Vehicle control device, vehicle control system, reception determination method, and program

Abstract

This vehicle control device includes a cooperation control unit 73, a functional block 50, an acceptance determination unit 75, and an output control unit 77. The cooperation control unit causes cooperation between an application and a functional block that executes a predetermined process, and the functional block converts a first command sent from the application in a vehicle-independent format into a second command in a vehicle-dependent format and outputs the second command to an operation control unit that controls an object to be controlled. The acceptance determination unit determines whether the first command is in accordance with the intention of a user, and the output control unit does not cause the output unit to output a second command when the acceptance determination unit has determined that the first command does not comply with the intention of the user.

Description

Cross-reference to related applications

[0001] This international application claims priority based on Japanese Patent Application No. 2022-140066 filed with the Japan Patent Office on September 2, 2022, and incorporates by reference the entire contents of Japanese Patent Application No. 2022-140066 into this international application.

Technical Field

[0002] This disclosure relates to a vehicle control device.

Background Art

[0003] The following Patent Document 1 discloses an in-vehicle device for appropriately preventing the execution of inappropriate vehicle remote operations by a user. Specifically, when the air conditioner is operated by a vehicle remote operation from the user and the presence of a person or an animal is detected inside the vehicle cabin or around the vehicle, the in-vehicle device ignores the user's designation of cooling, heating, and set temperature, and forcibly operates the air conditioner in the auto mode.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

[0005] By the way, in the future, it is assumed that an unspecified number of third-party applications will access the vehicle system. As a result of the inventors' detailed examination, these applications have been found to have the problem that they may access the functions and information of the vehicle at unintended times or with unintended content and operate the vehicle.

[0006] One aspect of this disclosure provides a technique capable of suppressing the execution of an application regardless of the user's intention.

[0007] One aspect of the present disclosure is a vehicle control device that is mounted on a vehicle and configured to control the vehicle.

[0008] The vehicle control device includes a cooperation control unit (73) that enables coordination between applications (61, 62, 63, 64) configured to provide services to the vehicle and functional blocks (50) configured to perform predetermined processes in the vehicle.

[0009] The functional block includes output units (51-59) configured to convert a first command, expressed in a vehicle-independent format and transmitted from the application, into a second command in a vehicle-dependent format, and output it to the operation control units (91-99) for controlling the controlled object. The coordination control unit also transfers the first command transmitted from the application to the functional block.

[0010] The vehicle control device also includes a reception determination unit (75, S103) and an output control unit (77, S103).

[0011] The reception determination unit is configured to determine whether the first command conforms to the user's intentions, and the output control unit is configured to prevent the output unit from outputting the second command if the reception determination unit determines that the first command does not conform to the user's intentions.

[0012] This configuration prevents applications from running without the user's consent. [Brief explanation of the drawing]

[0013] [Figure 1] This is a block diagram showing the configuration of a vehicle control system. [Figure 2] This is a block diagram showing the functional configuration of the processing unit. [Figure 3] Figure 2 is a flowchart illustrating the basic operation of the processing unit shown. [Figure 4] This is a flowchart of the notification settings process. [Figure 5]This flowchart shows a variation of the basic operation of the processing unit. [Modes for carrying out the invention]

[0014] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings.

[0015] [1. Embodiments] [1-1. Correspondence between the configuration of the embodiment and the configuration of the present disclosure] In the embodiments described below, ECUA10 corresponds to the vehicle control device in this disclosure.

[0016] The processing in S103 in the embodiment corresponds to the functions of the reception determination unit and output control unit in this disclosure. The processing in S104 in the embodiment corresponds to the functions of the output unit in this disclosure. The processing in S105 in the embodiment corresponds to the functions of the match determination unit in this disclosure. The processing in S106 in the embodiment corresponds to the functions of the output permission unit and storage unit in this disclosure. The processing in S107 in the embodiment corresponds to the functions of the notification unit in this disclosure. The processing in S204 in the embodiment corresponds to the functions of the notification setting unit in this disclosure.

[0017] [1-2. Structure] The vehicle control system 1 shown in Figure 1 is mostly mounted on a vehicle such as a passenger car and includes multiple ECUs 10, 15, 41-49 (hereinafter referred to as "a large number of ECUs 10, etc."). The vehicle control system 1 may also include a center 35 outside the vehicle.

[0018] Center 35 is configured as a server capable of providing functions to the vehicle. For example, Center 35 can provide the vehicle with functions related to autonomous driving.

[0019] A number of ECUs 10 etc. and the center 35 are each configured around a well-known microcomputer having CPUs 11, 16, 36 (hereinafter referred to as CPUs 11 to 36) and semiconductor memories 12, 17, 37 such as RAM, ROM, and flash memory (hereinafter referred to as memories 12 to 37). Note that ECUs 41 to 49 also have a CPU and a memory, but their illustration is omitted. Also, an ECU represents an electronic control unit.

[0020] A number of ECUs 10 etc. and the center 35 are configured to control controlled objects mounted on the vehicle. The controlled objects include, for example, an engine, brakes, a motor, various lights, a display device, an air conditioner, a seat, a horn, a generator, etc. Note that the illustration of the controlled objects is omitted.

[0021] The controlled objects are individually controlled by the ECUs 41 to 49 which are operation control devices. The ECUs 41 to 49 include ECUC41 having a camera control unit 91, ECUD42 having a millimeter-wave control unit 92, ECUE43 having a brake control unit 93, and ECUF44 having a steering control unit 94. Also included are ECUG45 having a display control unit 95, ECUH46 having a sound control unit 96, ECUI47 having a light control unit 97, ECUJ48 having a HVAC control unit 98, and ECUK49 having a seat control unit 99.

[0022] Each of the control units 91 to 99 includes an operation control unit for operating the controlled object. As an example, the operation control unit is an operation control program. The camera control unit 91 acquires the captured image of the in-vehicle camera and controls the exposure etc. of the in-vehicle camera. The millimeter-wave control unit 92 controls the millimeter-wave radar provided on the vehicle and acquires the detection result obtained by the millimeter-wave radar.

[0023] The brake control unit 93 controls the brakes. The steering control unit 94 controls the steering. The display control unit 95 controls displays such as meters and warning lights. The sound control unit 96 controls sounds such as warning sounds and voices generated from the speaker. The light control unit 97 controls various lights mounted on the vehicle.

[0024] The HVAC control unit 98 controls the vehicle's air conditioning system. HVAC stands for Heating, Ventilation and Air-Conditioning. The seat control unit 99 controls the vehicle's electric power seats.

[0025] The various functions of the numerous ECUs 10 and the center 35 are realized by the CPUs 11 to 36 executing programs stored in non-transitional tangible recording media. In this example, the memories 12 to 37 correspond to the non-transitional tangible recording media that store the programs. Furthermore, when these programs are executed, the methods corresponding to the programs are executed. Note that non-transitional tangible recording media means recording media excluding electromagnetic waves. Also, the number of microcomputers constituting the numerous ECUs 10 and the center 35 may be one or more.

[0026] Among the many ECUs 10, ECUA10 executes a program to realize the functions of applications 61, 62 and processing unit 71. ECUB15 realizes the function of application 63. Center 35 realizes the function of application 64.

[0027] Apps 61-64 are programs designed to provide services to the vehicle user. Apps 61-64 indirectly transmit commands to the controlled object, thereby activating the controlled object and providing useful functions to the user. These apps 61-64 may be installed in the ECUA10, the ECUB15, or the center 35.

[0028] More specifically, applications 61-64 are configured to generate a first command to the processing unit 71, which is a command that does not specify the control units 91-99 described later. The "command" includes data used by the processing unit 71, such as commands for operation requests, commands for arguments, function calls, etc. The "command" may also include priority information indicating which command should be processed first.

[0029] Apps 61-64 are not programs specifically created for a particular vehicle model or grade, but rather general-purpose programs that can handle many vehicle models and grades. Therefore, apps 61-64 cannot specify how the vehicle in which they are installed controls the controlled object. For this reason, apps 61-64 output commands that do not specify the control amount of the controlled object, in other words, the control units 91-99 used by the processing unit 71. On the other hand, apps 61-64 generate desired abstract operation content. For example, apps 61-64 only command the operation content "Turn on the lights," without including which specific lights to turn on.

[0030] In the following, at least one of apps 61-64 will also be referred to as service app 6.

[0031] Unlike applications 61-64, processing unit 71 has a program specifically created for each vehicle model, trim level, etc. In other words, processing unit 71 has a program that absorbs differences in vehicle model, trim level, etc., so that applications 61-64 do not need to be aware of these differences.

[0032] The processing unit 71 is mounted on the ECUA10. The processing unit 71 receives commands (hereinafter referred to as the first command) from itself (ECUA10), another ECU (ECUB15), and multiple applications 61-64 mounted on the center 35.

[0033] The processing unit 71 also serves as a program for controlling the controlled object. For example, the processing unit 71 calculates the amount of operation of the actuator, which is the controlled object, and sends a command (hereinafter referred to as the second command) including the amount of operation to the various control units 91 to 99. In other words, the processing unit 71 comprises a linkage control unit 73, a functional block group 50, a reception determination unit 75, and an output control unit 77.

[0034] Here, when the linkage control unit 73 receives a first command from multiple applications 61 to 64, it selects the object to be controlled according to the first command and outputs the first command to the functional block group 50. If the linkage control unit 73 receives first commands simultaneously from multiple applications 61 to 64, it may mediate those first commands. As a result of the mediation, the linkage control unit 73 outputs the first command that it has determined to be executable to the functional block group 50.

[0035] The reception determination unit 75 determines, based on instructions from the cooperation control unit 73, whether the first command conforms to the user's intentions. If the reception determination unit 75 determines that the first command does not conform to the user's intentions, the output control unit 77 prevents the output of the second command corresponding to the first command from the output units 51-59 to each ECU 41-49. In this case, the output control unit 77 may also prevent the output of the first command from the cooperation control unit 73 to the functional block group 50.

[0036] Furthermore, the functional block group 50 includes output units 51 to 59 that convert the first command input from the linkage control unit 73 into a materialized second command and output it to the corresponding ECUs 41 to 49 of the control units 91 to 99. Each of the output units 51 to 59 outputs a second command to the corresponding ECU 41 to 49 that materializes the control parameters and operating amounts of the controlled object.

[0037] For example, when the linked control unit 73 receives a first command from applications 61-64 to turn on the lights, it identifies the specific target to be controlled, such as which lights to turn on, and outputs this to the functional block group 50. Then, the output units 51-59 in the functional block group 50 set the lighting pattern for the lights (for example, the interval for blinking) from the first command and output this as a second command to the control units 91-99 to turn on the lights.

[0038] The processing unit 71 is also a program for sending data obtained from sensors, etc., to the service application 6. In other words, the processing unit 71 implements the functions of "state recognition" and "equipment control". In the state recognition function, it converts the sensor data obtained from each of the control units 91 to 99, which will be described later, into a format suitable for the processing unit 71. In the equipment control function, it distributes drive instructions from the processing unit 71 to each of the control units 91 to 99.

[0039] The state recognition function enables the classification of individual sensor data acquired from vehicle sensors into data categorized by sensing target, making it easier for the service application 6 to use. It also integrates the data and converts it into more abstract information.

[0040] For example, in the state recognition function, each control unit 91-99 acquires individual information such as vehicle speed 0 km / h, shift position P, and no driver inside the vehicle, and based on this information, outputs that the vehicle is in a parked state. This information is transmitted to the service application 6.

[0041] For example, if service application 6 makes a request regarding the car finder, processing unit 71 may combine the acknowledgments from the lights and horn, which are responses to the light and horn control requests, into a single operation result and send it back to service application 6. Note that the car finder is a function of an application that clearly notifies the user of the vehicle's location, such as in a parking lot.

[0042] Furthermore, the equipment control function, as described above, selects the optimal control units 91-99 (e.g., engine, steering, shift, doors, windows, air conditioning, etc.) to fulfill vehicle operation requests from the service application 6. Then, it converts the data into a format that each control unit 91-99 can accept and distributes it, taking into consideration the order in which the data is transmitted.

[0043] For example, if the vehicle operation request is "turn left with a radius of 200m while accelerating at 0.3G," the equipment control function will output "a request to output 1000Nm to the engine and a request to output -0.1rad to the steering wheel."

[0044] For example, suppose the vehicle operation request is "transition to parking state." In this case, the equipment control function will output "request to put the shift lever in P, request to turn off the air conditioner, request to close all windows, and once the above requests are complete and the vehicle is unoccupied, request to lock the doors and transition to parking state."

[0045] [1-3. Processing] Next, the basic processing performed by the processing unit 71 to realize its functions as a reception determination unit 75 and an output control unit 77 will be explained using the flowchart in Figure 3. This process describes the sequence of events when a hazard operation request is received from the service application 6. In this process, the service application 6 is, for example, a car finder application that notifies the user of the vehicle's location by flashing the hazard lights.

[0046] First, in S101, the processing unit 71 determines whether or not a new first command has been input from the service application 6.

[0047] If the processing unit 71 determines in S101 that a new first command has been input from the service application 6, it proceeds to S102.

[0048] On the other hand, if the processing unit 71 determines in S101 that no new first command has been input from the service application 6, it repeats S101.

[0049] In S102, the processing unit 71 determines whether the new first command is a command indicating a hazard operation request.

[0050] If the processing unit 71 determines in S102 that the new first command is a command indicating a hazard operation request, it proceeds to S103.

[0051] On the other hand, if the processing unit 71 determines in S102 that the new first command is not a command indicating a hazard operation request, it returns to S101.

[0052] In S103, the processing unit 71 performs processing as a reception determination unit 75, which determines whether the first command is in line with the user's intentions. Specifically, the processing unit 71 determines whether the first command is in line with the user's intentions based on at least one of the following: vehicle equipment, vehicle status, and vehicle environment.

[0053] "Meeting the user's intentions" means maintaining or transitioning to a state where the user's safety is ensured, the user does not feel anxious, the user is more comfortable, and the vehicle runs smoothly.

[0054] Whether the first command aligns with the user's intentions may include both a "timing" perspective and a "content" perspective. The "timing" perspective is the perspective of determining whether it is inappropriate to execute the first command at that time. The "content" perspective is the perspective of determining whether executing the first command would create a contradiction or cause discomfort to the user.

[0055] A situation in which executing the first command would result in a contradiction is one in which, if the first command were executed, the system would transition to the exact opposite state from the state before the first command was executed. For example, as will be described later in another embodiment (2a), this would occur if the first command to start the air conditioning is entered while the heating is on, or if the first command to close the side window is entered while the side window open button is being pressed.

[0056] For example, if running an application could cause the battery level to drop and potentially render the vehicle inoperable, it will be determined that it does not align with the user's intentions. Similarly, if the car finder function is unnecessary, such as when the vehicle is in motion, and unintended activation of the hazard lights is inappropriate, it will also be determined that it does not align with the user's intentions. Furthermore, if another application is to open the vehicle doors, for example, if the vehicle is traveling at high speed on a highway, opening the vehicle doors will be deemed inappropriate, and it will be determined that it does not align with the user's intentions.

[0057] Vehicle equipment refers to the equipment in the vehicle on which the vehicle control system 1 is installed. For example, vehicle equipment includes the voltage value of the device and the power status of the device. Vehicle status refers to the state inside the vehicle on which the vehicle control system 1 is installed. For example, vehicle status includes the status of various switches and the temperature inside the vehicle. Vehicle environment refers to the environment around the vehicle on which the vehicle control system 1 is installed. For example, vehicle environment includes information such as the weather and time of day. The processing unit 71 may determine whether the first command is in line with the user's intentions based on two or more pieces of information from vehicle equipment, vehicle status, and vehicle environment.

[0058] In this embodiment, the processing unit 71 determines, based on the vehicle equipment, whether the hazard light activation request is in line with the user's intention. If the processing unit 71 determines in S103 that the first command is in line with the user's intention, it proceeds to S104 and activates the hazard lights.

[0059] In other words, S104 selects one or more control units 91-99 that are best suited for activating the hazard lights. Then, it converts the data into a format that each control unit 91-99 can accept and distributes it, taking into account the order in which the data is transmitted.

[0060] On the other hand, if the processing unit 71 determines in S103 that the first command does not conform to the user's intentions, it proceeds to S105. In other words, if the processing unit 71 determines in S103 that the first command does not conform to the user's intentions, it does not output the second command based on the first command.

[0061] In S104, the processing unit 71 activates the hazard lights. At this time, the processing unit 71 enables the application for activating the hazard lights to be activated. As a result, the processing unit 71 can output a second command based on the first command to the operation control unit for controlling the controlled object.

[0062] Each control unit 91-99 is equipped with an operation control unit for operating the controlled object, and each control unit 91-99 executes the operation control unit upon receiving an operation instruction. In other words, the memory of each operation control device, each ECU 41-49, stores the operation control program that constitutes each control unit 91-99, and this program is executed by the CPU.

[0063] In this embodiment, the processing unit 71 outputs a second command based on the first command to the light control unit 97 for controlling various lights. Specifically, the processing unit 71 outputs a "request to flash the headlights and taillights" as the second command. The light control unit 97 executes operation control of the controlled object based on the second command. After that, the processing unit 71 terminates this process.

[0064] In S105, the processing unit 71 determines whether a notification has already been issued asking whether or not to execute the application that issued the first command.

[0065] If the processing unit 71 determines that a notification has already been issued in S105 asking whether or not to execute the application for which the first command was output, it proceeds to S106.

[0066] However, the processing unit 71 may make another inquiry if the conditions under which it previously inquired with the user differ from the current conditions. This is because, even if the user has already responded whether or not to run the application, the user may want to select a different response depending on the conditions (for example, whether the vehicle is moving or stopped, the ambient light level, etc.).

[0067] Therefore, even if the processing unit 71 determines that a notification has already been issued asking whether or not to execute the application that issued the first command, if it determines in S105 that the comparison condition does not match the permission condition, it proceeds to S107.

[0068] More specifically, the processing unit 71 determines whether the comparison condition matches the authorization condition. The comparison condition is at least one of the vehicle equipment, vehicle state, and vehicle environment when the first command related to the application is input. In this embodiment, the vehicle equipment information in this processing cycle corresponds to the comparison condition. The authorization condition is at least one of the vehicle equipment, vehicle state, and vehicle environment when the user is authorized to execute the application for which the first command was output. The authorization condition is stored in memory 12. In this embodiment, the vehicle equipment information stored in memory 12 in S106 in a previous processing cycle corresponds to the authorization condition.

[0069] In other words, if the processing unit 71 determines in S105 that the comparison conditions do not match the permission conditions, it asks the user again whether or not to execute the first command.

[0070] On the other hand, if the processing unit 71 determines that no notification has yet been issued asking whether or not to execute the application for which the first command was output in S105, it proceeds to S107.

[0071] In S106, the processing unit 71 determines whether the user has authorized the execution of the application that output the first command. In this embodiment, the processing unit 71 determines whether the user has authorized the hazard operation.

[0072] If the processing unit 71 determines in S106 that the user has given permission to execute the application that output the first command, it stores the permission conditions, which are the conditions under which permission was granted, in memory 12. After that, the processing unit 71 proceeds to S104. In other words, if the user has given permission to execute the application in response to the query, the processing unit 71 allows the output of the second command based on the first command, regardless of the result of the determination in S103. In addition, if the processing unit 71 determines in S105 that the comparison conditions match the permission conditions, it also determines in S106 that the user has given permission to execute the application that output the first command.

[0073] On the other hand, if the processing unit 71 determines that the user has not authorized the execution of the application that issued the first command in S106, it terminates this process without executing the application that issued the first command.

[0074] In S107, the processing unit 71 notifies the user that it cannot execute the application that issued the first command, and also asks the user whether or not to execute the application that issued the first command. The processing unit 71 also notifies the user of the reason why it cannot execute the application that issued the first command. After that, the processing unit 71 terminates this process. Here, the processing unit 71 may change the means of notifying the user depending on the situation. For example, if the user is not in the vehicle and operates the application from outside the vehicle using a mobile terminal such as a smartphone, the processing unit 71 may display the notification on the display screen of the mobile terminal. Alternatively, for example, if the user is in the vehicle and operates the application using an in-vehicle device, the processing unit 71 may display the notification on the in-vehicle display.

[0075] Furthermore, even if the processing unit 71 determines that a notification asking whether or not to execute the application for which the first command was output in S105 has not yet been output, if it is pre-configured not to send notifications for that application, it will skip the process in S107. The notification setting process for determining whether or not to ask the user about an application will be described in detail later.

[0076] [1-4. Notification settings process] The notification setting process executed by the processing unit 71 will be explained using the flowchart in Figure 4. This process is executed when a new application is added.

[0077] First, in S201, the processing unit 71 determines whether a new application has been added.

[0078] If the processing unit 71 determines that a new application has been added in S201, it proceeds to S202.

[0079] On the other hand, if the processing unit 71 determines in S201 that no new applications have been added, it repeats S201.

[0080] In S202, the processing unit 71 displays a notification settings screen, for example, on the monitor. On the notification settings screen, various settings can be configured for the application that was determined to have been newly added in S201. For example, it is possible to set whether or not to ask the user for permission to execute the request in S105, that is, "whether or not to ask the user for permission to execute the request when an action request is made at a time that may not be in line with the user's intentions."

[0081] Next, in S203, the processing unit 71 determines whether or not input has been received from the notification settings screen.

[0082] If the processing unit 71 determines in S203 that input has been received from the notification settings screen, it proceeds to S204.

[0083] On the other hand, if the processing unit 71 determines in S203 that there was no input from the notification settings screen, it skips the process in S204 and terminates this notification settings process.

[0084] In S204, the processing unit 71 sets whether or not to request a notification, based on the input from the notification settings screen. After that, the processing unit 71 terminates this notification settings process.

[0085] Furthermore, the method for setting whether or not to send an inquiry is not limited to using the notification settings screen. For example, the processing unit 71 may receive the setting for whether or not to send an inquiry using the user's mobile device or other communication means, and may set whether or not to send an inquiry according to this setting.

[0086] [1-5. Effects] According to the embodiments described in detail above, the following effects can be obtained.

[0087] (1a) If the processing unit 71 determines in S103 that the first command does not conform to the user's intentions, it does not proceed to S104 and does not output a second command based on the first command. With this configuration, it is possible to prevent the application from being executed regardless of the user's intentions.

[0088] (1b) The processing unit 71 determines whether the first command is in line with the user's intentions based on at least one of the vehicle equipment, vehicle condition, and vehicle environment. With this configuration, the user's intentions are determined based on information about the vehicle equipment, vehicle condition, and vehicle environment of the vehicle used by the user, so the user's intentions can be determined appropriately.

[0089] (1c) In S107, the processing unit 71 notifies the user that the application that output the first command cannot be executed, and in addition, asks the user whether or not to execute the application that output the first command. If the user permits to execute the application in response to the inquiry, the processing unit 71 permits to output the second command based on the first command, regardless of the result of the determination in S103. With this configuration, the user can be informed that the application cannot be executed. In addition, the user's intention regarding whether or not to execute the application can be reflected.

[0090] (1d) If the processing unit 71 determines in S105 that the comparison condition matches the permission condition, then in S106 it determines that the user has given permission to execute the application that output the first command, and outputs a second command based on the first command without contacting the user. With this configuration, when it is not necessary to reconfirm the user's intention, the system can avoid bothering the user by not sending a notification.

[0091] (1e) If the processing unit 71 determines in S105 that the comparison condition does not match the permission condition, it asks the user again whether or not to execute the first command. With this configuration, if the situation has changed since the last time the user permitted the application to run, the user's intention can be confirmed again.

[0092] (1f) In S107, the processing unit 71 also notifies the user of the reason why the application that issued the first command cannot be executed. With this configuration, the user can find out the reason why the application that issued the first command cannot be executed, and the user can decide whether or not to execute the application, taking the reason into consideration.

[0093] (1g) The processing unit 71 can configure whether or not to ask the user whether or not to execute an application when an application is added. Furthermore, even if the processing unit 71 determines that a notification asking whether or not to execute the application for which the first command was output in S105 has not yet been output, if it is pre-configured not to send a notification for that application, it can skip the process in S107 and change the settings so that no notification is sent. With this configuration, it is possible to configure settings that take into account whether or not a notification is appropriate. For example, for applications where real-time performance is required and waiting for a response to the notification before execution may degrade performance, it can be configured not to send a notification.

[0094] [2. Other Embodiments] While embodiments of this disclosure have been described above, it goes without saying that this disclosure is not limited to the embodiments described above and can take various forms.

[0095] (2a) In the above embodiment, a series of steps were described when a hazard light activation request is received from the service app 6. It was illustrated that when the car finder function is unnecessary, such as when the vehicle is in motion, and the unintended illumination of the hazard lights is inappropriate, it is determined that the action does not conform to the user's intentions. In other words, the above embodiment illustrated the case when the first command is input at a time unintended by the user. However, requests received from the service app 6 are not limited to hazard light activation requests. For example, the case when an air conditioner activation request is received from the service app 6, that is, when a first command with content unintended by the user is input, will be explained. Below, only the differences from the processing when a hazard light activation request is received from the service app 6 will be explained.

[0096] In S102, the processing unit 71 determines whether the new first command is a command indicating an air conditioner operation request. If the processing unit 71 determines in S102 that the new first command is a command indicating an air conditioner operation request, it proceeds to S103.

[0097] On the other hand, if the processing unit 71 determines in S102 that the new first command is not a command indicating an air conditioner operation request, it returns to S101.

[0098] In S103, the processing unit 71 determines, based on the vehicle status, whether the air conditioning operation request is in line with the user's intentions. More specifically, the processing unit 71 determines, based on the state of the air conditioning switch and the temperature inside the vehicle, whether the air conditioning operation request is in line with the user's intentions. For example, if the air conditioning switch is set to heating and the temperature inside the vehicle is 26 degrees, and an air conditioning operation request is received to switch to cooling set to 18 degrees, the processing unit 71 determines that the air conditioning operation request is not in line with the user's intentions.

[0099] If the processing unit 71 determines in S103 that the air conditioner operation request is in line with the user's intentions, it proceeds to S104. On the other hand, if the processing unit 71 determines in S103 that the air conditioner operation request is not in line with the user's intentions, it proceeds to S105.

[0100] In S104, the processing unit 71 outputs a second command based on the first command to the HVAC control unit 98 for controlling the air conditioner. Based on the second command, the HVAC control unit 98 executes control of the controlled object.

[0101] (2b) In the above embodiment, an example was given in which the processing unit 71 determines in S103 whether the first command is in line with the user's intention. However, the processing unit 71 may execute the process of S301 before the process of S103, as shown by the dotted line in Figure 3.

[0102] More specifically, in S301, the processing unit 71 may first perform processing as a safety determination unit to determine whether or not the vehicle's safety can be maintained when it receives the first command. In this case, the processing unit 71 may determine whether or not the vehicle's safety can be maintained when it receives the first command based on at least one of the vehicle equipment, vehicle condition, and vehicle environment.

[0103] Here, "maintaining vehicle safety" means prioritizing user safety, and the processing unit 71 will, for example, reject the first command to open the door while traveling at 100 km / h. If the processing unit 71 determines that vehicle safety is maintained when it receives the first command in S301, it may proceed to S103 and determine whether the first command is in line with the user's wishes.

[0104] On the other hand, if the processing unit 71 determines that the vehicle's safety cannot be maintained when it receives the first command in S301, it may skip subsequent processing and terminate the process. With this configuration, it is possible to determine whether or not to accept the first command by taking into account both the perspective of vehicle safety and the perspective of the user's intentions. Therefore, the application can be executed more safely and in accordance with the user's intentions. Note that the processing in S301 is a part of the processing in S103 that has been separated, and in the above embodiment, the processing in S301 is included in the processing in S103.

[0105] (2c) In the above embodiment, an example was given in which the processing unit 71 determines in S103 whether the first command is in line with the user's intention. However, as shown in Figure 5, the processing unit 71 may also perform the processing in S401 before the processing in S103 to determine whether the first command is a target for determination that should be determined in S103 as the reception determination unit.

[0106] The determination process in S401 corresponds to the determination unit for determining the target of determination in this disclosure. In this determination process, for example, if the first command is a data acquisition command for state recognition, or depending on the type of the first command or the applications 61-64 that input the first command, it may not be necessary to determine in S103 whether the first command is appropriate or not.

[0107] Therefore, in Figure 5, the determination process in S401 determines whether the first command is subject to determination in S103 based on the content and type of the first command. If the first command is not subject to determination in S401, the process in S103 is not executed, and the process proceeds to S104.

[0108] As a result, for example, for first commands from safety-related applications or applications requiring real-time performance, control such as hazard operation in S104 can be performed without executing the judgment process in S103, thereby improving the safety of the control.

[0109] (2d) The numerous ECUs 10 etc. and their methods described in this disclosure may be implemented by a dedicated computer provided by configuring a processor and memory programmed to implement one or more functions embodied by a computer program. Alternatively, the numerous ECUs 10 etc. and their methods described in this disclosure may be implemented by a dedicated computer provided by configuring a processor by one or more dedicated hardware logic circuits. Alternatively, the numerous ECUs 10 etc. and their methods described in this disclosure may be implemented by one or more dedicated computers configured by a combination of a processor and memory programmed to implement one or more functions and a processor configured by one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by the computer on a computer-readable non-transitional tangible recording medium. The methods for implementing the functions of each part included in the numerous ECUs 10 etc. do not necessarily need to include software, and all of their functions may be implemented using one or more hardware components.

[0110] (2e) Multiple functions of one component in the above embodiment may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Furthermore, some of the configurations of the above embodiment may be omitted. Furthermore, at least some of the configurations of the above embodiment may be added to or replaced with the configurations of other above embodiments.

[0111] (2f) In addition to the vehicle control system 1 described above, this disclosure can also be realized in various forms, such as an ECU 10 which is a component of the vehicle control system 1, a vehicle control program for causing the computer to function as the ECU 10, a non-transitional physical recording medium such as a semiconductor memory which stores this program, and a vehicle control method.

[0112] [Technical concepts disclosed in this specification] [Item 1] A vehicle control device that is mounted on a vehicle and configured to control the vehicle, The system includes a cooperation control unit (73) configured to enable cooperation between an application (61, 62, 63, 64) configured to provide services to the vehicle and a functional block (50) configured to perform predetermined processing in the vehicle, The functional block includes output units (51-59) configured to convert a first command, expressed in a vehicle-independent format and transmitted from the application, into a second command in a vehicle-dependent format, and output the second command to an operation control unit (91-99) for controlling the controlled object. The aforementioned cooperation control unit is configured to transfer the first command transmitted from the application to the functional block. Furthermore, the system includes a reception determination unit (75, S103) configured to determine whether the first command is in line with the user's intentions, If the reception determination unit determines that the first command does not conform to the user's intentions, the output control unit (77, S103) is configured to prevent the output unit from outputting the second command, A vehicle control device equipped with the following features. [Item 2] The vehicle control device described in item 1, The reception determination unit determines whether the first command is in line with the user's intentions based on at least one of the vehicle equipment, vehicle condition, and vehicle environment. A vehicle control device configured in such a way.

[0113] [Item 3] A vehicle control device as described in item 1 or item 2, If the reception determination unit determines that the first command does not conform to the user's intentions, the notification unit (S107) is configured to notify the user that the application that issued the first command cannot be executed, and in addition, to ask the user whether or not to execute the application that issued the first command. If permission is granted to execute the application in response to the aforementioned inquiry, regardless of the determination result by the reception determination unit, the output unit permits the output of the second command based on the first command, A vehicle control system further equipped with the following features.

[0114] [Item 4] The vehicle control device described in item 3, A notification setting unit (S204) is configured to allow setting whether or not to contact the user via the notification unit when adding the application. Furthermore, The notification unit changes whether or not to contact the user according to the settings made by the notification setting unit. A vehicle control device configured in such a way.

[0115] [Item 5] A vehicle control device as described in item 3 or item 4, In response to an inquiry by the notification unit, if the user is permitted to execute the application for which the first command was output, the storage unit (S106) is configured to store in memory the permission condition, which is at least one of the vehicle equipment, vehicle status, and vehicle environment at the time of permission. After the permission conditions are stored, a matching determination unit (S105) is configured to determine whether a comparison condition, which is at least one of the vehicle equipment, the vehicle condition, and the vehicle environment, matches the permission conditions when the first command relating to the application is input, Furthermore, If the matching determination unit determines that the comparison condition matches the permission condition, the notification unit will, without contacting the user, permit the output permission unit to output the second command based on the first command. A vehicle control device configured in such a way.

[0116] [Item 6] The vehicle control device described in item 5, If the matching determination unit determines that the comparison conditions do not match the permission conditions, The notification unit is configured to ask the user again whether or not to execute the first command.

[0117] [Item 7] A vehicle control device described in any one of items 3 to 6, The notification unit is configured to also notify the vehicle control device of the reason why the application that output the first command cannot be executed.

[0118] [Item 8] A vehicle control device described in any one of items 1 to 7, The reception determination unit further includes a safety determination unit (S301) that determines whether or not the safety of the vehicle can be maintained when the first command is received. The reception determination unit is configured to determine whether the first command is in line with the user's intentions when the safety determination unit determines that the safety of the vehicle can be maintained after receiving the first command.

[0119] [Item 9] A vehicle control device described in any one of items 1 to 8, The reception determination unit further includes a determination target determination unit (S401) that determines whether the first command transmitted from the application is subject to determination by the reception determination unit, The reception determination unit is configured to determine whether the first command conforms to the user's intentions when the determination target determination unit determines that the first command is the target of determination.

[0120] [Item 10] A vehicle control system comprising a plurality of electronic control devices (41-49) for controlling an object to be controlled which is equipment of a vehicle, and a vehicle control device (10) which is communicatively connected to the plurality of electronic control devices, The aforementioned vehicle control device is The system includes a cooperation control unit (73) configured to enable cooperation between an application (61, 62, 63, 64) configured to provide services to the vehicle and a functional block (50) configured to perform predetermined processing in the vehicle, The functional block includes an output unit (52) configured to convert a first command, expressed in a vehicle-independent format and transmitted from the application, into a second command in a vehicle-dependent format, and output it to the electronic control unit for controlling the controlled object. The aforementioned cooperation control unit is configured to transfer the first command transmitted from the application to the functional block. Furthermore, the system includes a reception determination unit (75, S103) configured to determine whether the first command is in line with the user's intentions, The system includes an output control unit (77, S103) configured to prevent the output unit from outputting a second command if the reception determination unit determines that the first command does not conform to the user's intentions, The at least one electronic control device is The system includes an object control unit (91-99) that receives the second command and controls the object to be controlled, A vehicle control system configured as follows.

[0121] [Item 11] A reception determination method performed by a vehicle control device mounted on a vehicle and configured to control the vehicle, When a first command is input from the application, a second command based on the first command is output to the operation control unit for controlling the controlled object (S104), Determining whether the first command is in line with the user's intentions (S103), If it is determined that the first command is not in line with the user's intentions, the second command will not be output (S103), A method for determining acceptance, including the acceptance criteria.

[0122] [Item 12] The computer installed in the vehicle, When a first command is input from the application, a function (S104) outputs a second command based on the first command to the operation control unit for controlling the controlled object. A function (S103) that determines whether the first command is in line with the user's intentions. If it is determined that the first command does not conform to the user's intentions, a function is provided to prevent the output of the second command (S103). A program to achieve this.

Claims

1. A vehicle control device that is mounted on a vehicle and configured to control the vehicle, The system includes a cooperation control unit (73) configured to enable cooperation between applications (61, 62, 63, 64) configured to provide services to the vehicle and a functional block (50) configured to perform predetermined processing in the vehicle. The functional block includes output units (51-59) configured to convert a first command, expressed in a vehicle-independent format and transmitted from the application, into a second command in a vehicle-dependent format, and output the second command to an operation control unit (91-99) for controlling the controlled object. The aforementioned cooperation control unit is configured to transfer the first command transmitted from the application to the functional block. Furthermore, the system includes a reception determination unit (75, S103) configured to determine whether the first command is in line with the user's intentions, If the reception determination unit determines that the first command does not conform to the user's intentions, the output control unit (77, S103) is configured to prevent the output unit from outputting the second command, If the reception determination unit determines that the first command does not conform to the user's intentions, the notification unit (S107) is configured to notify the user that the application that issued the first command cannot be executed, and in addition, to ask the user whether or not to execute the application that issued the first command. If permission is granted to execute the application in response to the aforementioned inquiry, regardless of the determination result by the reception determination unit, an output permission unit (S106) permits the output unit to output the second command based on the first command, A vehicle control device equipped with the following features.

2. A vehicle control device that is mounted on a vehicle and configured to control the vehicle, The system includes a cooperation control unit (73) configured to enable cooperation between applications (61, 62, 63, 64) configured to provide services to the vehicle and a functional block (50) configured to perform predetermined processing in the vehicle. The functional block includes output units (51-59) configured to convert a first command, expressed in a vehicle-independent format and transmitted from the application, into a second command in a vehicle-dependent format, and output the second command to an operation control unit (91-99) for controlling the controlled object. The aforementioned cooperation control unit is configured to transfer the first command transmitted from the application to the functional block. Furthermore, the system includes a reception determination unit (75, S103) configured to determine whether the first command is in line with the user's intentions based on the user's operation, If the reception determination unit determines that the first command does not conform to the user's intentions, the output control unit (77, S103) is configured to prevent the output unit from outputting the second command, Equipped with, The reception determination unit determines whether the first command conforms to the user's intentions by comparing the first command with at least one of the dynamically changing vehicle state and vehicle environment. A vehicle control device configured in such a way.

3. A vehicle control device according to claim 2, If the reception determination unit determines that the first command does not conform to the user's intentions, the notification unit (S107) is configured to notify the user that the application that issued the first command cannot be executed, and in addition, to ask the user whether or not to execute the application that issued the first command. If permission is granted to execute the application in response to the aforementioned inquiry, regardless of the determination result by the reception determination unit, an output permission unit (S106) permits the output unit to output the second command based on the first command, A vehicle control system further equipped with the following features.

4. A vehicle control device according to claim 1 or claim 3, A notification setting unit (S204) is configured to allow setting whether or not to contact the user via the notification unit when adding the application. Furthermore, The notification unit changes whether or not to contact the user according to the settings made by the notification setting unit. A vehicle control device configured in such a way.

5. A vehicle control device according to claim 1 or claim 3, In response to an inquiry by the notification unit, if the user is permitted to execute the application for which the first command was output, the storage unit (S106) is configured to store in memory a permission condition which is at least one of the vehicle state and vehicle environment at the time of permission, After the permission conditions are stored, a matching determination unit (S105) is configured to determine whether a comparison condition, which is at least one of the vehicle state and the vehicle environment at the time the first command relating to the application is input, matches the permission conditions. Furthermore, If the matching determination unit determines that the comparison condition matches the permission condition, the notification unit will, without inquiring with the user, permit the output permission unit to output the second command based on the first command. A vehicle control device configured in such a way.

6. A vehicle control device according to claim 5, If the matching determination unit determines that the comparison conditions do not match the permission conditions, The notification unit is configured to ask the user again whether or not to execute the first command.

7. A vehicle control device according to claim 1 or claim 3, The notification unit is configured to also notify the vehicle control device of the reason why the application that output the first command cannot be executed.

8. A vehicle control device according to claim 1 or claim 2, The reception determination unit further includes a safety determination unit (S301) that determines whether or not the safety of the vehicle can be maintained when the first command is received. The reception determination unit is configured to determine whether the first command is in line with the user's intentions when the safety determination unit determines that the safety of the vehicle can be maintained after receiving the first command.

9. A vehicle control device according to claim 1 or claim 2, The reception determination unit further includes a determination target determination unit (S401) that determines whether the first command transmitted from the application is subject to determination by the reception determination unit, The reception determination unit is configured to determine whether the first command conforms to the user's intentions when the determination target determination unit determines that the first command is the target of determination.

10. A vehicle control system comprising a plurality of electronic control devices (41-49) for controlling an object to be controlled which is equipment of a vehicle, and a vehicle control device (10) which is communicatively connected to the plurality of electronic control devices, The aforementioned vehicle control device is The system includes a cooperation control unit (73) configured to enable cooperation between applications (61, 62, 63, 64) configured to provide services to the vehicle and a functional block (50) configured to perform predetermined processing in the vehicle. The functional block includes an output unit (52) configured to convert a first command, expressed in a vehicle-independent format and transmitted from the application, into a second command in a vehicle-dependent format, and output it to the electronic control unit for controlling the controlled object. The aforementioned cooperation control unit is configured to transfer the first command transmitted from the application to the functional block. Furthermore, the system includes a reception determination unit (75, S103) configured to determine whether the first command is in line with the user's intentions, If the reception determination unit determines that the first command does not conform to the user's intentions, the output control unit (77, S103) is configured to prevent the output unit from outputting the second command, If the reception determination unit determines that the first command does not conform to the user's intentions, the notification unit (S107) is configured to notify the user that the application that issued the first command cannot be executed, and in addition, to ask the user whether or not to execute the application that issued the first command. If permission is granted to execute the application in response to the aforementioned inquiry, the output permission unit (S106) permits the output unit to output the second command based on the first command, regardless of the determination result by the reception determination unit, At least one of the plurality of electronic control devices is The system includes an object control unit (91-99) that receives the second command and controls the object to be controlled, A vehicle control system configured as follows.

11. A vehicle control system comprising a plurality of electronic control devices (41-49) for controlling an object to be controlled which is equipment of a vehicle, and a vehicle control device (10) which is communicatively connected to the plurality of electronic control devices, The aforementioned vehicle control device is The system includes a cooperation control unit (73) configured to enable cooperation between applications (61, 62, 63, 64) configured to provide services to the vehicle and a functional block (50) configured to perform predetermined processing in the vehicle. The functional block includes an output unit (52) configured to convert a first command, expressed in a vehicle-independent format and transmitted from the application, into a second command in a vehicle-dependent format, and output it to the electronic control unit for controlling the controlled object. The aforementioned cooperation control unit is configured to transfer the first command transmitted from the application to the functional block. Furthermore, the system includes a reception determination unit (75, S103) configured to determine whether the first command is in line with the user's intentions based on the user's operation, The system includes an output control unit (77, S103) configured to prevent the output unit from outputting the second command if the reception determination unit determines that the first command does not conform to the user's intentions, The reception determination unit is configured to determine whether the first command is in line with the user's intentions by comparing the first command with at least one of the dynamically changing vehicle state and vehicle environment. At least one of the plurality of electronic control devices is The system includes an object control unit (91-99) that receives the second command and controls the object to be controlled, A vehicle control system configured as follows.

12. A reception determination method performed by a vehicle control device mounted on a vehicle and configured to control the vehicle, When a first command is input from the application, a second command based on the first command is output to the operation control unit for controlling the controlled object (S104), Determining whether the first command is in line with the user's intentions (S103), If it is determined that the first command is not in line with the user's intentions, the second command is not output (S103), Including, and further, If it is determined that the first command does not conform to the user's intentions, the user is notified that the application that issued the first command cannot be executed, and in addition, the user is asked whether or not to execute the application that issued the first command (S107), If permission is granted to execute the application in response to the aforementioned inquiry, permission is granted to output the second command based on the first command to the operation control unit (S106), A method for determining acceptance, including the acceptance criteria.

13. A reception determination method performed by a vehicle control device mounted on a vehicle and configured to control the vehicle, When a first command is input from the application, a second command based on the first command is output to the operation control unit for controlling the controlled object (S104), The first command is determined by comparing it with at least one of the dynamically changing vehicle state and vehicle environment, and whether the first command is in line with the user's intentions based on the user's operation (S103). If it is determined that the first command is not in line with the user's intentions, the second command is not output (S103), A method for determining acceptance, including the acceptance criteria.

14. The computer installed in the vehicle, When a first command is input from an application, a function (S104) outputs a second command based on the first command to the operation control unit for controlling the controlled object. A function (S103) that determines whether the first command is in line with the user's intentions. If it is determined that the first command does not conform to the user's intentions, a function is provided to prevent the output of the second command (S103). If it is determined that the first command does not conform to the user's intentions, the system notifies the user that the application that issued the first command cannot be executed, and also provides a function to ask the user whether or not to execute the application that issued the first command (S107). If permission is granted to execute the application in response to the aforementioned inquiry, a function (S106) is provided to allow the output of the second command based on the first command to the operation control unit. A program to achieve this.

15. The computer installed in the vehicle, When a first command is input from an application, a function (S104) outputs a second command based on the first command to the operation control unit for controlling the controlled object. A function (S103) that determines whether the first command conforms to the user's intentions based on the user's operation by comparing the first command with at least one of the dynamically changing vehicle state and vehicle environment. If it is determined that the first command does not conform to the user's intentions, a function is provided to prevent the output of the second command (S103). A program to achieve this.

Images