vehicle

Abstract

In a vehicle capable of automatically executing some or all of the various driving controls necessary for driving without requiring driver intervention, the ability to forcibly stop some or all of the automatically executed controls at an appropriate time is provided. [Solution] The automatic driving control device installed in the vehicle comprises a driving mode setting unit and an automatic control unit. The driving mode setting unit sets the vehicle's driving mode to either a highly automated mode or a basic mode. When the driving mode is set to the highly automated mode, the automatic control unit automatically executes the automatic driving operations, which are driving operations that are set to be executed automatically, and stops at least one of the automatic driving operations being executed when a predetermined event requiring cancellation occurs.

Description

Cross - reference to related applications

[0001] This international application claims priority based on Japanese Patent Application No. 2014 - 234665 filed with the Japan Patent Office on November 19, 2014, and incorporates by reference the entire contents of Japanese Patent Application No. 2014 - 234665 into this international application.

Technical Field

[0002] [[ID=​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​Furthermore, as autonomous driving technology becomes more advanced, it is desirable to be able to take appropriate action against malfunctions in the on-board computer that enables autonomous driving. Specifically, when employing autonomous driving technology, it is desirable to be able to, if necessary, disable at least a part of the automatically executed controls and hand them over to the driver, or to forcibly control the vehicle's behavior in a safe direction.

[0007] In one aspect of this disclosure, it is desirable that in a vehicle capable of automatically executing at least a portion of the various driving controls necessary for driving without requiring driver intervention, at least a portion of the automatically executed controls be forcibly stopped at an appropriate time. [Means for solving the problem]

[0008] An automated driving control system in one aspect of this disclosure is mounted on a vehicle and comprises an ambient information acquisition unit, a driving mode setting unit, an automatic control unit, and a unit for determining events requiring deactivation. The surrounding information acquisition unit acquires surrounding information, which is information about the area around the vehicle. More specifically, surrounding information is information that indicates the state of the area around the vehicle, and is also information necessary to automatically perform multiple types of driving operations required for the vehicle to run without requiring driver intervention.

[0009] The driving mode setting unit sets the vehicle's driving mode to either the highly automated mode or the basic mode. The highly automated mode is a driving mode in which at least some of the above-mentioned multiple types of driving operations necessary for the vehicle's operation are automatically performed based on surrounding information. The basic mode is a mode in which the number of types of automated driving operations performed automatically is fewer than in the highly automated mode. The driving mode is zero.

[0010] The automatic control unit executes the automatic driving operations set for the driving mode based on the driving mode set by the driving mode setting unit. The cancellation event determination unit determines whether a predetermined cancellation event has occurred, at least when the driving mode is the highly automated mode. A cancellation event is a predetermined event that should cancel (stop execution of) at least one of the automatic driving operations that are set to be executed.

[0011] When the operating mode is set to at least the highly automated mode, if the deactivation event determination unit determines that a deactivation event has occurred, the automatic control unit will stop the execution of at least one of the automatic driving operations that are set to be performed.

[0012] With the automated driving control device configured in this way, if a cancellation event occurs when the driving mode is set to at least the highly automated mode (i.e., when it is set to execute at least one automated driving operation), at least one of the automated driving operations that would normally be executed will be canceled from execution and will no longer be executed by the automated control unit.

[0013] Therefore, even if an event requiring disengagement occurs that could cause the automated driving system to malfunction, it is possible to suppress unintended instability in the vehicle's movement. The automatic control unit may, when the driving mode is set to a driving mode that has at least one automatic driving operation to be performed, and the cancellation event determination unit determines that a cancellation event has occurred, stop all automatic driving operations that should be performed in that driving mode. In other words, if a cancellation event occurs, the automatic control unit will not perform any automatic driving operations. By doing so, even if a cancellation event occurs that could cause automatic driving operations to fail, it is possible to more reliably prevent the vehicle's driving from becoming unintentionally unstable.

[0014] The system may also include a notification unit and a release permission determination unit. The notification unit notifies the vehicle occupants that a release event has occurred when the release event determination unit determines that a release event has occurred. The release permission determination unit determines, after notification by the notification unit, whether a specific release permission action has been performed by the vehicle occupants. The automatic control unit may stop the execution of any automatic driving operations that should be stopped if the release permission determination unit determines that a release permission action has been performed. If the release permission determination unit does not determine that a release permission action has been performed, the automatic control unit may execute a predetermined automatic stop process to stop the vehicle from moving.

[0015] In this configured automated driving control system, when an event requiring deactivation occurs, the system does not unconditionally stop the automated driving operation, but instead provides prior notification. Then, if the vehicle occupants respond to that notification and indicate their intention to stop, the automated driving operation is stopped. In this way, it is possible to suppress the instability of the vehicle's driving state that can result from stopping the automated driving operation. [Brief explanation of the drawing]

[0016] [Figure 1] Figure 1A is a side view of the vehicle according to the embodiment, and Figure 1B is a top view of the vehicle according to the embodiment. [Figure 2] This is a block diagram showing the electrical configuration of a vehicle according to the first embodiment. [Figure 3] Figure 3A is an explanatory diagram showing the level of automatic operation for each driving mode, and Figure 3B is an explanatory diagram showing that the control content for each level of automatic operation may be set arbitrarily. [Figure 4] This is an explanatory diagram illustrating the basics of autonomous driving. [Figure 5] This is a flowchart for the process of setting the autonomous driving level. [Figure 6] Figure 5 is a flowchart showing the details of the automatic driving deactivation confirmation process in the automatic driving level setting process. [Figure 7]A flowchart showing details of the system monitoring process in the automatic driving cancellation confirmation process of FIG. 6. [Figure 8] A flowchart showing details of the internal and external behavior monitoring process in the automatic driving cancellation confirmation process of FIG. 6. [Figure 9] A flowchart showing details of the environmental monitoring process in the automatic driving cancellation confirmation process of FIG. 6. [Figure 10] FIG. 10A is a flowchart of the driving history recording process, and FIG. 10B is a flowchart showing details of the self-diagnosis process in the automatic driving cancellation confirmation process of FIG. 6. [Figure 11] A block diagram showing the electrical configuration of the vehicle of the second embodiment. [Figure 12] A flowchart of the control state monitoring process of the second embodiment.

Embodiments for Carrying Out the Invention

[0017] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings. [First Embodiment] (1) Configuration of Vehicle 1 FIG. 1A shows a side view of vehicle 1 of the present embodiment, and FIG. 1B shows a top view of the vehicle 1. However, FIGS. 1A and 1B are mainly for clearly showing the arrangement states of various cameras, radars, sensors, etc. in vehicle 1, and illustrate those arrangement states simply.

[0018] As shown in FIGS. 1A and 1B, vehicle 1 includes at least a front camera 2, a rear camera 3, a left side camera 4, a right side camera 5, and an in-vehicle camera 6 as cameras for photographing the inside and outside of the vehicle 1. Each of the cameras 2 to 6 is a camera capable of photographing color images and videos. Each of the cameras 2 to 6 may be a monocular camera or a stereo camera having a plurality of lenses and capable of obtaining information in the depth direction.

[0019] The front camera 2 is mounted on the front end of the ceiling inside the vehicle interior, facing forward. This front camera 2 allows for wide-area imaging of the area in front of the vehicle 1. The rear camera 3 is mounted on the rear end of the ceiling inside the vehicle interior, facing rearward. This rear camera 3 allows for wide-area imaging of the area behind the vehicle 1.

[0020] The left-side camera 4 is mounted on the left side of vehicle 1, facing left. This left-side camera 4 allows for wide-area imaging of the left side of vehicle 1. The right-side camera 5 is mounted on the right side of vehicle 1, facing right. This right-side camera 5 allows for wide-area imaging of the right side of vehicle 1.

[0021] The interior camera 6 is mounted on the front end of the ceiling inside the vehicle, facing backward (into the vehicle interior). This interior camera 6 can capture at least the upper body of the driver inside the vehicle.

[0022] Furthermore, as shown in Figures 1A and 1B, Vehicle 1 is equipped with a forward radar device 11, a rear radar device 12, a left-side radar device 13, and a right-side radar device 14. In this embodiment, each of the radar devices 11 to 14 is a millimeter-wave radar. As is well known, a millimeter-wave radar is a radar that transmits millimeter-wave radio waves and receives the reflected waves with multiple receiving antennas, thereby detecting target information about targets around Vehicle 1 based on the relationship between the transmitted wave and each received wave, and the relationships between each received wave. Target information that can be detected by each of the radar devices 11 to 14 includes the presence or absence of a target in the detection direction, the distance to the target, the direction of the target relative to Vehicle 1, and the speed of movement of the target (relative speed to Vehicle 1).

[0023] Specifically, the forward radar device 11 is installed at the front end of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the front of the vehicle 1. This forward radar device 11 allows for the acquisition of target information regarding targets in front of the vehicle 1. The rear radar device 12 is installed at the rear end of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the rear of the vehicle 1. This rear radar device 12 allows for the acquisition of target information regarding targets behind the vehicle 1. The left-side radar device 13 is installed on the left side of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the left side of the vehicle 1. This left-side radar device 13 allows for the acquisition of target information regarding targets to the left side of the vehicle 1. The right-side radar device 14 is installed on the right side of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the right side of the vehicle 1. This right-side radar device 14 allows for the acquisition of target information regarding targets to the right side of the vehicle 1.

[0024] Furthermore, as shown in Figures 1A and 1B, Vehicle 1 is equipped with a solar radiation sensor 16 and a rainfall sensor 17. The solar radiation sensor 16 is installed at the bottom of the front windshield 9 at the front of the vehicle interior. This solar radiation sensor 16 can detect the amount of solar radiation on Vehicle 1, and consequently the brightness around Vehicle 1. The rainfall sensor 17 is installed at the top of the front windshield 9 on the interior side of the vehicle interior. This rainfall sensor 17 can detect the presence or absence of rainfall and the amount of rainfall.

[0025] (2) Electrical configuration of vehicle 1 The electrical configuration of Vehicle 1 will be explained in detail using Figure 2. As shown in Figure 2, Vehicle 1 is equipped with an automatic driving control device 30. The automatic driving control device 30 mainly has a mode switching function and an automatic driving function. The mode switching function is a function that sets the driving mode of Vehicle 1 to either the highly automated mode or the basic mode. The automatic driving function is a function that performs automatic driving according to the automatic driving level of the set driving mode (see Figure 3A; details will be described later). As will be described later, the automatic driving control device 30 appropriately switches the driving mode of Vehicle 1 according to various factors such as the driving state of Vehicle 1, the surrounding conditions of Vehicle 1, and the state of the driver of Vehicle 1.

[0026] There are different types of autonomous driving systems for vehicles, including partially autonomous driving and fully autonomous driving. Partial autonomous driving is a form of autonomous driving where some of the various driving actions required by the driver to operate the vehicle are automated. Here, automation means that the actions can be performed without requiring any driver intervention. Fully autonomous driving is a form of autonomous driving where the entire journey to the set destination is automated without requiring any driver intervention. The parameter that indicates the degree to which the types and number of driving actions are automated in autonomous driving is called the autonomous driving level. Fully autonomous driving has a higher autonomous driving level than partially autonomous driving. Furthermore, even within partially autonomous driving, there are various levels depending on the types and number of driving actions that are automated.

[0027] In this embodiment, the vehicle 1 is configured to enable not only partially automated driving but also fully automated driving through the automatic driving control device 30. In this embodiment, the driver can arbitrarily change the level of automated driving, that is, which of the various driving operations necessary for driving are automated and which are performed by the driver.

[0028] More specifically, in this embodiment, there are seven main automatic control functions for achieving fully autonomous driving: automatic start / stop control, lane keeping control, distance control, lane change control, right / left turn control, collision prevention control, and parking control. The autonomous driving control device 30 is capable of executing these seven types of automatic control functions, and fully autonomous driving can be achieved by executing all seven types of automatic control functions.

[0029] Conversely, partial autonomous driving can be achieved by executing any six or fewer of the seven types of automatic control functions described above. In this embodiment, it is possible to arbitrarily set which of the seven types of automatic control functions to execute in the highly automated mode.

[0030] The specific details of the seven types of automatic control functions will be explained in more detail later. The level of autonomous driving increases with the number of the seven types of automatic control functions that are executed. Specifically, the level of autonomous driving when none of the seven types of automatic control functions are executed is level 0. The level of autonomous driving when n types of the seven types of automatic control functions are executed is level n. Therefore, in the level 0 driving mode, the driver must judge and operate the control actions corresponding to the seven types of automatic control functions themselves. On the other hand, the driving modes from level 1 to level 6 are driving modes in which partial autonomous driving is performed. The driving mode of level 7 is the driving mode in which fully autonomous driving is performed.

[0031] In this embodiment, the highly automated mode is a driving mode in which automated driving is performed at an automated driving level of Level 1 or higher. On the other hand, the basic mode is a driving mode in which the automated driving level is relatively lower than that of the highly automated mode. For example, if the highly automated mode is at level n, the basic mode can be set to any level from n-1 to level 0.

[0032] In this embodiment, for the sake of simplicity and clarity, the basic mode will be described as being set to automatic driving level 0. Level 0 is the level in which none of the seven types of automatic control functions described above are executed, and the driver must perform most of the various driving operations necessary for driving.

[0033] The automatic driving control device 30 includes a control unit 30a and a memory 30b. The memory 30b specifically includes ROM, RAM, and various other storage media (e.g., EEPROM, flash memory). The control unit 30a implements various functions, including the mode switching function and automatic driving function described above, by executing various programs stored in the memory 30b. The control unit 30a includes at least a CPU.

[0034] The various programs stored in memory 30b include a program (so-called security software) capable of detecting unauthorized external operations, computer viruses, malicious software and data (hereinafter collectively referred to as "malicious factors"). The control unit 30a monitors for the presence of malicious factors at all times by keeping this security software resident while it is running. If malicious factors occur, it executes various malicious countermeasures. Malicious countermeasures include a process that forcibly sets the automatic driving level to level 0 and disables all automatic control functions. In addition, various specific contents of malicious countermeasures are conceivable. For example, it may output a warning to the driver by voice or the like, or it may forcibly decelerate or stop vehicle 1. Furthermore, the connection between the control unit 30a and each communication unit 31-35 may be physically blocked to prevent external access to the automatic driving control device 30 via wireless communication.

[0035] The automatic driving control device 30 is connected to the cameras 2-6, radar devices 11-14, and sensors 21-23 shown in Figures 1A and 1B. The control unit 30a of the automatic driving control device 30 individually controls the operation of each camera 2-6 and acquires the shooting results (image data) from each camera 2-6 and stores them in the memory 30b. The acquisition and storage of image data is repeated at predetermined intervals.

[0036] The control unit 30a can recognize various conditions inside and outside the vehicle based on the image data from each of the cameras 2 to 6. For example, from the image data of the interior camera 6, it can recognize the actions, facial expressions, gaze, and eye condition of the occupants (mainly the driver).

[0037] This allows the control unit 30a to determine whether the driver is exhibiting abnormal behavior based on the image data from the indoor camera 6. Abnormal behavior of the driver, in this context, refers to the driver's behavior. This means that either the driver is unable to operate vehicle 1 properly, or the driver is feeling uneasy about the operation of vehicle 1 due to the autonomous driving function not working correctly. Specific examples of the former include being distracted, falling asleep, or fainting. Specific examples of the latter include the driver showing signs of surprise, worry, or fear.

[0038] Furthermore, based on the image data from the front camera 2, the control unit 30a can recognize the vehicle ahead, oncoming vehicles, vehicles in adjacent lanes traveling diagonally ahead, lane markings, pedestrian crossings, pedestrians, intersections, other vehicles entering intersecting roads at intersections, the contents of road signs, traffic lights, and billboards in the direction of travel, rainfall conditions, snowfall conditions, fog conditions, ambient brightness, and other objects around the vehicle through various image recognition processes. Recognizable road signs also include letters and marks painted on the road surface.

[0039] As a result, the control unit 30a can recognize pedestrian behavior, pedestrian behavior and gaze, whether or not oncoming vehicles are flashing their headlights, and weather conditions based on image data from the front camera 2. More specifically regarding weather conditions, it can recognize if there is more than a certain amount of rain or snow, or if dense fog is present. From pedestrian behavior, it can recognize whether or not pedestrians feel uneasy about vehicle 1. More specifically, if a pedestrian is looking at vehicle 1 and their facial expression shows a specific emotion such as surprise, worry, or fear, it can be determined that the pedestrian feels uneasy about vehicle 1. In addition, if a predetermined number or more pedestrians are looking at vehicle 1, it can be recognized that there is a possibility that vehicle 1 is not operating properly.

[0040] Furthermore, the control unit 30a can recognize the distance and relative speed to the vehicle ahead, the vehicle's driving status relative to the road, and the content of road signs and billboards based on the image data from the front camera 2. Therefore, based on the recognition results of the content of road signs and billboards, it can recognize various sign information such as speed limits, whether a stop is required, and whether parking is permitted. It can also recognize, for example, areas prone to accidents, school zones, and other specific environments (for example, areas with a high frequency of animal sightings).

[0041] Furthermore, the control unit 30a can recognize rear vehicles, vehicles in adjacent lanes traveling diagonally behind the vehicle, ambient brightness, pedestrians, road signs, and other objects around the vehicle through various image recognition processes based on the image data from the rear camera 3.

[0042] As a result, the control unit 30a can recognize, for example, the relative distance and relative speed between the vehicle and the vehicle behind, and whether or not the vehicle behind is flashing its headlights, based on the image data from the rear camera 3. In addition, similar to the image data from the front camera 2, the image data from the rear camera 3 can also be used to recognize pedestrian behavior, pedestrian behavior and gaze, and weather conditions.

[0043] Furthermore, based on the image data from the left-side camera 4 and the right-side camera 5, the control unit 30a can recognize vehicles to the sides of the vehicle (including vehicles to the left front, left rear, right front, and right rear), road signs on the side of the road the vehicle is traveling on, lane markings, pedestrians, ambient brightness, and other objects around the vehicle through various image recognition processes.

[0044] As a result, the control unit 30a can recognize, for example, the relative distance and relative speed between the vehicle and the adjacent vehicle based on the image data from each of the side cameras 4 and 5. In addition, similar to the image data from the front camera 2, the image data from each of the side cameras 4 and 5 can be used to recognize pedestrian behavior, pedestrian behavior and gaze, weather conditions, and so on.

[0045] Furthermore, the control unit 30a of the automatic driving control device 30 individually controls each radar device 11-14, and acquires target detection results from each radar device 11-14 and stores them in the memory 30b. The detection results from each radar device 11 to 14 are acquired and stored repeatedly at predetermined intervals. Based on the detection results from each radar device 11 to 14, the control unit 30a can calculate and acquire information such as the presence or absence of a target, the distance to the target, the direction of the target, and the relative speed of the target as seen from the vehicle 1.

[0046] Furthermore, the detection results from the forward radar device 11 primarily provide information on targets in front of the vehicle (including diagonally to the left and right). The detection results from the rear radar device 12 primarily provide information on targets in the rear of the vehicle (including diagonally to the left and right). The detection results from the left-side radar device 13 primarily provide information on targets on the left side of the vehicle (including the left front and left rear). The detection results from the right-side radar device 14 primarily provide information on targets on the right side of the vehicle (including the right front and right rear).

[0047] Furthermore, the control unit 30a of the automatic driving control device 30 can determine the brightness of the driving environment based on the detection signal from the solar radiation sensor 16, and determine whether it is nighttime or a similar situation (hereinafter simply referred to as "nighttime"). The vehicle 1 is equipped with headlights (not shown). The headlights can be turned on and off by the driver, and can also be turned on and off automatically by setting the light mode to auto mode. When the light mode is set to auto mode, the control unit 30a automatically turns on the headlights if it determines that it is nighttime based on the detection signal from the solar radiation sensor 16, and automatically turns off the headlights if it is not nighttime. In addition, in this embodiment, when the driving mode is set to highly automated mode, the light mode is forcibly set to auto mode.

[0048] Furthermore, the control unit 30a of the automatic driving control device 30 can determine the presence or absence of rainfall and the amount of rainfall based on the detection signal from the rainfall sensor 17. In addition, as shown in Figure 2, the vehicle 1 is equipped with a wheel speed sensor 18, a current sensor 19, a steering amount sensor 20, an in-vehicle contact sensor 21, an engine room temperature sensor 22, an engine room sound sensor 23, a tire pressure sensor 24, a suspension sensor 25, an external sound sensor 26, and an impact sensor 27 as components connected to the automatic driving control device 30.

[0049] The wheel speed sensors 18 are installed on each of the four wheels of the vehicle 1 (front, rear, left, and right) and output a detection signal (wheel speed signal) indicating the rotational speed of the corresponding wheel. The wheel speed signals from each wheel speed sensor 18 are input to the automatic driving control device 30.

[0050] The control unit 30a can detect the rotational speed of each wheel based on the wheel speed signals from each wheel speed sensor 18. Based on the detection results, it can then determine, for example, whether or not slippage is occurring.

[0051] The current sensor 19 is provided for one or more of the numerous electrical wires installed in the vehicle 1, and outputs a detection signal (current detection signal) indicating the current flowing through that electrical wire. The current detection signal from the current sensor 19 is input to the automatic driving control device 30.

[0052] The control unit 30a can detect the current in the corresponding electrical wiring based on the current detection signal from the current sensor 19. From the detection result, it can then detect, for example, whether or not an overcurrent is flowing in a particular electrical wiring. An overcurrent, in this context, is a large current that would theoretically not flow when the vehicle 1 is operating normally, and could be, for example, a large current or surge current that may be caused by a lightning strike.

[0053] Alternatively, the current sensor 19 may be installed on the body of the vehicle 1 to detect the current flowing through the vehicle. In this way, if lightning strikes the vehicle 1, the current will be transmitted through the vehicle 1 to the ground. It can detect large currents flowing through it. The location and method of installing the current sensor 19 may be determined as appropriate so as to enable detection of lightning strikes on vehicle 1.

[0054] The steering amount sensor 20 is provided to directly or indirectly detect the amount of steering of the steering wheel. The steering amount sensor 20 may be provided, for example, on the column shaft connecting the steering wheel 10 (see Figures 1A and 1B) and the steering mechanism. However, the vehicle 1 in this embodiment is equipped with an electric power steering system that can control the steering of the steering wheel by a motor, and is equipped with a rotation sensor for detecting the rotational position (and thus the steering state) of the motor for steering control. Therefore, the steering amount sensor 20 may not be provided separately, and the rotation sensor may be used as the steering amount sensor 20. In other words, the specific configuration and installation location of the steering amount sensor 20 may be determined as appropriate so as to enable the detection of the steering amount.

[0055] The control unit 30a can detect the steering amount of the steering wheels based on the detection signal from the steering amount sensor 20. From the detection result, it can then detect, for example, the state of change or rate of change of the steering amount. This allows it to determine whether the automatic steering control is being performed appropriately when the driving level is set to one in which steering is performed automatically (i.e., when the driving level is set to one in which at least one of lane keeping control, lane change control, and right / left turn control is performed). Specifically, for example, if the rate of change of the steering amount is greater than a predetermined value (i.e., the rate of change is excessive), it can be determined that the automatic steering control is not being performed properly. Alternatively, if the vehicle is not driving along the lane (e.g., crossing the lane markings) or if it is going straight when it should be turning right or left, it can also be determined that the automatic steering control is not being performed properly.

[0056] The in-vehicle contact sensor 21 is a sensor for detecting when an occupant of the vehicle 1 touches a specific part inside the vehicle, and is installed at that specific part (hereinafter also referred to as the "specific in-vehicle contact area"). The specific in-vehicle contact area can be determined as appropriate, and examples include a specific part of the driver's seat, the steering wheel 10 or its vicinity.

[0057] As will be described later, the in-vehicle contact sensor 21 is provided to allow the driver to quickly (emergently) deactivate the automated driving system when the automated driving level of vehicle 1 is set to level 1 or higher. In other words, if the driver wants to deactivate the automated driving system for any reason when the automated driving level is level 1 or higher, the automated driving system will be forcibly deactivated if the driver touches a specific contact area inside the vehicle. Therefore, the specific configuration and installation location of the in-vehicle contact sensor 21 may be determined appropriately so as to detect when the driver touches a specific contact area inside the vehicle.

[0058] In this embodiment, "deactivating" autonomous driving means setting the autonomous driving level to level 0. However, this is merely one example. For example, "deactivating" autonomous driving could be defined as stopping at least one of the currently running automatic control functions. For example, if a driver senses that an automatic control function may not be functioning correctly while it is active and touches a specific contact area inside the vehicle, "deactivating" autonomous driving could be defined as forcibly stopping one or more automatic control functions, including at least that function.

[0059] The engine compartment temperature sensor 22 is installed in a predetermined location inside or near the engine compartment of the vehicle 1 and outputs a detection signal corresponding to the temperature of the engine compartment. The control unit 30a can detect the temperature of the engine compartment based on the detection signal from the engine compartment temperature sensor 22. If the detected temperature of the engine compartment is excessive (for example, above a predetermined temperature threshold), the control unit 30a can determine that some kind of abnormality has occurred in the engine or its surroundings.

[0060] The engine compartment sound sensor 23 is installed in or near the engine compartment of the vehicle 1 at a predetermined location, primarily for the purpose of detecting sounds generated within the engine compartment, and outputs a detection signal corresponding to the volume of sound in the surrounding area. The control unit 30a can detect sounds generated within the engine compartment based on the detection signal from the engine compartment sound sensor 23. If the detected sound within the engine compartment is excessive (for example, above a predetermined volume threshold), the control unit 30a can determine that some kind of abnormality is occurring in the engine or its surroundings.

[0061] The tire pressure sensors 24 are installed on each of the four wheels of the vehicle 1 (front, rear, left, and right) and output a detection signal (air pressure signal) indicating the air pressure of the corresponding wheel's tire. The air pressure signals from each tire pressure sensor 24 are input to the automatic driving control device 30.

[0062] The control unit 30a can detect the air pressure of each wheel's tire based on the air pressure signals from each tire pressure sensor 24. From the detection results, it can then determine, for example, whether or not an abnormality (e.g., a puncture) has occurred in any of the tires.

[0063] The suspension sensor 25 outputs a detection signal indicating the amount of extension or contraction of the suspension of the vehicle 1 (for example, the amount of extension or contraction of the shock absorber or spring). Based on the detection signal from the suspension sensor 25, the control unit 30a can detect the behavior of the vehicle 1 (mainly vertical behavior). When the automatic driving level of the vehicle 1 is set to level 1 or higher, if the automatic control function being executed is not working properly, the behavior of the vehicle 1 may become unstable. For example, unstable behaviors such as sudden acceleration, sudden braking, and sudden turns may occur automatically. Such unstable behaviors manifest as suspension behavior. Therefore, based on the detection signal from the suspension sensor 25 (i.e., based on the amount of extension or contraction of the suspension itself or its rate of change), the control unit 30a can determine the stability of the behavior of the vehicle 1, and consequently, if the automatic control function is operating, it can determine whether or not that automatic control function is working properly.

[0064] The external sound sensor 26 is primarily intended to detect sounds occurring around the vehicle 1. Based on the detection signal from the external sound sensor 26, the control unit 30a can detect the type and volume of sounds occurring around the vehicle 1. For example, it can detect if another vehicle is honking its horn.

[0065] The impact sensor 27 outputs a detection signal corresponding to the level of impact when an impact is applied to the vehicle 1 from outside the vehicle 1. Based on the detection signal from the impact sensor 27, the control unit 30a can detect the presence and level of an external impact on the vehicle 1. The impacts detected by the impact sensor 27 include a wide range of impact levels, from relatively large impacts such as collisions with other vehicles or road structures to relatively low impacts such as impacts caused by a person outside the vehicle 1 hitting the vehicle 1.

[0066] Furthermore, as shown in Figure 2, the vehicle 1 is equipped with a GPS communication unit 31, a vehicle-to-vehicle communication unit 32, a vehicle-to-infrastructure communication unit 33, a vehicle-to-pedestrian communication unit 34, and an LTE communication unit 35 as components connected to the automatic driving control device 30.

[0067] The GPS communication unit 31 receives radio waves from multiple GPS (Global Positioning System) satellites and outputs the information (GPS information) contained in these received radio waves to the automatic driving control device 30. The control unit 30a of the automatic driving control device 30 can calculate the current position of the vehicle 1 based on the information received by the GPS communication unit 31.

[0068] Furthermore, the automatic driving control device 30 is equipped with a route guidance function, which is one of the various elemental functions for realizing the automatic driving function. The route guidance function calculates an appropriate route from the current position to the destination based on the current position of the vehicle 1 calculated based on GPS information and the destination set by the driver, and guides and controls the vehicle 1 so that it travels along that route to the destination.

[0069] The route guidance function includes functions to recognize the road conditions around vehicle 1 (for example, the shape of the route to the destination and the width of the vehicle), and functions to recognize the presence and operating status of infrastructure in the direction of travel (for example, the status of traffic lights in the direction of travel, the presence or absence of intersections, the presence or absence of pedestrian crossings, speed limits and regulatory information). The control unit 30a uses these various recognition results to realize the above guidance control.

[0070] The content of the guidance control for vehicle 1 in the route guidance function differs depending on the level of autonomous driving. For example, when the autonomous driving level is set to level 7, which is fully autonomous driving, the guidance control involves providing route information (information on which direction and route the vehicle should travel) necessary for the execution of multiple types of automatic control functions (seven types as described above in this embodiment) that are necessary for achieving fully autonomous driving. Also, for example, when the autonomous driving level is set to a predetermined level 1 to 6 (partially autonomous driving) which is lower than fully autonomous driving, the guidance control involves providing route information for the automatic control functions necessary for partially autonomous driving among the multiple types of automatic control functions, and providing guidance on the driving route to the driver as needed (e.g., voice guidance).

[0071] If the automatic driving level is set to any of levels 1 to 6, that is, if one or more of the seven types of automatic control functions are set to be executed, the control unit 30a provides, as guidance control, at least the information necessary for the set automatic control function.

[0072] Map data and other various data necessary for the route guidance function are stored in memory 30b. The control unit 30a executes the program for the route guidance function stored in memory 30b while referring to these various data, thereby realizing the route guidance function (i.e., the guidance control described above).

[0073] The vehicle-to-vehicle communication unit 32 is a communication module for wirelessly sending and receiving various data with other vehicles besides its own vehicle. The control unit 30a of the automatic driving control device 30 can acquire information about other surrounding vehicles (e.g., direction of travel, speed, position, etc.) via the vehicle-to-vehicle communication unit 32. Conversely, it can also transmit information about its own vehicle 1 to other vehicles.

[0074] The control unit 30a can also determine the relative relationship between its own vehicle and other vehicles by acquiring the position and driving status of other vehicles through vehicle-to-vehicle communication. For example, it can detect the relative distance and relative speed between its own vehicle and other vehicles.

[0075] Furthermore, information that can be transmitted and received via vehicle-to-vehicle communication includes information regarding the driving mode. The control unit 30a can also transmit and receive information such as whether the driving mode is set to the highly automated mode or the basic mode, and what level of automated driving is set for that driving mode.

[0076] The vehicle-to-infrastructure communication unit 33 is a communication module for receiving various types of information wirelessly transmitted from a roadside communication device 81 (see Figure 4) installed on the road (ground side). The various types of information received by the vehicle-to-infrastructure communication unit 33 are input to the automatic driving control device 30.

[0077] The street communication device 81 is connected to a server (not shown) and receives various information from that server. The information is transmitted wirelessly within a designated area. The server aggregates various types of road traffic information, such as infrastructure information (e.g., traffic light information, road regulation information, and other information related to the road) and information about the presence of other vehicles and pedestrians. Based on the aggregated road traffic information, the server transmits individual road information related to each road communication device 81. The individual road information is information targeting vehicles traveling within the communication area of ​​the road communication device 81, and includes various types of road traffic information within that communication area, as well as various types of simultaneous traffic information beyond that area (in the direction of travel). Each road communication device 81 wirelessly transmits the individual road information received from the server within a designated communication area.

[0078] The control unit 30a of the automatic driving control device 30 can acquire various road traffic information regarding the road around the vehicle and in the direction of travel via the vehicle-to-infrastructure communication unit 33. The information that the control unit 30a can acquire via the vehicle-to-infrastructure communication unit 33 includes section information regarding sections where driving requires caution (hereinafter also referred to as "cautionary sections"), such as accident-prone areas, school zones, and areas where animals appear. By linking the acquired section information with the route guidance function, the control unit 30a can recognize the relative relationship between the cautionary section and the vehicle 1, such as whether the vehicle 1 is currently driving in a cautionary section indicated by the section information, and how much further it will be before entering the cautionary section. It is also possible to acquire information about other sections or locations other than cautionary sections as section information.

[0079] Each roadside communication device 81, as illustrated in Figure 4, is equipped with a camera 82. Each camera 82 takes a picture of the road and transmits the captured data to a server via the network.

[0080] The server can obtain road traffic information around each camera from the image data transmitted from each camera 82. Specifically, the server can recognize the shape of the road, the lanes, and the status of traffic lights from the image data. The server can also recognize the driving status and license plate number of vehicles in motion. Furthermore, the server can determine whether the vehicles in the image data are driving normally based on the image data. For example, if a vehicle passes through a red light without stopping, the server can determine that the vehicle is not driving normally.

[0081] Furthermore, vehicle 1 can transmit various information regarding its status via the vehicle-to-infrastructure communication unit 33. The transmitted information from vehicle 1 is received by the roadside communication device 81 and aggregated on the server. The server can individually recognize and manage the status of multiple vehicles, including vehicle 1, and can, if necessary, notify a specific vehicle of the status of other vehicles. Therefore, for example, it can learn what level of autonomous driving is set for other vehicles around the vehicle, that is, to what extent the automatic control function is operating for other surrounding vehicles.

[0082] The pedestrian-vehicle communication unit 34 is a communication module for wireless communication with a communication terminal (e.g., a mobile phone or smartphone) held by a pedestrian on the ground. If the communication terminal held by the pedestrian is configured to wirelessly transmit terminal location information indicating the location of the communication terminal (i.e., the pedestrian's location), the pedestrian-vehicle communication unit 34 can receive the terminal location information transmitted from that communication terminal. The terminal location information received by the pedestrian-vehicle communication unit 34 is input to the automatic driving control device 30. The automatic driving control device 30 can also inform pedestrians of the location information of vehicle 1, etc., by wirelessly transmitting various information, such as the location information of vehicle 1, from the pedestrian-vehicle communication unit 34 to the pedestrian's communication terminal.

[0083] The control unit 30a of the automatic driving control device 30 can determine the location and movement of pedestrians based on terminal location information received via the vehicle-pedestrian communication unit 34. The presence and movement of pedestrians are already known. While detection can be performed using the cameras and radar devices described above, the presence or absence of pedestrians and the sudden appearance of pedestrians can also be detected from information obtained via the vehicle-pedestrian communication unit 34.

[0084] The LTE communication unit 35 is a communication module for realizing wireless communication using LTE, a well-known mobile phone communication standard. The control unit 30a can acquire various information necessary for the autonomous driving of vehicle 1 and update existing information (for example, map data) via the LTE communication unit 35 (i.e., via LTE wireless communication). It is not mandatory to acquire or update such information via LTE wireless communication, and other wireless communication methods may be used instead.

[0085] Furthermore, as components connected to the automatic driving control device 30, the vehicle 1 includes, as shown in Figure 2, an operation unit 36, a display unit 37, a speaker 38, an automatic driving switch 41, a level setting operation unit 42, an emergency stop lever 43, and a release reset switch 44.

[0086] The control unit 36 ​​is an input interface for receiving various input operations on the vehicle 1 from the occupants of the vehicle 1, including the driver. The display unit 37 is an output interface for visually providing various information to the occupants of the vehicle 1, including the driver. Various information, including map information in the route guidance function, is also displayed on the display unit 37. The speaker 38 outputs sound based on various voice signals output from the automatic driving control device 30.

[0087] The automatic driving switch 41 is a switch used to set the driving mode of vehicle 1 to the highly automated mode. In order for the driver of vehicle 1 to set the driving mode to the highly automated mode and perform automatic driving, the driver of vehicle 1 needs to switch the automatic driving switch 41 to the ON position. On the other hand, when the automatic driving switch 41 is switched to the OFF position, the driving mode is set to the basic mode.

[0088] The emergency stop lever 43 is an operating means for forcibly disengaging automatic driving when the automatic driving level of vehicle 1 is level 1 or higher (i.e., forcibly switching the automatic driving level to level 0), and is installed in a predetermined location inside the vehicle (for example, on the ceiling). When the emergency stop lever 43 is operated while the automatic driving level of vehicle 1 is set to level 1 or higher, automatic driving is forcibly disengaged. If the driver recognizes that an unauthorized factor such as a computer virus or unauthorized operation has occurred, or if the driver recognizes that the automatic control function is not working properly, the driver can forcibly disengage automatic driving by operating the emergency stop lever 43 and drive vehicle 1 under their own driving control.

[0089] The level setting operation unit 42 is a user interface for receiving operations from the driver to set the autonomous driving level (details will be described later). The release reset switch 44 is a switch used to reset the release state after automatic driving has been forcibly released and the automatic driving level has been forcibly set to level 0. In this embodiment, as will be described later, when the automatic driving level is set to level 1 or higher, if a predetermined event requiring release occurs that should release automatic driving, automatic driving is forcibly released. Specifically, the automatic driving release flag, which will be described later, is set.

[0090] When automatic driving is forcibly deactivated, the deactivated state is maintained in principle (the set state of the automatic driving deactivation flag is maintained). However, the deactivation state can be reset (the automatic driving deactivation flag is reset) by pressing the deactivation reset switch 44. When the deactivation state is reset, the driving mode is set to the mode corresponding to the operation state of the automatic driving switch, and the automatic driving level is set to the level corresponding to the set driving mode (the level set by the level setting operation unit 42).

[0091] Furthermore, as shown in Figure 2, the vehicle 1 includes a driving control unit 46, a brake control unit 47, and a steering control unit 48 as components connected to the automatic driving control device 30.

[0092] The driving control unit 46 controls the driving of vehicle 1 by controlling the engine and transmission (not shown) based on various information such as the amount the accelerator pedal (not shown) is pressed, the operating position of the shift lever (not shown), the vehicle speed, and the engine speed.

[0093] On the other hand, if the autonomous driving level is set to level 1 or higher, that is, if any of the seven types of automatic control functions described above are executed, the autonomous driving control device 30 outputs the control information necessary to realize the automatic control function being executed to the driving control unit 46. In this case, the driving control unit 46 automatically controls the engine and transmission in accordance with the control information from the autonomous driving control device 30, even if the accelerator pedal is not pressed. Although the vehicle 1 in this embodiment is equipped with an engine as a drive source for driving, the autonomous driving control device of this disclosure can also be applied to vehicles equipped with a drive source other than an engine (for example, an electric motor). In that case, the driving control unit 46 shown in Figure 2 is responsible for controlling the drive source of that vehicle. Furthermore, if a vehicle is equipped with a drive source other than an engine, the engine room temperature sensor 22 and the engine room sound sensor 23 described above may be installed for the purpose of detecting the temperature and sound of the drive source or its surroundings, respectively.

[0094] The brake control unit 47 controls a brake device (not shown) based on the amount the brake pedal (not shown) is pressed. On the other hand, if the automatic driving level is set to level 1 or higher, that is, if any of the seven types of automatic control functions described above are executed, the automatic driving control device 30 outputs the control information necessary to realize the automatic control function being executed to the driving control unit 46. In this case, the brake control unit 47 automatically controls the brake device according to the control information from the automatic driving control device 30, even if the brake pedal is not pressed.

[0095] The steering control unit 48 has two main functions. One is the so-called electric power steering function, which assists the driver's operation of the steering wheel 10 with a motor. The other is an automatic steering function that automatically steers the steering wheels (e.g., front wheels) of the vehicle 1 without requiring any driver operation. Steering of the steering wheels is basically performed by the driver operating the steering wheel 10, but when at least one of the seven types of automatic control functions described above, excluding automatic start / stop control and distance control, is performed, the steering control unit 48 automatically controls the steering of the steering wheels by controlling the motor according to the control information from the automatic driving control device 30, even if the driver is not operating the steering wheel 10.

[0096] (3) Explanation of the autonomous driving function In the vehicle 1 of this embodiment, the automatic driving control device 30 can acquire and detect various types of information necessary to realize the automatic driving functions described above.

[0097] The information available for realizing autonomous driving functions includes, first and foremost, information such as the vehicle's position and speed (vehicle information). The vehicle's position can be obtained by calculation based on GPS information. The vehicle's speed can be obtained by calculation based on the vehicle speed signal from the vehicle speed sensor (not shown), the detection signal from the steering amount sensor 20, and the yaw rate signal from the yaw rate sensor (not shown). The vehicle's speed can also be calculated from the rate of change of the vehicle's position.

[0098] Furthermore, information that can be used to realize autonomous driving functions also includes information about surrounding objects. Specifically, this includes various types of objects present around the vehicle, such as vehicles in front, behind, to the side, oncoming vehicles, vehicles crossing intersections, pedestrians, bicycles, road structures and fixed fixtures, and obstacles. This refers to information regarding the relative position, distance, and speed of objects (including people and animals) relative to the vehicle.

[0099] Information about these surrounding objects can be obtained based on the image data from each camera 2-5 and the detection results from each radar device 11-14. Various technologies for recognizing surrounding objects based on image data and radar device detection results have been proposed and put into practical use, so their explanation will be omitted here.

[0100] Information about surrounding objects can also be obtained through vehicle-to-vehicle communication, vehicle-to-infrastructure communication, and vehicle-to-pedestrian communication. For example, by communicating with surrounding vehicles, it is possible to recognize not only the surrounding vehicles visible from the vehicle, but also the position and movement of surrounding vehicles that are in blind spots and cannot be directly seen from the vehicle. As previously described, vehicle-to-infrastructure communication can obtain information about the presence of surrounding vehicles and pedestrians. As previously described, vehicle-to-pedestrian communication can determine the position and movement of pedestrians based on terminal position information received via the vehicle-to-pedestrian communication unit 34.

[0101] Through one or more of the following methods: vehicle-to-vehicle communication, vehicle-to-infrastructure communication, and vehicle-to-pedestrian communication, it is possible to acquire information on oncoming vehicles during normal driving (especially on curves) or when turning right in order to prevent head-on collisions with oncoming vehicles; acquire information on motorcycles on the left side or rear in order to prevent motorcycles from being caught in the vehicle when turning left; acquire information on vehicles on the side (rear side) when changing lanes; acquire information on vehicles ahead in order to prevent or prevent rear-end collisions; acquire information on other vehicles traveling on the roadside of the intersection in order to prevent head-on collisions at intersections; and acquire information on pedestrians in order to prevent collisions with pedestrians, etc.

[0102] Furthermore, information that can be used to realize autonomous driving functions also includes information about various road markings directly painted on the road, such as lane markings (including parking markings), pedestrian crossings, and stop lines. Information about road markings includes their location and content. This information about road markings can be obtained based on the shooting data of each camera 2 to 6. Various technologies for recognizing road markings from shooting data have been proposed and put into practical use, so their explanation will be omitted here.

[0103] Information regarding road markings in the direction of travel can also be obtained through vehicle-to-infrastructure communication. Although not present in vehicle 1 of this embodiment, it is also possible to obtain information regarding various road markings using laser radar.

[0104] Furthermore, information that can be used to realize autonomous driving functions also includes information on traffic lights, railway crossings, signs (including billboards), intersections, merging / diverging points, sidewalks, obstacles, hazardous areas, and other ground structures (hereinafter collectively referred to as "infrastructure-related information"). Infrastructure-related information includes not only the presence and location of the various objects mentioned above, but also information on the color of traffic lights, the operating status of railway crossings, and the display content of signs and billboards. Infrastructure-related information can also be recognized and acquired based on the captured data from each of the 2-6 cameras, and can also be acquired through vehicle-to-infrastructure communication. In addition, various infrastructure information can also be acquired from the route guidance function described above, which is based on GPS information and map data.

[0105] Furthermore, regulatory information can also be used to realize autonomous driving functions. For example, if there are road restrictions in place in the direction of travel due to construction, accidents, natural disasters, etc., this regulatory information can be obtained through vehicle-to-infrastructure communication.

[0106] Among the various types of information necessary for realizing the autonomous driving function (in this embodiment, the realization of the seven types of automatic control functions described above), such as information about surrounding objects, information about road markings, infrastructure-related information, and regulatory information, information about the surroundings of vehicle 1 in particular is an example of the surrounding information described herein. It corresponds to.

[0107] The automatic driving control device 30 acquires the various types of information described above and, based on that information, controls the driving control unit 46, brake control unit 47, steering control unit 48, and other necessary in-vehicle devices to achieve automatic driving. Specifically, it can perform the seven types of automatic control functions described above. The seven types of automatic control functions in this embodiment are, as described above, automatic start / stop control, lane keeping control, inter-vehicle distance control, lane change control, right / left turn control, collision prevention control, and parking control.

[0108] Automatic start / stop control is a system that automatically stops vehicle 1 when conditions for stopping are met while driving, and automatically starts vehicle 1 again when the conditions for stopping are no longer met. This control is performed using information about the vehicle itself, information about surrounding objects obtained from cameras 2-5 and radar sensors 11-14, and infrastructure-related information and regulatory information obtained through vehicle-to-infrastructure communication. With this automatic start / stop control, for example, if the traffic light is green at an intersection, the vehicle will continue driving, but will stop if it is red or yellow; if a level crossing is detected ahead and the barrier is down, the vehicle will stop; if the barrier is not down, the vehicle will stop briefly and then start again. In addition, the vehicle will also automatically stop if an obstacle is detected ahead.

[0109] Lane keeping control is a control system configured to automatically steer the steering wheels so that the vehicle does not deviate from the lane markings and travels along the lane. This control is performed in cooperation with the route guidance function, using information about the vehicle itself, as well as information about road markings (especially lane markings) obtained from cameras 2-5 and radar sensors 11-14.

[0110] Inter-vehicle distance control is a control system that maintains a constant distance from other vehicles when other vehicles are traveling ahead, and drives at a set speed when no other vehicles are present. This control is performed using information about the vehicle itself, as well as information about surrounding objects (especially vehicles ahead) obtained from cameras 2-5 and radar sensors 11-14.

[0111] Lane change control is a system that, when a lane change (steering for lane change) becomes necessary, detects other vehicles in the adjacent lane to be changed to, and automatically changes lanes while controlling the driving force, braking force, and steering to avoid collisions with other vehicles, depending on the presence, position, and speed of those vehicles. This control is performed using information about the vehicle itself, as well as information about surrounding objects (especially other vehicles in adjacent lanes) obtained from cameras 2-5 and radar sensors 11-14, information about lane markings, and information about other vehicles (vehicles traveling in adjacent lanes) obtained through vehicle-to-vehicle communication.

[0112] Right / left turn control is a control system that automatically performs a right or left turn when necessary, without colliding with oncoming vehicles, vehicles traveling on the intersection, other vehicles around the vehicle, pedestrians, etc. This control is performed using information about the vehicle itself, information about surrounding objects obtained from cameras 2-5 and radar sensors 11-14, information about other vehicles obtained through vehicle-to-vehicle communication, and information about pedestrians, etc. obtained through vehicle-to-pedestrian communication.

[0113] Collision prevention control is a system that automatically steers, brakes, or stops a vehicle to prevent it from colliding with an obstacle present on the road in its path. This is done using information about surrounding objects obtained from cameras 2-5 and radar sensors 11-14, as well as infrastructure-related information and regulatory information obtained through vehicle-to-infrastructure communication.

[0114] Parking control calculates the driving trajectory to a specific target parking location (for example, within a parking space in a specific parking lot) when a specific target parking location is set as the destination, and then controls the vehicle along that driving trajectory. This control system automatically parks the vehicle by controlling the driving force, braking force, and steering.

[0115] The system is configured so that the driver can arbitrarily set which of the seven control functions described above is to be executed, i.e., the level of autonomous driving. Specifically, as shown in Figure 3A, the level of autonomous driving can be arbitrarily set in both the highly automated mode and the basic mode. However, in the basic mode, level 7 cannot be set; any level from 0 to 6 can be set. On the other hand, in the highly automated mode, level 0 cannot be set; any level from 1 to 7 can be set. Furthermore, the level in the basic mode can be set within a range lower than the level in the highly automated mode. Conversely, the level in the highly automated mode can be set within a range higher than the level in the basic mode.

[0116] In this embodiment, as shown in Figure 3A, at Level 1, control A (e.g., lane keeping control) is performed. At Level 2, in addition to control A, control B (e.g., following distance control) is performed. At Level 3, in addition to controls A and B, control C (e.g., automatic start / stop control) is performed. At Level 4, in addition to controls A, B, and C, control D (e.g., collision prevention control) is performed. At Level 5, in addition to controls A, B, C, and D, control E (e.g., lane change control) is performed. At Level 6, in addition to controls A, B, C, D, and E, control F (e.g., right / left turn control) is performed. At Level 7, in addition to controls A, B, C, D, E, and F, control G (e.g., parking control) is performed. In other words, the higher the level, the more types of automatic control functions are performed, and at Level 7, fully autonomous driving is achieved.

[0117] The level setting for each driving mode can be adjusted individually for each driving mode by operating the level setting control unit 42 located near the driver's seat. In this embodiment, the automatic driving level for the basic mode is set to level 0 by default, and the automatic driving level for the highly automated mode is set to level 1 by default. The currently set automatic driving level for each driving mode can be arbitrarily changed. For example, if the basic mode is set to level 0, the highly automated mode can be arbitrarily changed between levels 1 and 7. Also, for example, if the basic mode is set to level 1, the highly automated mode can be arbitrarily changed between levels 2 and 7. Also, for example, if the highly automated mode is set to level 4, the basic mode can be arbitrarily changed between levels 0 and 3.

[0118] The level at which automatic control functions are executed is not limited to the examples shown in Figure 3A. For example, it is not necessary for the number of automatic control functions executed to increase by one with each increase in the level. The level at which automatic control functions are executed can be determined as appropriate.

[0119] Furthermore, assuming that the number of automatic control functions executed increases by one with each level increase, as shown in Figure 3A, the content of control A to control G may be set arbitrarily by the driver or other personnel, as shown in Figure 3B.

[0120] In this embodiment, when the automatic driving switch 41 is turned off, the driving mode of vehicle 1 is set to the basic mode. On the other hand, when the automatic driving switch 41 is turned on, the driving mode becomes the highly automated mode under certain conditions. If the system is set to perform lane change control, right / left turn control, and parking control, it is necessary to set a destination (or target parking position in the case of parking control). Specifically, this can be done by activating the route guidance function and entering the destination via the touch panel. When a destination is set, the automatic driving basically works in cooperation with the route guidance function to follow the calculated route to the destination while confirming the position of the vehicle itself.

[0121] Examples of various control methods in the highly automated mode, when the automated driving level in the highly automated mode is set to level 7, will be explained using Figure 4. Each of the vehicles 61 to 67 shown in Figure 4 has the same configuration as vehicle 1 shown in Figures 1 and 2. Vehicles traveling within the communication area of ​​the road communication device 81 can receive individual road information from the road communication device 81. At least four of the vehicles in Figure 4, 61, 65, 66, and 67, can receive individual road information from at least two nearby road communication devices 81a and 81b. Specifically, they can obtain information such as traffic light 71 ahead, oncoming vehicle 62, and pedestrian 76.

[0122] Furthermore, at least vehicle 63 can receive individual road information from at least nearby road communication devices 81c. Specifically, it can obtain information such as the presence of a stop sign 73 (i.e., that it should stop), and that another vehicle 64 is approaching from the right.

[0123] Furthermore, at least vehicle 64 can receive individual road information from at least nearby roadside communication devices 81d. Specifically, it can obtain information such as that another vehicle 63 is approaching from the left.

[0124] Furthermore, at least vehicle 62 can receive individual road information from at least nearby road communication devices 81e. Specifically, it can obtain information such as information about the traffic light 72 ahead, the presence of an oncoming vehicle 61 that is about to turn right, the presence of a pedestrian crossing in the direction of the left turn, and the presence of a pedestrian 76 at that pedestrian crossing.

[0125] Furthermore, each vehicle 61-66 can obtain various information from its own cameras 2-6 and radar devices 11-14, and can also obtain various information through vehicle-to-vehicle communication and vehicle-to-pedestrian communication. For example, vehicle 65 can detect the vehicle 67 in front of it and the vehicle 66 to its right using its camera and radar device, allowing it to maintain an appropriate distance from the vehicle 67 in front of it, or, if a lane change is necessary, to change lanes at the appropriate time while considering the positional relationship with the vehicle 66 to its right. In addition, vehicle 65 can also detect a pedestrian 77 suddenly appearing using its camera and radar device, and in that case, it can perform appropriate deceleration control to avoid colliding with the pedestrian 77 while considering the distance to the vehicle 65 behind it.

[0126] As a result, each vehicle 61 to 66 can automatically drive along its route to its destination, using various information such as information obtained from its own vehicle and information obtained from the roadside. Specifically, each vehicle 61 to 66 can automatically drive along its route while avoiding contact with other vehicles, pedestrians, or other road structures, and while complying with traffic signals and traffic regulations, mainly by automatically controlling the drive control unit 46, brake control unit 47, and steering control unit 48.

[0127] (4) Automated driving level setting process Next, the automatic driving level setting process executed by the control unit 30a of the automatic driving control device 30 will be explained using Figure 5. The automatic driving level setting process in Figure 5 switches the driving mode of the vehicle 1 to either the highly automated mode or the basic mode, and also determines whether or not to deactivate automatic driving when the automatic driving level is level 1 or higher. If it is determined that deactivation is necessary, the process forcibly sets the automatic driving level to level 0.

[0128] When the control unit 30a is activated by turning on the power switch (e.g., ignition switch) of the vehicle 1 (not shown), it reads the program for setting the automatic driving level shown in Figure 5 from the memory 30b and executes it repeatedly at a predetermined control cycle.

[0129] When the control unit 30a starts the automatic driving level setting process shown in Figure 5, in S10, the automatic driving solution The system determines whether the deactivation flag is set or not. The deactivation flag is set when it is determined that deactivation of automatic driving should be disabled, and specifically, it is set in S119 of Figure 6, which will be described later.

[0130] If the automatic driving deactivation flag is set (S10:YES), in S70 the automatic driving level is set to level 0. That is, regardless of whether the driving mode is set to the highly automated mode or the basic mode, the automatic driving level is forcibly set to level 0, preventing all of the seven types of automatic control functions described above from being executed. Then, in S80, a predetermined error notification is issued to inform the occupants of vehicle 1 that automatic driving has been forcibly deactivated, and the automatic driving level setting process is terminated.

[0131] While this automatic driving deactivation flag is set, all seven types of automatic control functions will not operate, and therefore, the driver must perform all driving operations corresponding to these seven types of automatic control functions (driving operations that can be performed automatically by each automatic control function). As previously mentioned, the automatic driving deactivation flag can be reset by pressing the deactivation reset switch 44.

[0132] If the automatic driving deactivation flag is not set in S10 (S10: NO), then in S20, it is determined whether or not the emergency stop flag is set. The emergency stop flag is set when it is determined that vehicle 1 should be stopped in an emergency, and specifically, it is the flag set in S120 in Figure 6, which will be described later.

[0133] If the emergency stop flag is set (S20:YES), the emergency stop process is executed in S90. The emergency stop process is a process to bring vehicle 1 to a stop as quickly as possible while maintaining safety. The specific details of the emergency stop process may be determined as appropriate to allow the vehicle to be stopped as quickly as possible while maintaining safety. For example, the process could involve slowing down vehicle 1 and moving it to the side of the road to a stop while monitoring it with cameras and radar devices to avoid contact with objects outside the vehicle (including other vehicles and pedestrians).

[0134] If the emergency stop flag is not set in S20 (S20: NO), then in S30, it is determined whether the automatic driving switch 41 is ON or OFF. If the automatic driving switch 41 is ON (S30: YES), then in S40, the driving mode is set to the highly automated mode and the process proceeds to S60. If the automatic driving switch 41 is OFF (S30: NO), then in S50, the driving mode is set to the basic mode and the process proceeds to S60.

[0135] If the driving mode is set to the highly automated mode in S40, the control unit 30a executes automatic control functions in S55 based on the automated driving level set as the highly automated mode. For example, if level 6 is set as the highly automated mode, it executes six types of automatic control functions A to F (see Figure 3A). Also, for example, if level 7 is set as the highly automated mode, it executes all seven types of automatic control functions A to G to achieve fully automated driving. Furthermore, the execution of the automatic control functions in S55 is performed based on the various information acquired as needed, including the aforementioned surrounding information.

[0136] If the driving mode is set to the basic mode in S50, the control unit 30a executes an automatic control function based on the automatic driving level set as the basic mode in S50. For example, if level 1 is set as the basic mode, the automatic control function of control A (see Figure 3A) is executed. The execution of the automatic control function in this case is also carried out based on the various information acquired, including the aforementioned ambient information, as needed. However, the basic mode If level 0 is set as the code, all automatic control functions will not be executed.

[0137] In S60, the automatic driving deactivation confirmation process is executed. This automatic driving deactivation confirmation process has two main purposes. First, if the automatic driving level is set to level 1 or higher, it is necessary to determine whether it is necessary to forcibly set the automatic driving level to level 0, and if it is necessary to forcibly set it to level 0, the automatic driving deactivation flag is set. Second, if the automatic driving level is set to level 1 or higher, it is necessary to determine whether it is necessary to make an emergency stop on vehicle 1, and if it is necessary to make an emergency stop, the emergency stop flag is set.

[0138] The details of the automatic driving deactivation confirmation process in S60 are shown in Figure 6. When the control unit 30a proceeds to the automatic driving deactivation confirmation process in S60, it determines in S111 whether the automatic driving level set in the current driving mode is level 1 or higher, as shown in Figure 6. If the automatic driving level is not level 1 or higher (i.e., level 0) (S111: NO), the automatic driving deactivation confirmation process in Figure 6 is terminated, and the automatic driving level setting process in Figure 5 is terminated.

[0139] If the current driving mode is set to an automatic driving level of 1 or higher (S111: YES), the system monitoring process is executed in S112. The system monitoring process in S112 monitors the operating state of vehicle 1 (including the execution state of the automatic control function) and determines whether a predetermined event (an event requiring deactivation) has occurred that should forcibly switch the automatic driving level to level 0. The details of the system monitoring process in S112 will be described in detail later using Figure 7.

[0140] In S113, the internal and external behavior monitoring process is executed. The internal and external behavior monitoring process in S113 monitors the behavior of the vehicle occupants inside the vehicle 1 and the behavior of pedestrians and other vehicles outside the vehicle 1 to determine whether or not a deactivation event has occurred that should force the automated driving level to switch to level 0. The details of the internal and external behavior monitoring process in S113 will be described in detail later using Figure 8.

[0141] In S114, environmental monitoring is performed. The environmental monitoring process in S114 monitors the environment around vehicle 1 and determines whether or not a deactivation event has occurred that would force the automated driving level to switch to level 0. The details of the environmental monitoring process in S114 will be described later using Figure 9.

[0142] In S115, a self-diagnosis process is performed. The self-diagnosis process in S115 is a process to self-diagnose whether the execution status of the automatic control function by the control unit 30a itself is normal or not by comparing it with past execution results. The details of the self-diagnosis process in S115 will be described in detail later using Figure 10B.

[0143] In S116, it is determined whether or not an event requiring disengagement has occurred in any of the processes from S112 to S115. If no event requiring disengagement has occurred (S116: NO), the automatic driving disengagement confirmation process shown in Figure 6 is terminated. If it is determined that an event requiring disengagement has occurred in any of the processes from S112 to S115 (S116: YES), in S117, an automatic driving disengagement warning is issued to the occupants of vehicle 1. This warning is issued to inform the occupants in advance that automatic driving should be disengaged based on the occurrence of an event requiring disengagement. This warning may be issued in various ways that allow the occupants of vehicle 1 to recognize that an event requiring disengagement has occurred and that the automatic driving should be disengaged. Specific notification methods include, for example, issuing a predetermined message by voice or visually displaying a message to the occupants using the display unit 37. Methods such as transmitting signals or vibrating the seat may also be employed.

[0144] In S118, it is determined whether or not the automated driving system can be deactivated. In other words, this determination determines whether or not the driver is able to perform the driving operations that were previously performed automatically when the automated driving system is deactivated. The basis for determining whether or not the automated driving system can be deactivated may be decided as appropriate. For example, the determination may be based on whether or not a specific deactivation permission action has been performed by the driver, based on the driver's state or behavior. A deactivation permission action is an action that indicates that the driver is in a state where they can perform driving operations themselves. A deactivation permission action includes a stationary state in which the driver is stationary in a specific condition. As a deactivation permission action, at least one of several actions or states may be set, such as the driver holding the steering wheel 10 with at least one hand, the driver holding the steering wheel 10 with both hands, the driver's eyes being open, the driver's gaze being directed forward, and the driver's behavior being normal (for example, a state that is judged positively in the determination process in S204 described later). The control unit 30a may, for example, determine whether or not the release permission operation has been performed based on image data from the indoor camera 6.

[0145] If it is determined that autonomous driving can be deactivated (S118: YES), the autonomous driving deactivation flag is set in S119. As a result, when the decision process in S10 in Figure 5 is executed next, it is determined to be positive and proceeds to S70, where the autonomous driving level is forcibly set to level 0.

[0146] If it is determined in S118 that automatic driving cannot be deactivated (S118: NO), the emergency stop flag is set in S120. As a result, when the decision process in S20 in Figure 5 is executed next, it is determined to be positive, and the process proceeds to S90, where the emergency stop process is executed.

[0147] Next, the system monitoring process at S112 in the automatic driving deactivation confirmation process shown in Figure 6 will be explained in detail using Figure 7. When proceeding to the system monitoring process at S112, as shown in Figure 7, at S161, it is determined whether the distance to other vehicles is normal or not. The distance to other vehicles can be detected based on the detection results of other vehicles around the vehicle by each camera 2-5 and each radar device 11-14. Alternatively, it can be detected based on the position information of other vehicles and the vehicle's own position information obtained via vehicle-to-vehicle communication.

[0148] To determine whether the distance to other vehicles is normal, for example, a distance threshold may be set, and the vehicle may be deemed normal if the distance to other vehicles is greater than or equal to that threshold. In this case, the threshold may be set individually depending on the position of the other vehicle relative to the vehicle (for example, whether it is in front of, behind, or to the side of the vehicle). Of course, there may be other methods to determine whether the distance to other vehicles is normal.

[0149] If the distance to other vehicles is abnormal (S161: NO), proceed to S169. When the distance to other vehicles is abnormal, the risk of collision with other vehicles increases. One possible cause is that the automatic control function is not working properly. Therefore, if the distance to other vehicles is abnormal, S169 determines that a disengagement event has occurred in order to forcibly disengage automatic driving and hand over the driving operation of vehicle 1 to the driver. In other words, an abnormal distance to other vehicles is one of the disengagement events.

[0150] If the distance to other vehicles is normal (S161: YES), then in S162, it is determined whether the relative speed to other vehicles is normal. The relative speed to other vehicles can also be determined, similar to the distance to other vehicles, based on the detection results of other vehicles around the vehicle by each camera 2-5 and each radar device 11-14.

[0151] Whether the relative speed with other vehicles is normal can be determined, for example, by setting a threshold for relative speed, and determining that the speed is normal if it is below that threshold. In this case, the threshold can be set individually depending on the position of the other vehicle relative to your vehicle (for example, whether it is in front of, behind, or to the side of your vehicle). Of course, there may be other methods besides the above example to determine whether the relative speed with other vehicles is normal.

[0152] If the relative speed with other vehicles is abnormal (S162: NO), proceed to S169. If the relative speed with other vehicles is abnormal, there is a possibility of collision with other vehicles. Also, it may not be following the flow of surrounding traffic. One possible cause is that the automatic control function is not working properly. Therefore, if the relative speed with other vehicles is abnormal, S169 determines that a disengagement event has occurred in order to forcibly disengage automatic driving and hand over the driving operation of vehicle 1 to the driver. In other words, an abnormal relative speed with other vehicles is one of the events that requires disengagement.

[0153] If the relative speed with other vehicles is normal (S162: YES), then in S163, it is determined whether the suspension behavior is normal or not. The suspension behavior can be detected based on the detection result of the suspension sensor 25.

[0154] Whether the suspension behavior is normal or not can be determined, for example, by setting a threshold for the amount of extension or contraction of the suspension, and determining that it is normal if the amount of extension or contraction is below that threshold. Alternatively, for example, a threshold can be set for the rate of change of the amount of extension or contraction, and determining that it is normal if the rate of change of the amount of extension or contraction is below that threshold. If multiple suspension sensors 25 are provided, how to make an overall determination based on the detection results from the multiple suspension sensors 25 may be determined as appropriate. For example, if the amount of extension or contraction detected by even one of the multiple suspension sensors 25 exceeds a threshold, it may be determined that the suspension behavior is abnormal.

[0155] If the suspension behavior is abnormal (S163: NO), proceed to S169. If the suspension behavior is abnormal, one possible cause is that the automatic control function is not working properly. In other words, if the automatic control function is not working properly, unstable behavior such as sudden acceleration, sudden braking, and sudden turns may occur, which may cause the suspension to extend and contract significantly. Therefore, if the suspension behavior is abnormal, in order to forcibly deactivate the automatic driving and entrust the driving operation of vehicle 1 to the driver, it is determined in S169 that a deactivation event has occurred. In other words, abnormal suspension behavior is one of the events that requires deactivation.

[0156] If the suspension behavior is normal (S163: YES), then in S164, it is determined whether the engine compartment is normal or not. Specifically, it is determined whether the condition inside the engine compartment is such that the temperature inside the engine compartment is normal and no abnormal noises are being generated. The temperature inside the engine compartment can be detected based on the detection result of the engine compartment temperature sensor 22, and the sound generated from the engine compartment can be detected based on the detection result of the engine compartment sound sensor 23.

[0157] To determine whether the engine compartment is functioning normally, for example, a temperature threshold may be set for the temperature inside the engine compartment, and a volume threshold may be set for the noise inside the engine compartment. If the temperature inside the engine compartment is below the temperature threshold and the noise level inside the engine compartment is below the volume threshold, the system may determine that it is functioning normally. Regarding the noise inside the engine compartment, the sound quality may be analyzed, and if a sound quality equivalent to that which may occur when an abnormality occurs is detected, the system may determine that the engine compartment is abnormal.

[0158] If the engine compartment is not functioning correctly (S164: NO), proceed to S169. If the engine compartment is not functioning correctly, one possible cause is that the automatic control function is not working properly. In other words, if the automatic control function is not working properly, the automatic driving control device 30 may not be able to properly control the driving control unit 46, and as a result, the driving control unit 46 may not be able to properly control the engine, transmission, etc. Therefore, if the engine compartment is not functioning correctly, in order to forcibly deactivate automatic driving and entrust the driving operation of vehicle 1 to the driver, it is determined in S169 that a deactivation event has occurred. In other words, an abnormal engine compartment is one of the events that requires deactivation.

[0159] If the engine compartment is normal (S164: YES), then in S165, it is determined whether or not an abnormal current is occurring. Here, an abnormal current refers to the overcurrent described above (for example, an excessive current that may occur during a lightning strike). The determination of whether or not an abnormal current is occurring can be made based on the detection result of the current sensor 19. For example, a threshold can be set for the current to be detected, and if the detected current is greater than or equal to that threshold, it may be determined that an abnormal current has occurred.

[0160] If an abnormal current occurs (S165: YES), proceed to S169. If an abnormal current occurs, there is a possibility that the automatic control function may not operate normally due to that abnormal current. Therefore, if an abnormal current occurs, in order to forcibly cancel automatic driving and hand over the operation of vehicle 1 to the driver, it is determined in S169 that a cancellation event has occurred. In other words, the occurrence of an abnormal current due to various factors such as lightning strikes is one of the cancellation events.

[0161] If no abnormal current is generated (S165: NO), then in S166, it is determined whether or not a tire puncture has occurred. Whether or not a tire puncture has occurred can be determined based on the detection result of the tire pressure sensor 24.

[0162] To determine whether or not a tire has punctured, for example, a threshold can be set for the air pressure, and if the air pressure in any one of the four tires falls below the threshold, it can be determined that a puncture has occurred.

[0163] If a puncture has occurred (S166: YES), proceed to S169. If a puncture has occurred, it is possible that the automatic control function will not be able to control vehicle 1 properly due to the puncture. Therefore, if a puncture has occurred, in order to forcibly deactivate the automatic driving and hand over the driving operation of vehicle 1 to the driver, it is determined in S169 that a deactivation event has occurred. In other words, a puncture in the tire is one of the events that requires deactivation.

[0164] If a tire puncture has not occurred (S166: NO), S167 determines whether or not a slip has occurred. Whether or not a slip has occurred can be determined based on the detection results of the wheel speed sensors 18 for each wheel. For example, the detection results of each wheel speed sensor 18 may be compared, and if the difference between the highest and lowest wheel speeds is greater than or equal to a predetermined threshold, it may be determined that a slip has occurred.

[0165] If a slip occurs (S167: YES), proceed to S169. If a slip occurs, it is possible that the automatic control function will not be able to control vehicle 1 properly as a result of the slip. Therefore, if a slip occurs, in order to forcibly deactivate the automatic driving and entrust the driving operation of vehicle 1 to the driver, it is determined in S169 that a deactivation event has occurred. In other words, the occurrence of a slip is one of the events that requires deactivation.

[0166] If no slip occurs (S167: NO), check in S168 whether the steering condition is normal. A determination is made as to whether or not the steering state is normal. The steering state can be detected based on the detection result of the steering amount sensor 20. For example, a threshold may be set for the steering amount relative to the neutral position, and the state may be judged as normal if the steering amount from the neutral position is less than or equal to that threshold. Alternatively, for example, a threshold may be set for the rate of change of the steering amount, and the state may be judged as normal if the rate of change of the steering amount is less than or equal to that threshold.

[0167] If the steering condition is not normal (S163: NO), proceed to S169. If the steering condition is not normal, one possible cause is that the automatic control function is not working properly. Therefore, if the steering condition is not normal, in order to forcibly deactivate automatic driving and entrust the driving operation of vehicle 1 to the driver, it is determined in S169 that a deactivation event has occurred. In other words, an abnormal steering condition is one of the events that requires deactivation.

[0168] If the steering condition is normal (S168: YES), the system monitoring process shown in Figure 7 (i.e., the process in S112 of Figure 6) is terminated. Next, the internal and external behavior monitoring process in S113 of the automatic driving deactivation confirmation process in Figure 6 will be explained in detail using Figure 8. When proceeding to the internal and external behavior monitoring process in S113, as shown in Figure 8, it is determined in S201 whether or not contact with a specific contact area inside the vehicle by an occupant of vehicle 1 has been detected. Whether or not contact with a specific contact area inside the vehicle has been made can be determined based on the detection result of the in-vehicle contact sensor 21.

[0169] If contact with a specific contact area inside the vehicle is detected (S201: YES), the process proceeds to S210. In the instruction manual for vehicle 1 of this embodiment, if the driver feels that there is an abnormality or anxiety regarding the operation of the automatic control function, the automatic driving can be forcibly deactivated by touching a specific contact area inside the vehicle or by operating the emergency stop lever 43. Therefore, if contact with a specific contact area inside the vehicle is detected, it can be determined that the occupant of vehicle 1 has expressed an intention to forcibly deactivate the automatic driving.

[0170] Therefore, if contact with a specific contact area inside the vehicle is detected, the system determines in S210 that a disengagement event has occurred in order to forcibly disengage the automated driving system and hand over the driving operation of vehicle 1 to the driver. In other words, detection of contact with a specific contact area inside the vehicle is one of the disengagement events.

[0171] If no contact is detected with a specific contact area inside the vehicle (S201: NO), then in S202, it is determined whether or not the emergency stop lever 43 was operated. If the emergency stop lever 43 was operated (S202: YES), the process proceeds to S210. The operation of the emergency stop lever 43 indicates that the occupant of vehicle 1 has expressed an intention to forcibly deactivate the automatic driving function.

[0172] Therefore, if the emergency stop lever 43 is operated, the system determines in S210 that a cancellation event has occurred in order to forcibly cancel the automatic driving and hand over the driving operation of vehicle 1 to the driver. In other words, the operation of the emergency stop lever 43 is one of the cancellation events.

[0173] If the emergency stop lever 43 is not operated (S202: NO), S203 determines whether or not an external impact has been detected. As previously described, an external impact here includes everything from major impacts such as collisions with other vehicles to minor impacts such as a pedestrian or other external person hitting vehicle 1.

[0174] Whether or not there has been an external impact can be determined based on the detection result of the impact sensor 27. If an external impact is detected (S203:YES), proceed to S210. If an external impact has been detected, it means that vehicle 1 has been damaged and is unable to drive normally. It is possible that the automatic control function of vehicle 1 malfunctioned, causing vehicle 1 to behave abnormally, or that someone outside the vehicle noticed something was wrong with the driver of vehicle 1, and therefore the person outside the vehicle may have knocked on vehicle 1 or otherwise tried to alert the occupants of vehicle 1.

[0175] Therefore, if an external impact is detected, the system determines in S210 that a disengagement event has occurred in order to forcibly disengage the automated driving system and hand over the driving operation of vehicle 1 to the driver. In other words, the detection of an external impact is one of the disengagement events.

[0176] If no external impact is detected (S203: NO), S204 determines whether the driver's behavior is normal or not. The driver's behavior can be recognized by analyzing the data captured by the indoor camera 6. For example, if the driver is distracted for a certain period of time or longer, if the driver's eyes are closed for a certain period of time or longer, or if the driver has an expression of surprise, worry, or fear, the driver's behavior can be determined to be abnormal. Of course, the driver's behavior can also be determined to be normal or not based on other criteria.

[0177] If the driver's behavior is determined to be abnormal (S204: YES), proceed to S210. If the driver's behavior is determined to be abnormal, it could be due to a problem with the driver or a malfunction in the automatic control functions of vehicle 1.

[0178] Therefore, if the driver's behavior is deemed abnormal, the system determines in S210 that a disengagement event has occurred in order to forcibly disengage the automated driving system and hand over the operation of vehicle 1 to the driver, or to bring vehicle 1 to an emergency stop. In other words, the determination that the driver's behavior is abnormal is one of the disengagement events.

[0179] If the driver's behavior is judged to be normal (S204: NO), then in S205, it is determined whether or not a pedestrian is looking at the vehicle. Whether or not a pedestrian is looking at the vehicle can be determined by analyzing the data captured by each camera 2 to 5, as described above.

[0180] If pedestrians are looking at the vehicle (S205: YES), then in S208, it is determined whether the vehicle is attracting the attention of a predetermined number of pedestrians or more (i.e., whether it is attracting a lot of attention from pedestrians). If the number of pedestrians looking at the vehicle is less than the predetermined number (i.e., it is not attracting a lot of attention) (S208: NO), then proceed to S209.

[0181] S209 determines whether the behavior of a pedestrian looking at the vehicle is normal or not. The criteria for determining whether the behavior of a pedestrian looking at the vehicle is normal or not may be determined as appropriate. For example, if the pedestrian's facial expression or behavior is such as surprise, worry, or fear, the pedestrian's behavior may be judged as abnormal.

[0182] If it is determined in S208 that a predetermined number of pedestrians are looking towards the vehicle (S208: YES), or if it is determined in S209 that the behavior of pedestrians looking towards the vehicle is not normal (S209: NO), the process proceeds to S210.

[0183] The fact that many pedestrians are focusing their gaze on the vehicle suggests that the automatic control function of vehicle 1 is not working properly, causing vehicle 1 to behave abnormally, or that something is wrong with the driver of vehicle 1. Furthermore, even if only a small number of pedestrians are looking at the vehicle, if those pedestrians are behaving abnormally, it still suggests that the automatic control function of vehicle 1 is not working properly. It is possible that the absence of the part is causing Vehicle 1 to behave abnormally, or that something is wrong with the driver of Vehicle 1.

[0184] Therefore, if the gaze of a large number of pedestrians is concentrated on a vehicle, or if the behavior of the pedestrians who are looking at the vehicle is abnormal, the system will determine in S210 that a disengagement event has occurred in order to forcibly disengage the automated driving system and hand over the driving operation of vehicle 1 to the driver, or to bring vehicle 1 to an emergency stop. In other words, the gaze of a large number of pedestrians is concentrated on a vehicle, and the behavior of the pedestrians who are looking at the vehicle is abnormal, both of which are examples of disengagement events.

[0185] If no pedestrians are looking at the vehicle (S205: NO), or if only a few pedestrians are looking at the vehicle and their behavior is normal (S209: YES), proceed to S206.

[0186] In S206, it is determined whether or not the vehicle has been flashed by another vehicle (mainly an oncoming vehicle or a vehicle behind). Whether or not the vehicle has been flashed by another vehicle can be determined mainly by analyzing the data captured by the front camera 2 and the rear camera 3. If the vehicle has been flashed by another vehicle (S206: YES), proceed to S210.

[0187] Being flashed by another vehicle suggests that the automatic control function of Vehicle 1 has malfunctioned, causing Vehicle 1 to behave abnormally, and that the driver of the other vehicle noticed this abnormal behavior and alerted the driver. Therefore, when flashed by another vehicle, S210 determines that a disengagement event has occurred, either forcibly disengaging automatic driving and handing over control of Vehicle 1 to the driver, or bringing Vehicle 1 to an emergency stop. In other words, being flashed by another vehicle is one of the events that requires disengagement.

[0188] If no other vehicle has flashed its headlights (S206: NO), then in S207, determine whether or not another vehicle has honked its horn. Whether or not another vehicle has honked its horn can be determined mainly based on the detection result of the external sound sensor 26. If another vehicle has honked its horn (S207: YES), proceed to S210.

[0189] The fact that another vehicle honked its horn suggests that the automatic control function of vehicle 1 has malfunctioned, causing vehicle 1 to behave abnormally, and that the driver of the other vehicle noticed this abnormal behavior and warned the driver. Therefore, when another vehicle honks its horn, S210 determines that a disengagement event has occurred, either to forcibly disengage automatic driving and hand over the driving control of vehicle 1 to the driver, or to bring vehicle 1 to an emergency stop. In other words, being honked at by another vehicle is one of the disengagement events.

[0190] Next, the environmental monitoring process in S114 of the automatic driving deactivation confirmation process in Figure 6 will be explained in detail using Figure 9. When proceeding to the environmental monitoring process in S114, as shown in Figure 9, in S251, it is determined whether or not the weather around vehicle 1 is in a heavy rain state. The determination of whether or not it is a heavy rain state can be made based on the detection signal from the rainfall sensor 17, for example, by setting a threshold for the detected amount and comparing it with that threshold. Of course, it is also possible to determine whether or not it is a heavy rain state by other methods. For example, it is also possible to analyze the amount of rain from the captured data of each camera 2 to 5 and make the determination.

[0191] If heavy rain conditions are determined (S251:YES), proceed to S256. If heavy rain conditions are not determined (S251:NO), proceed to S252. In S252, it is determined whether the weather around vehicle 1 is experiencing heavy snowfall. This determination can be made, for example, by analyzing the amount of snowfall from the data captured by each camera 2-5. Of course, other methods may also be used to determine whether or not there is heavy snowfall.

[0192] If heavy snow conditions are determined (S252:YES), proceed to S256. If heavy snow conditions are not determined (S252:NO), proceed to S253. In S253, it is determined whether or not there is dense fog around vehicle 1. The determination of whether or not there is dense fog can be made in the same way as the determination of heavy snow conditions, for example, by analyzing the fog conditions from the captured data of each camera 2 to 5. Of course, other methods may also be used to determine whether or not there is dense fog.

[0193] If dense fog is determined (S253:YES), proceed to S256. If dense fog is not determined (S253:NO), proceed to S254. If heavy rain, heavy snow, or dense fog is detected (hereinafter collectively referred to as "bad weather"), visibility in front of the vehicle will be poor, and the automatic control functions may not operate properly. Therefore, in the event of bad weather, S256 determines that a disengagement event has occurred in order to forcibly disengage automatic driving and hand over the driving operation of vehicle 1 to the driver. In other words, bad weather is one of the events that requires disengagement.

[0194] In S254, it is determined whether or not vehicle 1 is traveling in a section requiring caution. As previously described, the sections requiring caution in this embodiment include at least accident-prone areas, school zones, and areas where animals are likely to appear. The determination of whether or not vehicle 1 is traveling in a section requiring caution can be made based on section information obtained via vehicle-to-infrastructure communication. Alternatively, if the data captured by the forward camera 2 includes signs or road markers indicating a section requiring caution, the determination can also be made based on that.

[0195] If it is determined that Vehicle 1 is traveling in a section requiring caution (S254: YES), the system proceeds to S256. When Vehicle 1 is traveling in a section requiring caution, it may be preferable for the driver to pay attention to the direction of travel and take control of the vehicle rather than relying on the automatic control function. Therefore, when Vehicle 1 is traveling in a section requiring caution, the system determines in S256 that a disengagement event has occurred in order to forcibly disengage automatic driving and entrust the driving of Vehicle 1 to the driver. In other words, Vehicle 1 traveling in a section requiring caution is one of the disengagement events.

[0196] If Vehicle 1 is not traveling in a section requiring attention (S254: NO), proceed to S255. In S255, determine whether the average level of autonomous driving levels of other surrounding vehicles (hereinafter referred to as "average surrounding level") is below a predetermined level (for example, level 1 or lower). If the average surrounding level is higher than the predetermined level (S255: NO), terminate the environmental monitoring process. On the other hand, if the average surrounding level is below the predetermined level (S255: YES), proceed to S256.

[0197] The surrounding average level can be derived by obtaining the autonomous driving levels set for each other vehicle traveling around the vehicle, and then averaging these obtained autonomous driving levels. The autonomous driving levels of other vehicles around the vehicle can be obtained directly via vehicle-to-vehicle communication or indirectly via vehicle-to-infrastructure communication.

[0198] If the surrounding average level is below a predetermined level, it means that many other vehicles in the vicinity are keeping their autonomous driving levels low. This also suggests that many other drivers are likely operating their vehicles using their own driving skills rather than relying on autonomous driving functions. The fact that many drivers in the surrounding area are not relying on autonomous driving functions suggests that the area you are currently driving in is, for some reason, an area where it is preferable for drivers to operate their vehicles using their own driving skills rather than autonomous driving.

[0199] Therefore, if the surrounding average level is below a predetermined level, the system determines in S256 that a deactivation event has occurred in order to forcibly deactivate the automated driving system and hand over the driving operation of vehicle 1 to the driver. In other words, the fact that the surrounding average level is below a predetermined level is one of the events that requires deactivation.

[0200] Next, we will explain the self-diagnosis process in S115 of the automatic driving deactivation confirmation process shown in Figure 6. Before explaining the self-diagnosis process, we will first explain the driving history recording process shown in Figure 10A.

[0201] The driving history recording process in Figure 10A is a process that stores various specific control operations performed while Vehicle 1 is driving (however, control operations performed automatically in the automatic control function) as a history, linked to the location where the specific control operation was performed. The types and number of specific control operations to be stored as history may be determined as appropriate. For example, actions such as stopping temporarily while driving or decelerating even though there are no other vehicles ahead may be designated as specific control operations.

[0202] If the automatic control function is working correctly, vehicle 1 should automatically stop where there is a stop sign or stop line. Also, it should slow down for safety before a pedestrian crossing, even if there are no vehicles ahead. On the other hand, if the automatic control function is not working correctly, the vehicle may pass a stop sign without stopping, or pass a pedestrian crossing without slowing down. In other words, if the automatic control function is not working correctly, the vehicle may drive differently even when driving in the same area as before.

[0203] Therefore, in this embodiment, past driving history is stored in association with location, and the next time the vehicle drives to the same location, it is compared with the past driving state. If the driving behavior is different from the past (for example, if the vehicle stopped in the past but passed through this time), it is determined that the automatic control function is not working properly and that the automatic driving should be deactivated.

[0204] When the control unit 30a starts operation, it executes the driving history recording process shown in Figure 10A in parallel with the automatic driving level setting process shown in Figure 5. When the control unit 30a starts the driving history recording process shown in Figure 10A, it determines in S301 whether or not vehicle 1 has traveled a certain distance. The determination in S301 continues until a certain distance has been traveled. If a certain distance has been traveled (S301: YES), the process proceeds to S302.

[0205] In S302, specific control operations performed within a given distance are stored as specific control information, along with the location information where those operations took place. If specific control operations at the same location have already been stored, the stored information is updated. After storing the specific control information for the given distance, the process returns to S301. In this way, after each distance traveled, the specific control information storage process is performed for that distance.

[0206] Next, the self-diagnosis process in S115 of Figure 6 will be explained using Figure 10B. When proceeding to the self-diagnosis process in S115, as shown in Figure 10B, in S351, it is determined whether the current driving position has been visited before. This determination can be made by comparing the current position based on GPS information with the position information associated with specific control information stored in memory 30b.

[0207] If the current driving position is not associated with any of the specific control information stored in memory 30b, the system assumes that the current driving position has never been visited before (S351: NO) and terminates the self-diagnosis process. If the current driving position matches or is close to a position information associated with any of the specific control information stored in memory 30b, the system determines that the current driving position has been visited before (S351: YES) and proceeds to S352.

[0208] In S352, past specific control information corresponding to the current driving position is read from memory 30b. In other words, it is checked whether or not specific control operations were performed in the past at the current location. In S353, it is determined whether or not the current driving state is different from the past. More specifically, it is determined whether or not specific control operations that were performed in the same location in the past are being performed again this time. If the driving is different from the past, that is, if specific control operations that were performed in the same location in the past are not being performed this time (S353: YES), the process proceeds to S354, and it is determined that an event requiring cancellation has occurred. If the driving is not different from the past, that is, if specific control operations that were performed in the same location in the past are being performed again this time (S353: NO), the self-diagnosis process is terminated.

[0209] (5) Effects of the first embodiment According to the vehicle 1 of this embodiment described above, when the autonomous driving level is level 1 or higher (i.e., when the automatic control function is operating), it is determined whether or not a disengagement event has occurred that should disengage autonomous driving (S112 to S115 in Figure 6). If a disengagement event occurs, the autonomous driving level is forcibly set to level 0. In other words, if a disengagement event occurs, regardless of the setting of the driving mode, all operations of the automatic control function are stopped, and the driving operation of vehicle 1 is entrusted to the driver.

[0210] Therefore, if an event requiring deactivation occurs, the driver can operate vehicle 1 themselves. This helps to suppress the occurrence of unstable operation of vehicle 1 caused by malfunctions of the automatic control function, etc.

[0211] Furthermore, in this embodiment, we anticipate a large number of events that could potentially require deactivation, and we make a decision on a case-by-case basis for each event. Specifically, as shown in S161 of Figure 7, the system determines the distance to other vehicles and forcibly disengages automatic driving if the distance is not normal. Therefore, even if vehicle 1 is about to collide with another vehicle due to a malfunction of the automatic control function, the driver can avoid this collision through their own driving actions.

[0212] Furthermore, as shown in S162 of Figure 7, the system determines the relative speed with other vehicles and forcibly disengages automatic driving if the relative speed with other vehicles is not normal. Therefore, even if vehicle 1 is about to collide with another vehicle due to a malfunction of the automatic control function, the driver can avoid this collision through their own driving actions. Also, even if the speed of vehicle 1 differs from the speed of many surrounding vehicles and does not follow the flow of surrounding traffic due to a malfunction of the automatic control function, the driver can avoid this collision through their own driving actions.

[0213] Furthermore, as shown in S163 of Figure 7, the system assesses the behavior of the suspension and forcibly disengages automatic driving if the behavior is abnormal. Therefore, even if vehicle 1 exhibits abnormal behavior due to a malfunction of the automatic control function, the driver can avoid this through their own driving operations.

[0214] Furthermore, as shown in S164 of Figure 7, the system assesses the condition of the engine compartment (temperature and sound), and if it is not normal, it forcibly deactivates the automatic driving function. Therefore, if an abnormality occurs in the engine compartment due to a malfunction of the automatic control function, the driver can minimize the impact through their own driving operations.

[0215] Furthermore, as shown in S165 of Figure 7, if an abnormal current occurs in the electrical wiring within the vehicle 1 (specifically, the electrical wiring on which the current sensor 19 is installed), the automatic operation is forcibly canceled. Therefore, even if an excessive current flows due to a lightning strike or the like, the automatic control function is canceled. This makes it possible to prevent malfunctions that could cause the vehicle 1 to become unstable during operation.

[0216] Furthermore, as shown in S166 and S167 of Figure 7, the system is designed to forcibly deactivate automatic driving if a tire punctures or slips. Therefore, if the reliability of driving by the automatic control function decreases due to a tire puncture or slip, the driver can appropriately operate vehicle 1 through their own driving actions (for example, by slowly decelerating and coming to a stop, or by smoothly recovering from a slipping state).

[0217] Furthermore, as shown in S168 of Figure 7, the system is configured to forcibly disengage automatic driving if the steering state of the steering wheels is not normal. Therefore, even if the steering wheels of vehicle 1 exhibit abnormal behavior due to a malfunction of the automatic control function, the driver can avoid this through their own driving operations.

[0218] Furthermore, as shown in S201 and S202 of Figure 8, if contact with a specific contact area inside the vehicle by an occupant is detected, or if the emergency stop lever is operated by an occupant, the automatic driving system is forcibly deactivated in both cases. Therefore, the driver can quickly deactivate the automatic driving system at their own discretion if a situation arises in which they want to deactivate the automatic driving system, such as when the behavior of vehicle 1 becomes unstable.

[0219] Furthermore, as shown in S203 of Figure 8, the system is configured to forcibly deactivate automatic driving if an external impact is detected. Therefore, even if an external impact may cause the automatic control function to malfunction, the driver can still operate vehicle 1 appropriately through their own driving operations.

[0220] Furthermore, as shown in S204 of Figure 8, if the driver's behavior is abnormal (for example, if the driver shows an expression of surprise or fear), the automatic driving system is forcibly deactivated. Therefore, even if the vehicle 1's driving state becomes unstable due to a malfunction of the automatic control function or other reasons, to the point where the driver shows an expression of surprise or fear, the driver can quickly avoid this situation through their own driving actions.

[0221] Furthermore, as shown in S205, S206, and S207 of Figure 8, the system is designed to forcibly deactivate automatic driving if the vehicle attracts the attention of pedestrians, if pedestrians looking at the vehicle exhibit abnormal behavior (for example, pointing at the vehicle with a surprised expression), if another vehicle honks its horn, or if another vehicle flashes its headlights. This is because any action taken by pedestrians or other vehicles towards the vehicle suggests that the vehicle's driving condition may be unstable, and this could be due to a malfunction of the automatic control function.

[0222] Furthermore, as shown in S251-S253 of Figure 9, the system is designed to forcibly deactivate automatic driving in the event of severe weather conditions such as heavy rain, heavy snow, or dense fog. Therefore, even if the automatic control function malfunctions due to severe weather and the vehicle 1 becomes unstable, the forced deactivation of automatic driving allows the driver to operate the vehicle 1 appropriately.

[0223] Furthermore, as shown in S254 of Figure 9, the automatic driving system is forcibly deactivated when vehicle 1 is traveling in a section requiring special attention. This makes it possible to drive appropriately through the section requiring special attention using the driver's own driving operations, without relying on the automatic control function.

[0224] Furthermore, as shown in Figure 10B, if the vehicle travels to a location it has traveled to before, and a specific control operation that was performed in the past is not performed this time, the automatic control function will operate normally. The system assumes that the vehicle is not operating and forcibly deactivates the autonomous driving function. This helps to prevent problems that could arise from malfunctions in the automatic control function.

[0225] Furthermore, in this embodiment, when an event requiring deactivation occurs, the automatic driving system is not unconditionally deactivated, but rather the occupants are notified that the automatic driving system will be deactivated (S117 in Figure 6). Then, when it is confirmed that the occupants have given a predetermined response or that the system is in a state where it is possible to deactivate the automatic driving system (YES in S118 in Figure 6), the automatic driving system is deactivated. As a result, the automatic driving system can be deactivated smoothly and appropriately, allowing the driver to take over the driving operation.

[0226] On the other hand, if the occupants are notified that the automatic driving system is being deactivated, but do not respond as prescribed (NO in S118), the system will automatically bring vehicle 1 to an emergency stop. Therefore, if, for example, the driver falls asleep or faints and becomes unable to drive vehicle 1, the system can quickly and appropriately stop vehicle 1, thereby preventing unforeseen incidents from occurring.

[0227] The control unit 30a corresponds to an example of an ambient information acquisition unit, an operating mode setting unit, an automatic control unit, a unit to determine an event requiring deactivation, a notification unit, and a unit to determine deactivation permission. Furthermore, the processes S40 and S50 in Figure 5 correspond to an example of the process of the operating mode setting unit. Also, the process of S55 in Figure 5 corresponds to an example of the process of the ambient information acquisition unit. Furthermore, the processes of S55 in Figure 5 and S118 to S120 in Figure 6 correspond to an example of the process of the automatic control unit. Furthermore, the process of S120 in Figure 6 corresponds to an example of the automatic stop process, which is a part of the process of the automatic control unit. Furthermore, the processes of S112, S113, S114 and S115 in Figure 6 correspond to an example of the process of the unit to determine an event requiring deactivation. Furthermore, the process of S117 in Figure 6 corresponds to an example of the process of the notification unit, and the process of S118 in Figure 6 corresponds to an example of the process of the unit to determine deactivation permission.

[0228] [Second Embodiment] Figure 11 shows the electrical configuration of the vehicle according to the second embodiment. In Figure 11, the same reference numerals are used for components that are the same as those in the vehicle 1 of the first embodiment, and their detailed descriptions are omitted.

[0229] As shown in Figure 11, the vehicle of this second embodiment includes an automatic driving control device 101 and a monitoring device 102. The automatic driving control device 101 has basically the same configuration and operates similarly to the automatic driving control device 101 of the first embodiment, except that it has a function to communicate data with the monitoring device 102 via the network 100. That is, the control unit 101a of the automatic driving control device 101 executes an automatic driving level setting process (see Figure 5) in accordance with various programs stored in the memory 101b, similar to the vehicle 1 of the first embodiment. It also executes an automatic control function based on the set automatic driving level.

[0230] In Figure 11, the cameras 2-6, radar devices 11-14, and sensors 16-27 of the vehicle 1 of the first embodiment shown in Figure 2 are collectively shown as a detection means group 111. Also in Figure 11, the communication units 31-35 of the vehicle 1 of the first embodiment shown in Figure 2 are collectively shown as a communication means group 112.

[0231] In this embodiment, the automatic driving control device 101 further periodically transmits the execution status of the automatic control function (result of control calculation) corresponding to the automatic driving level to the monitoring device 102 via the network 100 as one of the control information. In addition, if a release event occurs as a result of the automatic driving level setting process, the automatic driving control device 101 periodically transmits at least that fact (the fact that a release event has occurred) to the monitoring device 102 via the network 100 as one of the control information.

[0232] The monitoring device 102 is provided to monitor whether the various controls by the automatic driving control device 101 are functioning correctly. In other words, the monitoring device 102 basically has the same configuration as the automatic driving control device 101, and like the automatic driving control device 101, the control unit 102a performs control calculations for the automatic control function based on the set automatic driving level.

[0233] In other words, although the monitoring device 102 does not actually perform the automatic control function, it performs the control calculations for the automatic control function in the same way as the automatic driving control device 101. That is, both the automatic driving control device 101 and the monitoring device 102 perform the control calculations necessary to realize the automatic control function according to the set automatic driving level.

[0234] Therefore, assuming that the monitoring device is functioning normally, if the automatic driving control device 101 is functioning correctly, the results of the control calculations of both should be the same. On the other hand, if an abnormality occurs in the automatic driving control device 101 and the automatic control function does not operate normally, the results of the control calculations of both may differ (the calculation result of the automatic driving control device 101 may be abnormal).

[0235] Therefore, the monitoring device 102 compares its own control calculation result with the control calculation result of the automatic driving control device 101, and if the two do not match, it forcibly cancels the automatic control function of the automatic driving control device 101. Specifically, the control unit 102a of the monitoring device 102 executes the control state monitoring process shown in Figure 12.

[0236] When the control unit 102a of the monitoring device 102 starts the control state monitoring process shown in Figure 12, in S501 it executes calculation processing for the automatic control function corresponding to the set automatic driving level. In S502 it obtains the calculation result of the control calculation for the automatic control function in the automatic driving control device 101 from the automatic driving control device 101 via the network 100.

[0237] In S503, the calculation result obtained in S501 is compared with the calculation result obtained in S502 from the automatic driving control device 101 to determine whether the two match. If the two do not match (S503: NO), it is determined that the calculation result from the automatic driving control device 101 is not normal, and in S508, a forced release process is executed to forcibly cancel the automatic control function of the automatic driving control device 101.

[0238] Various specific details can be considered for the forced release process of S508. For example, the monitoring device 102 may instruct the driving control unit 46, the brake control unit 47, and the steering control unit 48 to ignore the control commands from the automatic driving control device 101, thereby causing each of these control units 46-48 to operate independently of the automatic driving control device 101 (i.e., automatic driving is released).

[0239] Alternatively, for example, by transmitting determination information indicating that the calculation results do not match to the automatic driving control device 101 via the network 100, the automatic driving control device 101 may be instructed to forcibly cancel automatic driving.

[0240] Furthermore, for example, switches may be provided between the automatic driving control device 101 and the driving control unit 46, between the automatic driving control device 101 and the brake control unit 47, and between the automatic driving control device 101 and the steering control unit 48, respectively, to enable or disable the electrical connection between them. By turning off at least one of these switches (i.e., disconnecting the electrical connection), the automatic driving control device 101 may be prevented from controlling the other components.

[0241] Furthermore, another possible reason for the calculation results from the automatic driving control device 101 being incorrect is that the automatic driving control device 101 is being illegally accessed from the outside. Therefore, a switch may be provided between the communication means group 112 and the automatic driving control device 101 to conduct or disconnect the electrical connection between them, and by turning this switch off (i.e., disconnecting the electrical connection), it may be possible to prevent physical access from the outside.

[0242] In S503, if the calculation results match (S503: YES), then in S504, it is determined whether or not an event requiring deactivation has occurred. Specifically, the determination of whether or not an event requiring deactivation has occurred is made by performing the exact same processing as in S112 to S115 in the automatic driving deactivation confirmation process of the first embodiment shown in Figure 6.

[0243] In S505, based on the judgment result in S504, it is determined whether or not a release event has occurred. If no release event has occurred (S505: NO), the control state monitoring process is terminated. If a release event has occurred (S505: YES), in S506, the judgment result of whether or not a release event has occurred in the automatic driving control device 101 is obtained from the automatic driving control device 101 via the network 100.

[0244] In S507, based on the results obtained in S506, it is determined whether or not the automatic driving control device 101 has also determined that an event requiring disengagement has occurred. If the automatic driving control device 101 has also determined that an event requiring disengagement has occurred, it is determined that the automatic driving control device 101 is operating normally, and the control state monitoring process is terminated. On the other hand, if the automatic driving control device 101 has not determined that an event requiring disengagement has occurred, it is determined that the automatic driving control device 101 is not operating normally for some reason, and the process proceeds to S508, where the forced disengagement process is executed as described above.

[0245] The vehicle of this second embodiment described above provides the following additional effects in addition to those of the first embodiment. Specifically, in this second embodiment, a monitoring device 102 is provided separately from the automatic driving control device 101. The monitoring device 102 also performs control calculations that are almost the same as those of the automatic driving control device 101, and the results of its calculations are compared with the results of the calculations performed by the automatic driving control device 101 to determine whether the automatic driving control device 101 is operating normally or not, depending on whether the two results match.

[0246] In other words, two independent computers are made to perform the same control calculations, and by checking whether the results of the calculations from both computers match, it is possible to determine whether one of the computers (in this case, the automatic driving control device 101) is operating normally or not.

[0247] If the calculation results of both do not match, the monitoring device 102 will execute a forced deactivation process (S508 in Figure 12) to forcibly deactivate the automatic driving. In the same manner as in the first embodiment, the automatic driving control device 101 will deactivate the automatic driving itself when a deactivation event occurs. In this second embodiment, in addition, the monitoring device 102 also performs a forced deactivation process to deactivate the automatic driving. Therefore, when a situation arises that requires the deactivation of automatic driving, it is possible to deactivate the automatic driving more reliably.

[0248] [Other embodiments] Although embodiments of this disclosure have been described above, this disclosure is not limited to the embodiments described above and can take various forms.

[0249] (1) The specific examples of events requiring disengagement shown in each of the above embodiments are merely examples. For other events that are considered to warrant disengaging automatic driving, it is also possible to determine whether or not they have occurred and to disengage automatic driving if they have occurred.

[0250] For example, in the first embodiment described above, an example was shown in which the automatic driving system is deactivated when the driver behaves abnormally, but it is also possible to deactivate the automatic driving system based on the behavior of other passengers other than the driver.

[0251] Furthermore, the system may decide whether or not to disengage autonomous driving not only based on the behavior of the occupants (including the driver), but also based on the content of the occupants' statements. For example, if someone says, "An ambulance is approaching from behind!", the system may disengage autonomous driving and hand over the driving to the driver. In other words, the system may be designed to disengage autonomous driving in response to specific words or sentences.

[0252] Furthermore, the infrastructure side may monitor the vehicle's driving status, and if the driving status is unstable (i.e., if the automatic control function may not be working properly), it may notify the vehicle in question via vehicle-to-infrastructure communication or similar means. The vehicle, upon receiving the above notification from the infrastructure side, may then forcibly deactivate the automatic driving function.

[0253] (2) In the above embodiment, the configuration was such that if an event requiring disengagement occurred when the autonomous driving level was level 1 or higher, the autonomous driving level could be set to 0 if an event requiring disengagement occurred when the level was higher than a predetermined level n (i.e., if the level was less than n, it could be ignored). Alternatively, the autonomous driving level could be set to 0 if an event requiring disengagement occurred when the driving mode was in the highly automated mode, and the setting of the basic mode could be maintained even if an event requiring disengagement occurred when the driving mode was in the basic mode.

[0254] Furthermore, it is not mandatory to reduce the autonomous driving level to level 0 when an event requiring disengagement occurs; it is acceptable to reduce it to a level at least lower than the current autonomous driving level. For example, if an event requiring disengagement occurs while in highly automated mode, the system may switch to basic mode.

[0255] (3) Cameras and radar devices necessary for realizing autonomous driving may be installed anywhere and in any number on Vehicle 1. The location and number of cameras and radar devices may be determined as appropriate to realize the desired automatic control functions. Furthermore, the in-vehicle equipment necessary for realizing autonomous driving is not limited to the various devices shown in Figures 1 and 2.

[0256] (4) In addition, the functions of one component in the above embodiment may be distributed among multiple components, or the functions of multiple components may be integrated into one component. Furthermore, at least a part of the configuration of the above embodiment may be replaced with a known configuration having a similar function. Furthermore, a part of the configuration of the above embodiment may be omitted. Furthermore, at least a part of the configuration of the above embodiment may be added to or replaced with the configuration of other above embodiments. Any aspect of the technical concept specified solely by the wording in the claims constitutes an embodiment of the present disclosure.

[0257] [Technical concept understood from the embodiments] From the various embodiments described in detail above, at least the following technical concepts can be understood. (A) An automatic driving control device installed in a vehicle, The surrounding information acquisition unit acquires surrounding information, which is information about the area around the vehicle, A driving mode setting unit sets the driving mode of the vehicle to either an advanced automation mode in which at least a portion of the multiple types of driving operations necessary for the vehicle's operation are automatically performed based on the surrounding information, or a basic mode in which the number of types of automatic driving operations, which are the driving operations that are automatically performed, is fewer than or zero than in the advanced automation mode. Based on the operating mode set by the operating mode setting unit, in that operating mode An automatic control unit that performs the automatic driving operation set in the above-mentioned automatic driving operation, When the aforementioned driving mode is set to a driving mode having at least one of the aforementioned automatic driving operations to be performed, a unit for determining whether a predetermined event requiring cancellation has occurred that causes at least one of the aforementioned automatic driving operations set in that driving mode to be cancelled, Equipped with, When the operating mode is set to an operating mode having at least one of the automatic driving operations to be executed, and the cancellation event determination unit determines that the cancellation event has occurred, the automatic control unit stops the execution of at least one of the set automatic driving operations. Automatic driving control system.

[0258] In the automated driving control system configured as described above, the deactivation event determination unit determines whether or not a deactivation event has occurred when the driving mode is set to the highly automated mode. Furthermore, even when the driving mode is set to the basic mode, if that basic mode is configured to perform at least one of several types of automated driving operations, the deactivation event determination unit will determine whether or not a deactivation event has occurred.

[0259] In other words, regardless of the type of driving mode set, if the system is configured to execute at least one of several types of automated driving operations, the system determines whether or not an event requiring cancellation has occurred. If it is determined that an event requiring cancellation has occurred, at least one of the automated driving operations being executed will be stopped.

[0260] An event requiring deactivation is an event that may occur due to the ongoing autonomous driving operation not being performed correctly, or an event that, while currently performing autonomous driving operations correctly, could cause disruption to autonomous driving operations if it occurs.

[0261] One or more events requiring deactivation may be pre-configured. If multiple events requiring deactivation are configured, the event requiring deactivation determination unit may determine whether or not each of the multiple events requiring deactivation has occurred, or it may determine whether or not some of the multiple events requiring deactivation have occurred. In the latter case, the unit may decide which of the multiple events requiring deactivation to be considered as appropriate. For example, based on the automatic driving operation set to be performed in the current driving mode, the unit may include at least one of the following as targets for consideration: an event requiring deactivation that occurs when the automatic driving operation fails to perform normally, and an event requiring deactivation that may interfere with the automatic driving operation.

[0262] Furthermore, the timing at which the event requiring cancellation determination unit determines whether or not an event requiring cancellation has occurred may be determined appropriately, in addition to the above. For example, depending on the number and types of automated driving operations set to be performed in the current driving mode, the unit may decide whether or not an event requiring cancellation has occurred, and if so, at what specific timing the decision should be made. (B) In the above (A), An automatic driving control device is configured such that the event requiring deactivation is that the operating state of the vehicle is in at least one of the following operating states: at least one operating state that may occur when the automatic driving operation set as the target of execution is not being executed properly, and at least one operating state that may cause the automatic driving operation set as the target of execution to not be executed properly.

[0263] In this way, by appropriately setting the operating state of a vehicle in which the autonomous driving operation may not be performed correctly (or may cease to be performed correctly) as an event requiring cancellation, the autonomous driving operation during execution It is possible to make an appropriate judgment as to whether or not to stop the rolling motion. (C) In (A) or (B) above, An automatic driving control device in which at least one of the following is set as the event requiring deactivation: the occupant of the vehicle exhibits a specific first behavior; a person around the vehicle exhibits a specific second behavior; and another vehicle around the vehicle performs a specific third action.

[0264] If an ongoing autonomous driving operation fails to function correctly, this will affect the vehicle's behavior. In response, the vehicle's occupants may exhibit certain behaviors (e.g., expressions of surprise or anxiety), people around the vehicle may exhibit certain behaviors (e.g., many people staring at the vehicle or pointing at it), or other vehicles (more specifically, the occupants of other vehicles) may take certain actions towards the vehicle (e.g., honking the horn or flashing their headlights). Therefore, by setting at least one of the first, second, and third behaviors as an event requiring deactivation, it is possible to appropriately determine whether or not to stop the ongoing autonomous driving operation. (D) In ​​any one of the above (A) to (C), An automatic driving control device in which the event requiring deactivation is set to be a specific environment around the vehicle that has been set in advance.

[0265] A specific environment means an environment in which the ongoing autonomous driving operation may not be executed properly, or an environment in which one or more specific autonomous driving operations should not be executed, and examples include bad weather such as heavy rain or thick fog. Also, for example, when the vehicle is traveling in an area where it is considered preferable to rely on the driver's own driving operation rather than autonomous driving, such as a school zone or an accident-prone area.

[0266] By setting the presence of the vehicle in such a specific environment as a cancellation event, it is possible to appropriately determine whether the ongoing autonomous driving operation should be stopped.

Explanation of Signs

[0267] 1... Vehicle, 2... Front camera, 3... Rear camera, 4... Left side camera, 5... Right side camera, 6... Interior camera, 9... Front window, 10... Steering wheel, 11... Front radar device, 12... Rear radar device, 13... Left side radar device, 14... Right side radar device, 16... Solar radiation sensor, 17... Rainfall sensor, 18... Wheel speed sensor, 19... Current sensor, 20... Steering amount sensor, 21... Interior contact sensor, 22... Engine room temperature sensor, 23... Engine room sound sensor, 24... Tire air pressure sensor, 25... Suspension sensor, 26... Exterior sound sensor, 27... Impact sensor, 30, 101... Autonomous driving control device, 30a, 101a, 102a... Control unit, 30b, 101b, 102b... Memory, 31... GPS communication unit, 32... Inter-vehicle communication unit, 33... Road-vehicle communication unit, 34... Pedestrian-vehicle communication unit, 35... LTE communication unit, 36... Operation unit, 37... Display unit, 38... Speaker, 41... Autonomous driving switch, 42... Level setting operation unit, 43... Emergency stop lever, 44... Release reset switch, 46... Travel drive control unit, 47... Brake control unit, 48... Steering control unit, 81... Road communication device, 82... Camera, 100... Network, 102... Monitoring device, 111... Detection means group, 112... Communication means group.

Claims

1. A vehicle equipped with an electric motor as a drive source during operation and equipped with a driving control device, The vehicle has a front camera, a left-side radar system, and a right-side radar system. The aforementioned operation control device is The driving mode can be set to an advanced automation mode in which there are many types of driving operations, in which at least a portion of the multiple types of driving operations necessary for the vehicle to run are executed based on information about the vehicle's surroundings, and a basic mode in which there are fewer types of driving operations than in the advanced automation mode. Based on the aforementioned operating mode, the operating operation set in that operating mode is executed. At least when the driving mode is the highly automated mode, it is determined whether the driver's behavior is normal or not. If the driver's behavior is deemed abnormal, it is determined whether the driver is holding the steering wheel with at least one hand. If it is determined that the driver is not holding the steering wheel with at least one hand, the system is configured to perform a predetermined stopping process to stop the vehicle from moving. A vehicle characterized in that, when the driving mode is set to the highly automated mode, it is configured to perform at least the following (a). (a) Automatic start / stop control, which stops the vehicle when the conditions for stopping are met while driving, and starts the vehicle again when the conditions for stopping are released after it has stopped.

2. The vehicle according to Claim 1, The aforementioned vehicle further has a display unit, The vehicle is characterized in that, when the driving control device determines that the driver's behavior is abnormal, it visually sends a message to the driver using the display unit.

3. The vehicle according to Claim 1, The aforementioned vehicle further has an interior camera, The vehicle is characterized in that the driving control device monitors the driver's behavior using data captured by the interior camera.

4. The vehicle according to claim 3, The aforementioned vehicle is further characterized by having an impact sensor.

5. The vehicle according to Claim 1, The vehicle is further characterized by storing the position in which the driving operation was performed.

6. A vehicle equipped with an electric motor as a drive source during travel and equipped with a driving control device, The vehicle has a front camera, a left-side radar system, and a right-side radar system. The aforementioned operation control device is The driving mode can be set to an advanced automation mode in which there are many types of driving operations, in which at least a portion of the multiple types of driving operations necessary for the vehicle to run are executed based on information about the vehicle's surroundings, and a basic mode in which there are fewer types of driving operations than in the advanced automation mode. Based on the aforementioned operating mode, the operating operation set in that operating mode is executed. At least when the driving mode is the highly automated mode, it is determined whether the driver's behavior is normal or not. If the driver's behavior is deemed abnormal, it is determined whether the driver is holding the steering wheel with at least one hand. If it is determined that the driver is not holding the steering wheel with at least one hand, the system is configured to perform a predetermined stopping process to stop the vehicle from moving. A vehicle characterized in that, when the driving mode is set to the highly automated mode, it is configured to perform at least the following (b). (b) Lane change control, which, when steering is required to change lanes, detects other vehicles in the adjacent lane to be changed to, and controls the driving force, braking force, or steering to change lanes in a way that avoids collision with the other vehicle in the adjacent lane, depending on the presence, position, or speed of the other vehicle in the adjacent lane.

7. The vehicle according to claim 6, The aforementioned vehicle further has a display unit, The vehicle is characterized in that, when the driving control device determines that the driver's behavior is abnormal, it visually sends a message to the driver using the display unit.

8. The vehicle according to claim 6, The aforementioned vehicle further has an interior camera, The vehicle is characterized in that the driving control device monitors the driver's behavior using data captured by the interior camera.

9. The vehicle according to claim 8, The aforementioned vehicle is further characterized by having an impact sensor.

10. The vehicle according to claim 6, The vehicle is further characterized by storing the position in which the driving operation was performed.

11. A vehicle equipped with an electric motor as a drive source during travel and equipped with a driving control device, The vehicle has a front camera, a left-side radar system, and a right-side radar system. The aforementioned operation control device is The driving mode can be set to an advanced automation mode in which there are many types of driving operations, in which at least a portion of the multiple types of driving operations necessary for the vehicle to run are executed based on information about the vehicle's surroundings, and a basic mode in which there are fewer types of driving operations than in the advanced automation mode. Based on the aforementioned operating mode, the operating operation set in that operating mode is executed. At least when the driving mode is the highly automated mode, it is determined whether the driver's behavior is normal or not. If the driver's behavior is deemed abnormal, it is determined whether the driver is holding the steering wheel with at least one hand. If it is determined that the driver is not holding the steering wheel with at least one hand, the system is configured to perform a predetermined stopping process to stop the vehicle from moving. A vehicle characterized in that, when the driving mode is set to the highly automated mode, it is configured to perform at least the following (d). (d) Collision prevention control, which is a control that steers the vehicle to avoid colliding with an obstacle when an obstacle is present on the road in the direction of travel of the vehicle.

12. The vehicle according to claim 11, The aforementioned vehicle further has a display unit, The vehicle is characterized in that, when the driving control device determines that the driver's behavior is abnormal, it visually sends a message to the driver using the display unit.

13. The vehicle according to claim 11, The aforementioned vehicle further has an interior camera, The vehicle is characterized in that the driving control device monitors the driver's behavior using data captured by the interior camera.

14. The vehicle according to claim 13, The aforementioned vehicle is further characterized by having an impact sensor.

15. The vehicle according to claim 11, The vehicle is further characterized by storing the position in which the driving operation was performed.

Images