determines that the operation request for vehicle function i transmitted from the application 63 is acceptable, and outputs the second command to vehicle function i.

[0058] Furthermore, the request arbitration unit 711 transmits the arbitration result that the first command of the application 63 can be accepted to the arbitration result management unit 713 in S108.

[0059] Next, in S17, the arbitration result management unit 713 determines whether or not there is a first command that has been determined to be unacceptable for a predetermined period of time or longer, similar to S13.

[0060] If there is no first command that has been determined to be unacceptable for a predetermined period of time or longer, the arbitration result management unit 713 asks the user in S109 whether or not to change the priority setting for similar scenes from the next time onwards.

[0061] In S18, a response to the inquiry regarding the next and subsequent settings is received, and in S110, the information terminal 81 requests that the priority of the vehicle function i be changed.

[0062] In S19, the arbitration priority management unit 712 updates the priority table based on the user's response.

[0063] Next, an example of operation when a new application is added will be explained using the ladder chart in Figure 4. In this process, a case where an application that executes an operation request for vehicle function i related to a non-safety function is added will be explained.

[0064] When application B is newly added from the information terminal 81 in S201, the application 63 requests the arbitration priority management unit 712 to add the vehicle function i requested by application B to the priority order table in S202.

[0065] In S21, the arbitration priority management unit 712 determines whether or not the vehicle function requested to be added to the priority table (hereinafter referred to as the added function) is a function related to vehicle safety. If the added function is a function related to vehicle safety, the arbitration priority management unit 712 does not permit its addition to the priority table. For example, if the added function has a high-level safety function such as vehicle function ii, it does not permit its addition to the priority table. This is because if the added function is a function related to vehicle safety, it should be executed with the highest priority and should not be able to have its priority changed to a lower one. In this embodiment, if the added function is vehicle function i, vehicle function i is a non-safety function and does not fall under the category of a function related to vehicle safety, and therefore addition of the added function to the priority table is permitted.

[0066] In S22, the arbitration priority management unit 712 adds the new application and the default priority to the priority table in association with each other. At this time, the arbitration priority management unit 712 may also add the types of requests that may be transmitted from the new application and the default priority to the priority table in association with each other.

[0067] If a change in priority is requested by user operation in S203, the arbitration priority management unit 712 changes the priority listed in the priority table from the default priority to the priority specified by user operation in S23.

[0068] Next, the arbitration priority management unit 712 transmits the changed priority to the information terminal 81 in S204.

[0069] Next, another example of operation when a new application is added will be explained using the ladder chart in Fig. 5. In this process, a case where an application that executes an operation request for vehicle function ii related to a high-level safety function is added will be explained.

[0070] When application B is newly added from the information terminal 81 in S301, the application 63 requests the arbitration priority management unit 712 to add the vehicle function ii requested by application B to the priority order table in S302.

[0071] In S31, the arbitration priority management unit 712 determines whether or not to add the vehicle function ii to the priority table, similarly to S21. In this embodiment, the vehicle function ii is a high-level safety function and corresponds to a function related to the safety of the vehicle, and therefore addition to the priority table is rejected.

[0072] Next, in S303, the arbitration priority management unit 712 stops the request for adding the vehicle function ii to the priority table, and in S32, the application 63 stops the request.

[0073] Furthermore, the arbitration priority management unit 712 notifies the user that application B cannot be added to the priority table because it is a safety-related function.

[0074] [1-4.Effects] According to the embodiment described above in detail, the following effects can be obtained.

[0075] (1a) In S13, the arbitration result management unit 713 determines whether there is a first command that has been determined to be unacceptable a predetermined number of times or more. Then, in S105, if there is a first command that has been determined to be unacceptable a predetermined number of times or more and the first command is not classified as a predetermined function related to vehicle safety, the arbitration result management unit 713 queries the user as to whether or not to execute the target application. This configuration can avoid a situation in which an application desired by the user is not executed a predetermined number of times or more. In addition, if a configuration is adopted in which functions related to vehicle safety are executed with priority without querying the user, vehicle safety can be maintained. Therefore, it is possible to execute an application desired by the user with priority while maintaining vehicle safety.

[0076] (1b) If the user responds that he / she will execute the target application, the request arbitration unit 711 executes the target application with priority over other applications by accepting a first command from the target application in S107. This configuration can prevent the target application from not being executed for a predetermined period of time.

[0077] (1c) If the user responds that he / she will execute the target application, the information terminal 81 requests in S106 that other applications that conflict with the target application be stopped. With this configuration, the other conflicting applications are stopped, so that the target application can be executed immediately.

[0078] (1d) When a new application is added, the arbitration priority management unit 712 associates the new application with a priority and adds the association to the priority table in S22. Furthermore, the request arbitration unit 711 determines, in S11, which first command is executable or not by referring to the priority table. With this configuration, the priority of applications can be managed in a simple manner. Note that when a new application is added, the type of command from the application may be associated with a priority and added to the priority table.

[0079] (1e) In S203, if a user operation requests a change in the priority of vehicle function i, the arbitration priority management unit 712 can change the priority listed in the priority table in S23. On the other hand, in S31, vehicle function ii is a high-level safety function and corresponds to a function related to vehicle safety, so addition to the priority table is rejected and the priority cannot be changed. With this configuration, it is possible to set priorities in accordance with the user's intentions. In addition, since functions related to vehicle safety are not set to lower priorities, it is possible to maintain vehicle safety.

[0080] 2. Other Embodiments Although the embodiments of the present disclosure have been described above, it goes without saying that the present disclosure is not limited to the above-described embodiments and can take on various forms.

[0081] (2a) In the above embodiment, the arbitration result management unit 713 determines whether there is a first command that has been determined to be unacceptable for a predetermined number of times or more in S13. That is, the number of times arbitration has been lost is counted, and this count value is used as the arbitration loss period to determine whether to accept the command. However, the method of determining whether there is a first command that has been determined to be unacceptable for a predetermined period of time or more is not limited to this. For example, the arbitration result management unit 713 may determine whether there is a first command that has been determined to be unacceptable for a certain period of time or more. That is, the arbitration loss period may be measured, and this period may be used as the arbitration loss period to determine whether to accept the command. Furthermore, the predetermined number of times or the certain period of time may be fixed values ​​or may differ depending on the type of application. Furthermore, the predetermined number of times or the certain period of time may be changed depending on the situation.

[0082] (2b) In the above embodiment, the arbitration result management unit 713 is configured to inquire of the user whether or not to execute the target application while the vehicle is stopped in S105. However, the timing of the inquiry to the user is not limited to this. For example, the arbitration result management unit 713 may notify the user while the vehicle is stopped or while the vehicle is moving, and may use different methods of inquiry to the user while the vehicle is stopped and while the vehicle is moving. As an example, it is preferable to display the inquiry content on a monitor while the vehicle is stopped, and to notify the user by voice while the vehicle is moving. With this configuration, the user can be queried in a manner appropriate for the situation.

[0083] (2c) In the above embodiment, when the user accepts a response to the inquiry in S14 and responds that he or she will execute the target app, the information terminal 81 requests in S106 that other applications that conflict with the target app be stopped. However, the configuration in which the target app is executed with priority over other applications is not limited to this. For example, the information terminal 81 may request execution of the target app without requesting that other applications that conflict with the target app be stopped. As a result, the execution of the target app may result in the other applications that conflict with the target app being stopped.

[0084] (2d) In the above embodiment, a configuration has been described in which adding a vehicle function to the priority table is not permitted if the vehicle function is a function related to vehicle safety. However, adding a vehicle function to the priority table may be permitted even if the vehicle function is a function related to vehicle safety. However, it is preferable that the priority of a vehicle function be unchangeable if the vehicle function is a function related to vehicle safety. With this configuration, vehicle safety can be maintained because the priority of a function related to vehicle safety is not set to a lower value. Note that the priority of applications classified as functions related to vehicle safety is set higher than the priority of applications not classified as functions related to vehicle safety. For example, applications classified as functions related to vehicle safety are set so as not to lose arbitration. This prevents applications classified as functions related to vehicle safety from losing arbitration, and allows the user's intentions to be reflected in applications not classified as functions related to vehicle safety.

[0085] (2e) In the above embodiment, the arbitration result management unit 713 is configured to query the user at S105 whether to execute application B as a target application. That is, the arbitration result management unit 713 queries whether to allow execution of the application itself. If execution is permitted, execution of the entire application is prioritized, either temporarily or permanently. However, the vehicle control system 1 may be configured to query whether to allow execution of a portion of the operations executed by the application. If execution is permitted, priority may be given to a portion of the operations executed by the application, either temporarily or permanently. For example, consider a case in which a driving instructor application that monitors the user's driving situation and performs driving diagnosis and a music playback application that plays music are both running. In this case, if the audio output of driving advice from the driving instructor application loses arbitration, the arbitration result management unit 713 may query whether to allow execution of the audio output. Even if audio output is not permitted, the driving instructor application itself may continue to run.

[0086] (2f) The multiple ECUs 10 and the associated methods described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to implement one or more functions embodied in a computer program. Alternatively, the multiple ECUs 10 and the associated methods described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the multiple ECUs 10 and the associated methods described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to implement one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions to be executed by a computer. The methods for implementing the functions of each unit included in the multiple ECUs 10 do not necessarily need to include software; all of the functions may be implemented using one or more hardware components.

[0087] (2g) Multiple functions of one component in the above embodiments may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0088] (2h) In addition to the vehicle control system 1 described above, the present disclosure can also be realized in various forms, such as an ECU 10 or the like that is a component of the vehicle control system 1, a vehicle control program for causing a computer to function as the ECU 10 or the like, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and a vehicle control method.

Claims

1. A vehicle control device that is mounted on a vehicle and configured to control the vehicle, an acceptance determination unit (711, S11) configured to, when a first command from at least one application is input, determine whether or not the first command can be accepted; an output unit (711, S103) configured to output a second command based on the first command determined to be acceptable to an operation control unit for controlling a controlled object; a period determination unit (713, S13) configured to determine whether or not there is a first command that has been determined to be unacceptable for a predetermined period of time or more; a notification unit (713, S105) configured to, when the first command determined by the period determination unit to be unacceptable for a predetermined period or longer exists and the first command is not classified into a preset function related to vehicle safety, inquire of a user whether or not to execute an operation of an application that has output the first command as a target application; A vehicle control device comprising:

2. The vehicle control device according to claim 1, an execution priority unit (711, S107) configured to receive a response to the inquiry from the notification unit, and when the user responds that they will execute the operation of the target application, cause the reception determination unit to receive the first command from the target application, thereby executing the operation of the target application in priority to operations of other applications; The vehicle control device further comprises:

3. The vehicle control device according to claim 2, the execution priority unit stops other applications that conflict with the target application, so that the acceptance determination unit determines that the target application is acceptable; A vehicle control device configured as follows.

4. The vehicle control device according to any one of claims 1 to 3, A priority table is provided in which a priority is associated with each application, a table adding unit (712, S21) configured to, when a new application is added, associate the new application with the priority and add the association to the priority table; Further provided with the acceptance determination unit determines whether the first command is executable by referring to the priority order table; A vehicle control device configured as follows.

5. The vehicle control device according to any one of claims 1 to 3, A priority table is provided in which a priority is assigned to each type of command from an application, a table adding unit (712, S21) configured to, when a new application is added, associate the type of command with the priority of the new application and add the associated command to the priority table; Further provided with the acceptance determination unit determines whether the first command is executable by referring to the priority order table; A vehicle control device configured as follows.

6. The vehicle control device according to claim 4, a table change unit (712, S23) configured to be able to change the priorities written in the priority order table by an operation of the user; Further provided with the table change unit cannot change the priority order of functions related to the safety of the vehicle; A vehicle control device configured as above.

7. The vehicle control device according to any one of claims 1 to 3, the notification unit notifies the user when the vehicle is stopped or when the vehicle is moving, and the method of inquiry to the user is different depending on whether the vehicle is stopped or when the vehicle is moving. A vehicle control device configured as follows.

8. The vehicle control device according to any one of claims 1 to 3, Priority is set for each application in advance. the priority of an application classified as a function related to vehicle safety is set higher than the priority of an application not classified as a function related to vehicle safety; the acceptance determination unit determines whether the first command can be executed by referring to the priority order. A vehicle control device configured as follows.

9. 1. A query method implemented by a vehicle control device mounted on a vehicle and configured to control the vehicle, comprising: When a first command is input from at least one application, determining whether the first command can be accepted (711, S11); For the first command determined to be acceptable, outputting a second command based on the first command to an operation control unit for controlling a controlled object (711, S103); Determining whether or not there is a first command that has been determined to be unacceptable for a predetermined period of time or more (713, S13); If the first command is determined to be unacceptable for a predetermined period of time or more and the first command is not classified as a function related to a preset vehicle safety, the application that output the first command is set as a target application, and the user is asked whether or not to execute the operation of the target application (713, S105); How to contact us, including:

10. The vehicle's on-board computer a function of determining whether or not a first command can be received when a first command is input from at least one application (711, S11); a function of outputting a second command based on the first command determined to be acceptable to an operation control unit for controlling a controlled object (711, S103); a function of determining whether or not there is a first command that has been determined to be unacceptable for a predetermined period of time or more (713, S13); a function of, when the first command determined to be unacceptable for a predetermined period of time or more exists and the first command is not classified into a function related to the vehicle safety set in advance, inquiring the user whether or not to execute the operation of the target application, with the application that output the first command as the target application (713, S105); A program to achieve this.

11. A vehicle control system mounted on a vehicle, a vehicle control device (10) configured to control the vehicle and having a relay function in a network within the vehicle; an electronic control unit (41 to 49) communicably connected to the vehicle control unit via the network; Equipped with The vehicle control device includes: an acceptance determination unit (711, S11) configured to, when a first command from at least one application is input, determine whether or not the first command can be accepted; an output unit (711, S103) configured to output a second command based on the first command determined to be acceptable to the electronic control device that controls the controlled object; a period determination unit (713, S13) configured to determine whether or not there is a first command that has been determined to be unacceptable for a predetermined period of time or more; a notification unit (713, S105) configured to, when the first command determined by the period determination unit to be unacceptable for a predetermined period or longer exists and the first command is not classified into a preset function related to vehicle safety, inquire of a user whether or not to execute an operation of an application that has output the first command as a target application; Equipped with The electronic control device a control unit (91 to 99) configured to execute control of the controlled object based on the second command output from the output unit; A vehicle control system comprising:

Images