Control system for vehicle
Patent Information
- Application Number
- JP2024517139
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2024-03-18
- Publication Date
- 2024-12-17
- Estimated Expiration
- 2043-01-18
Abstract
Description
Vehicle Control Systems
[0001] The present invention relates to a vehicle control system.
[0002] It has been proposed to use a server device for controlling the running of a vehicle such as an automobile (Patent Document 1).
[0003] International Publication No. 2021 / 038741
[0004] When vehicle driving is controlled using a server device in this manner, the traffic control system basically executes the following control: The server device acquires driving information for a plurality of vehicles, generates individual control information for each of the plurality of vehicles based on the acquired information, and transmits each individual control information to each of the plurality of vehicles. When each vehicle receives the individual control information addressed to itself, it uses the individual control information to generate control values to be actually used for driving control of its own vehicle, and executes driving control using the generated control values. Then, by repeatedly executing the control of the server device and the control of each of the plurality of vehicles, it is expected that each vehicle will be able to drive with improved safety, etc., under the control of the server device.
[0005] However, it is difficult to deny that a malfunction may occur in the server device while multiple vehicles are controlling their respective driving under the control of such a server device. For example, it is generally considered that there is a non-zero possibility that inconsistencies may occur in the programs used by the server device. For example, there is a non-zero possibility that inconsistencies between programs may occur in the server device due to program bugs, program updates, etc. Furthermore, the server device must be connected to a communication network. As a result, the server device may be subject to unauthorized access from outside. There is also a non-zero possibility that the server device may be hijacked and its programs may be rewritten. Even if such a malfunction occurs in the server device, vehicles actually traveling on the road are required to travel safely. Furthermore, each vehicle is also required to travel in a manner that does not impede the driving of other vehicles.
[0006] In a vehicle control system that uses a server device for vehicle driving control in this way, it is required to be able to respond to malfunctions in the server device for each vehicle that can run under the control of the server device.
[0007] A vehicle control system according to one embodiment of the present invention includes a plurality of vehicles each having a driving control unit capable of generating a control value for controlling the driving of the vehicle itself, and a server device that generates individual remote control values for each of the plurality of vehicles based on driving information for the plurality of vehicles and transmits the individual remote control values to the plurality of vehicles, wherein the driving control unit of each of the plurality of vehicles generates a control value for driving control of the vehicle itself using the individual remote control value addressed to the vehicle itself received from the server device, and the driving control unit of each of the plurality of vehicles determines whether or not there is a malfunction with the server device, and if it is determined that there is no malfunction with the server device, performs subordinate driving control to generate the control value using the individual remote control value received from the server device together with information from the vehicle's sensors, and if it is determined that there is a malfunction with the server device, performs autonomous driving control to generate the control value using information from the vehicle's sensors or information obtained by manual operation, without using the individual remote control value received from the server device.
[0008] In the present invention, in each of a plurality of vehicles, a driving control unit capable of generating control values for controlling the driving of the vehicle determines whether or not the server device has a malfunction. If it is determined that the server device does not have a malfunction, the driving control unit executes subordinate driving control to generate control values using information from the vehicle's sensors and individual remote control values received from the server device. This allows each vehicle to drive in accordance with the individual remote control values of the server device that has not been determined to have a malfunction. Furthermore, if it determines that the server device has a malfunction, the driving control unit executes autonomous driving control to generate control values using information from the vehicle's sensors or information obtained by manual operation. In this case, the driving control unit generates control values without using the individual remote control values received from the server device that has been determined to have a malfunction. This allows each vehicle not to drive in accordance with the individual remote control values of the server device that has been determined to have a malfunction.
[0009] In this way, in the present invention, each vehicle in a vehicle control system that uses a server device for vehicle driving control can deal with any malfunction in the server device.
[0010] FIG. 1 is a configuration diagram of an automobile control system according to an embodiment of the present invention. FIG. 2 is an explanatory diagram of the control system of the automobile of FIG. 1. FIG. 3 is an explanatory diagram of the basic hardware configuration of the automobile driving control device of FIG. 2. FIG. 4 is a basic flowchart of autonomous driving control by the automobile driving control device of FIG. 3. FIG. 5 is a hardware configuration diagram of the server device of FIG. 1. FIG. 6 is a basic timing chart of individual control of multiple automobiles in the control system of FIG. 1. FIG. 7 is a basic flowchart of control selection control by the automobile driving control device of FIG. 3. FIG. 8 is a flowchart of fault determination control of the server device by the automobile driving control device of FIG. 3. FIG. 9 is a flowchart of basic remote control information transmission control by the server device of FIG. 1. FIG. 10 is an explanatory diagram of a method of fault determination of the server device by the automobile driving control device. FIG. 11 is an explanatory diagram of a method of fault determination of the server device by the automobile driving control device.
[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
[0012] 1 is a configuration diagram of a control system 1 for a vehicle 2 according to an embodiment of the present invention. The control system 1 in FIG. 1 includes a plurality of vehicles 2 traveling on a road 90, and a server device 3 that transmits and receives information to and from the plurality of vehicles 2 via a communication system 6.
[0013] Here, automobile 2 is an example of a vehicle. Other examples of vehicles include trucks, buses, motorcycles, and personal mobility vehicles. In Fig. 1, multiple automobiles 2 are traveling in sequence on road 90. Some of the automobiles 2 are parked in a parking lot 95 facing road 90.
[0014] The communication system 6 includes a plurality of base stations 7 arranged along a road 90 and a communication network 8 to which the plurality of base stations 7 are connected. The base stations 7 may be, for example, commercial 5G base stations or base stations for intelligent transportation systems such as ADAS (Advanced Driver Assistance Systems). The communication network 8 may be configured from a carrier communication network that provides 5G base stations, the Internet connected to the carrier communication network, or the like.
[0015] The server device 3 includes a server main body 4 connected to the communication network 8 of the communication system 6 and a server DB 5 connected to the server main body 4. The server device 3 basically only needs to be connected to the Internet of the communication system 6, but may also be connected to a carrier communication network. Furthermore, the server device 3 may not be configured with a single server main body 4, but may instead be configured with multiple server main bodies 4 that cooperate with each other to execute distributed control. The multiple server main bodies 4 may be hierarchical, for example. The multiple server main bodies 4 at the lowest level in the hierarchy may be connected to the carrier communication network in a distributed manner according to the region, etc. Such a server main body 4 may be realized in a control device of a 5G base station, for example.
[0016] The server device 3 in FIG. 1 performs individual control of multiple automobiles 2 within the communication range of a communication system 6, which is composed of zones of at least three base stations 7 shown in the figure. Also shown in FIG. 1 are Global Navigation Satellite System (GNSS) satellites 110. The GNSS satellites 110 broadcast signals containing information about their position and time to the Earth. By receiving signals from multiple GNSS satellites 110, a GNSS receiver can obtain information about its own position and time. The position and time of each GNSS receiver can be used as highly reliable information that is unlikely to cause errors compared to the positions and times of other GNSS receivers.
[0017] Fig. 2 is an explanatory diagram of the control system 10 of the automobile 2 of Fig. 1. Each of the plurality of automobiles 2 shown in Fig. 1 may be equipped with the control system 10 of Fig. 2.
[0018] The control system 10 of the automobile 2 in Fig. 2 has a vehicle network 19 and a plurality of control devices connected thereto. In Fig. 2, examples of the plurality of control devices include a sensor control device 11, a driving control device 12, a drive control device 13, a steering control device 14, a braking control device 15, and an external vehicle communication control device 16. The control system 10 of the automobile 2 may also include other control devices, such as an operation control device that acquires information on manual driving operations by the occupant.
[0019] The vehicle network 19 may be a vehicle-specific network such as a Controller Area Network (CAN) or a Local Interconnect Network (LIN). Alternatively, the vehicle network 19 may include a commonly used network such as IEEE (Institute of Electrical and Electronics Engineers) 802.3 or IEEE 802.11. By using such a vehicle network 19, each control device can input and output information to and from other control devices via the vehicle network 19.
[0020] The sensor control device 11 controls the operation of various vehicle sensors provided in the automobile 2, and outputs detected information or processed information from the various vehicle sensors to other control devices via the vehicle network 19. In Fig. 2, a GNSS receiver 21, an outside vehicle camera 22, and an acceleration sensor 23 are connected to the sensor control device 11 as examples of vehicle sensors. In addition to these, a vehicle speed sensor, a steering sensor, and the like may also be connected to the sensor control device 11.
[0021] The GNSS receiver 21 generates information on the position and time of the automobile 2 .
[0022] The exterior camera 22 captures images of the surroundings of the automobile 2 traveling on the road 90 or the like. The exterior camera 22 may be a monocular camera, a compound eye camera, or a 360-degree camera. It is desirable that the exterior camera 22 be capable of capturing images of at least the front side of the traveling automobile 2. The sensor control device 11 may generate information on the relative distance and direction of other automobiles around the host vehicle based on the images captured by the exterior camera 22.
[0023] The acceleration sensor 23 detects the acceleration of the automobile 2. By using a sensor that detects acceleration in three axial directions as the acceleration sensor 23, the sensor control device 11 can generate information on the angular acceleration of the automobile 2 in each of the yaw, pitch, and roll directions.
[0024] The vehicle speed sensor detects the speed of the automobile 2. The steering sensor detects the rudder angle of a steering wheel (not shown) of the automobile 2.
[0025] A vehicle communication device 29 provided in the automobile 2 is connected to the exterior-vehicle communication control device 16. The vehicle communication device 29 establishes a wireless communication path with a base station 7 with which communication is possible. The exterior-vehicle communication control device 16 controls the operation of the vehicle communication device 29 and transmits and receives information to and from the server device 3 via the vehicle communication device 29 and the base station 7. For example, the exterior-vehicle communication control device 16 outputs information that the vehicle communication device 29 receives from the server device 3 or the base station 7 to other control devices via the vehicle network 19. The exterior-vehicle communication control device 16 transmits information input from other control devices via the vehicle network 19 to the server device 3 via the vehicle communication device 29 and the base station 7.
[0026] The drive control device 13 is connected to drive system components provided in the automobile 2, such as an engine that generates drive power using, for example, gasoline or hydrogen as fuel, a motor that generates drive power using electricity, a transmission, etc. The drive control device 13 controls the operation of these drive system components using control values obtained via the vehicle network 19.
[0027] The steering control device 14 is connected to, for example, a steering device provided in the automobile 2. The steering control device 14 controls the operation of the steering device using control values acquired through the vehicle network 19.
[0028] The braking control device 15 is connected to a braking device provided in the automobile 2. The braking control device 15 controls the operation of the braking device based on a control value acquired via the vehicle network 19.
[0029] The cruise control device 12 controls the driving of the automobile 2. When the automobile 2 is driven autonomously without the operation of the occupant, the cruise control device 12 acquires information on the driving state of the automobile 2 and information on the surrounding area of the automobile 2 from the sensor control device 11 and generates control values according to the acquired information. For example, when the cruise control device 12 determines that another moving object is approaching in front of the automobile 2 based on the latest captured image from the exterior camera 22, the cruise control device 12 generates a control value for the braking control device 15 to decelerate or stop the automobile 2. When the cruise control device 12 determines that the stopped automobile 2 is ready to start based on the latest captured image from the exterior camera 22, the cruise control device 12 generates a control value for the drive control device 13 to accelerate the automobile 2. When the cruise control device 12 determines that the automobile 2 is likely to deviate from the lane it is traveling in based on the latest captured image from the exterior camera 22, the cruise control device 12 generates a control value for the steering control device 14 to change the traveling direction of the automobile 2. Furthermore, when the position of the GNSS receiver 21 is compared with the high-precision map data and it is determined that the vehicle needs to turn right, turn left, or change lanes, the cruise control device 12 generates a control value for the steering control device 14 to change the direction of travel of the vehicle. In this way, the cruise control device 12 can cause the automobile 2 to travel autonomously through autonomous decision-making control based on detection by the vehicle's sensors.
[0030] Fig. 3 is an explanatory diagram of the basic hardware configuration of the cruise control device 12 of the automobile 2 in Fig. 2. The cruise control device 12 in Fig. 3 has a vehicle CPU (Central Processing Unit) 73, a vehicle memory 72, an input / output device 71 connected to the vehicle network 19, and a vehicle internal bus 79 to which these are connected. A timer or the like may also be connected to the vehicle internal bus 79.
[0031] The input / output device 71 inputs and outputs information to and from other control devices via the vehicle network 19. This allows the driving control device 12 to obtain information used for its control.
[0032] The vehicle memory 72 stores programs, setting values, detected values, and the like for driving control. Fig. 3 shows an example of high-precision map data 74 stored in the vehicle memory 72. The vehicle memory 72 may be configured, for example, by a semiconductor memory, a hard disk drive (HDD), or the like.
[0033] The vehicle CPU 73 reads and executes a program from the vehicle memory 72. This allows the driving control device 12 to implement a control unit.
[0034] Fig. 4 is a basic flowchart of the autonomous driving control by the driving control device 12 of the automobile 2 in Fig. 3. The vehicle CPU 73 of the driving control device 12 repeatedly executes the autonomous driving control of Fig. 4.
[0035] In step ST1, the vehicle CPU 73 of the cruise control device 12 collects and acquires vehicle information, such as information indicating the driving state of the vehicle and information about the driving environment around the vehicle, from the sensor control device 11 of the vehicle and other devices. The information acquired from the sensor control device 11 of the vehicle and other devices may be acquired in advance and stored in the vehicle memory 72 of the cruise control device 12 and other devices. Here, the vehicle information may include, for example, information about the position, direction, speed, acceleration, and direction of travel of the vehicle and other vehicles around the vehicle contained in an image captured by an in-vehicle camera. The vehicle CPU 73 may generate this information by processing the information acquired from the sensor control device 11 and other devices. The vehicle information may also include information indicating the operating states, control contents, and control results of the drive control device 13, steering control device 14, braking control device 15, and other devices. The vehicle information may also include time information generated by the GNSS receiver 21.
[0036] In step ST2, the vehicle CPU 73 of the driving control device 12 generates control values for autonomously controlling the driving of the vehicle based on the information acquired in step ST1. The vehicle CPU 73 generates control values for driving control of the vehicle in accordance with the vehicle information so as to suppress interference with other vehicles, etc. As a result, the vehicle CPU 73 generates, for example, a control value for accelerating the vehicle 2, a control value for maintaining the speed, a control value for decelerating the vehicle, a control value for stopping the vehicle, a control value for maintaining the speed, a steering control value for maintaining the lane, and a steering control value for changing the lane.
[0037] In step ST3, the vehicle CPU 73 of the cruise control device 12 outputs the control value generated in step ST2 to each control device that executes cruise control of the host vehicle via the vehicle network 19. As a result, for example, the drive control device 13 executes control to set the drive output to the control value. The steering control device 14 executes control to set the steering angle, including the steering direction, to the control value. The braking control device 15 executes control to set the braking force to the control value. This allows the automobile 2 to travel in accordance with the autonomous cruise control by the cruise control device 12. Thereafter, the vehicle CPU 73 of the cruise control device 12 ends this control.
[0038] In this way, each of the multiple automobiles 2 can generate control values for controlling the driving of its own vehicle through autonomous driving control by its driving control device 12.
[0039] Fig. 5 is a hardware configuration diagram of the server device 3 in Fig. 1. The server device 3 in Fig. 5 includes a server communication device 31, a server GNSS receiver 32, a server DB (server database) 5, a server memory 33, a server CPU 34, and a server internal bus 39 to which these are connected.
[0040] The server communication device 31 is connected to the communication network 8 of the communication system 6. The server communication device 31 transmits and receives information to and from the vehicle communication devices 29 provided in the automobiles 2. The server communication device 31 may receive driving information from each of the multiple automobiles 2.
[0041] The server GNSS receiver 32 generates information about the position and time of the server device 3. The time generated by the server GNSS receiver 32 can match the time generated by the GNSS receiver 21 of each vehicle 2 with high accuracy.
[0042] The server DB 5 accumulates and records various data used by the server device 3 for individual control of the plurality of automobiles 2. Such data includes, for example, driving information of each automobile 2. The server DB 5 may be provided with, for example, high-precision map data, a road regulation DB (road regulation database), a vehicle position / behavior DB (vehicle position / behavior database), and the like.
[0043] The server memory 33 stores data such as programs executed by the server CPU 34 .
[0044] The server CPU 34 reads and executes programs recorded in the server memory 33. This allows the server device 3 to function as a control unit for controlling its operation. The control unit generates individual control information, such as individual remote control values and individual control information, used for driving control of each vehicle 2, and transmits the information to each vehicle 2 in order to individually control the driving of each vehicle 2. The individual remote control values are the same type of control values generated by the driving control device 12 of each vehicle 2 and may be directly provided to a control device, such as the drive control device 13, that executes control in each vehicle 2. These individual remote control values are the control values generated in the autonomous driving control shown in FIG. 4 described above, which are generated by the server device 3 and transmitted to each vehicle 2. In this case, each vehicle 2 drives under remote control in accordance with the server device 3. In contrast, the individual control information may indicate requests made by the driving control device 12 of each vehicle 2 when generating the control values. Such individual control information may include information indicating requests regarding acceleration / deceleration, steering, lane changes, and the like. In this case, each vehicle 2 generates control values in response to requests from the server device 3 and travels under the control of the server device 3 .
[0045] The server CPU 34 may switch the individual control information generated for each vehicle 2 between individual remote control values and individual control information depending on the driving state of each vehicle 2. For example, when a vehicle 2 continues to travel along the road 90 of FIG. 1 , the server CPU 34 may generate individual control information as the individual control information for that vehicle 2. On the other hand, when a vehicle 2 travels from the road 90 of FIG. 1 to enter a parking lot 95, the server CPU 34 may generate individual remote control values as the individual control information for that vehicle 2. As a result, when the vehicle 2 continues to travel along the road 90 of FIG. 1 , the vehicle 2 can generate control values suitable for continuing to travel along the road 90 by following the individual control information and also using detection information from its own vehicle sensor. Furthermore, when the vehicle 2 travels from the road 90 of FIG. 1 to a parking lot 95, the vehicle 2 can generate control values in accordance with the individual remote control values from the server device, which is aware of the state of the parking lot 95, and travel toward the parking lot 95. The automobile 2 can travel safely in accordance with instructions from the server device 3 based on information beyond the range detectable by the automobile's own vehicle sensors.
[0046] Fig. 6 is a basic timing chart of the individual control of multiple automobiles 2 in the control system 1 of Fig. 1. For ease of explanation, Fig. 6 shows only one automobile 2. Fig. 6 shows an example in which each automobile 2 travels under subordinate travel control (step ST20) in accordance with the individual remote control value of the server device 3. In Fig. 6, time flows from top to bottom.
[0047] In the case of the secondary driving control in step ST20, the driving control device 12 of the automobile 2 first collects and acquires vehicle information about the automobile in step ST71, and then transmits the driving information of the automobile to the server device 3 (step ST72). As a result, the server device 3 collects driving information of multiple automobiles 2. Here, the driving information may basically be composed of information necessary for processing by the server device 3. The driving information may be the vehicle information itself or a part of the vehicle information. However, it is desirable that the driving information include at least information indicating the position, speed, etc. of the automobile 2.
[0048] When the server CPU 34 of the server device 3 receives the driving information from the vehicle 2, it calculates the position of the vehicle 2 (vehicle S position) based on the received driving information (step ST81). Here, the vehicle S position may indicate, for example, the lane of the road 90 on which the vehicle 2 is driving and the position on that lane, using high-precision map data. This allows the server device 3 to map each vehicle 2 to the high-precision map data, etc. The driving positions and driving conditions of multiple vehicles 2 are mapped onto the high-precision map data, etc.
[0049] Next, the server CPU 34 of the server device 3 determines the possibility of future interference between the multiple vehicles 2 (step ST82). For example, if the vehicle 2 traveling behind is traveling faster than the vehicle 2 traveling in front of it in the same lane, the server CPU 34 of the server device 3 determines that there is a possibility that the vehicles 2 will interfere with each other in the future.
[0050] Next, the server CPU 34 of the server device 3 generates individual control information for each of the plurality of automobiles 2 (step ST83) and transmits the information to each automobile 2 (step ST84). When remote control is to be performed, the server CPU 34 generates an individual remote control value as the individual control information. When traffic control is to be performed, the server CPU 34 generates individual traffic control information as the individual control information.
[0051] Upon receiving the individual control information from the server device 3, the cruise control device 12 of the automobile 2 generates a control value to be output to each control device that performs cruise control on the automobile 2 based on the individual control information received from the server device 3 (step ST73). The cruise control device 12 then outputs the generated control value to the drive control device 13, the steering control device 14, or the braking control device 15. As a result, for example, the drive control device 13 executes control to set the drive output as the control value. The steering control device 14 executes control to set the steering angle, including the steering direction, as the control value. The braking control device 15 executes control to set the braking force as the control value. Here, if each cruise control device 12 of the multiple automobiles 2 receives an individual remote control value from the server device 3, it can use the individual remote control value as the control value as is. However, the cruise control device 12 of this embodiment generates a control value that suppresses changes in cruise compared to the individual remote control value received from the server device 3.
[0052] Through this series of cooperative controls, the automobiles 2 can travel under the individual control of the server device 3 and in accordance with the individual control information generated by the server device 3. The server device 3 can generate individual control information, such as individual remote control values for each of the plurality of automobiles 2, based on the travel information for the plurality of automobiles 2, and transmit the information to the plurality of automobiles 2. Furthermore, the travel control device 12 of each of the plurality of automobiles 2 can generate control values for travel control of its own vehicle using the latest individual control information addressed to its own vehicle that is received from the server device 3. Under the individual control of the server device 3, the plurality of automobiles 2 can perform travel control basically in accordance with the instructions of the server device 3, thereby enabling the automobiles 2 to travel safely without interfering with each other.
[0053] However, it is difficult to deny the possibility that a malfunction may occur in the server device 3 while the driving of each of the multiple automobiles 2 is being controlled under the control of such a server device 3. For example, it is generally considered that there is a non-zero possibility that inconsistencies may occur in the programs used by the server device 3. For example, there is a non-zero possibility that inconsistencies between programs may occur in the server device 3 due to program bugs, program updates, etc. Furthermore, the server device 3 must be connected to a communication network 8 such as the Internet. As a result, the server device 3 may be subject to unauthorized access from outside. There is also a non-zero possibility that the server device 3 may be hijacked and its programs may be rewritten. Even if such a malfunction occurs in the server device 3, each automobile 2 traveling on the road is required to travel safely. Furthermore, each automobile 2 is also required to travel in a manner that does not impede the driving of other vehicles.
[0054] Fig. 7 is a basic flowchart of the control selection control by the cruise control device 12 of the automobile 2 of Fig. 3. The vehicle CPU 73 of the cruise control device 12 repeatedly executes the control for control selection in Fig. 7 in order to dynamically switch the cruise control of the host vehicle between the autonomous cruise control of Fig. 4 and the slave cruise control of Fig. 6 described above.
[0055] Furthermore, as will be described later in FIG. 9 , when it is necessary to force each vehicle 2 to perform remote control, the server device 3 repeatedly transmits remote control information including significant forcing information to each vehicle 2. Furthermore, as will be described later in FIG. 9 , when it is necessary to recommend remote control to each vehicle 2, the server device 3 repeatedly transmits remote control information including significant recommendation information to each vehicle 2. In the remote control information, at most one of the forcing information and the recommendation information can be significant. The forcing information is information that the server device 3 uses to request each vehicle 2 to follow the individual remote control value. The recommendation information is information that the server device 3 uses to recommend each vehicle 2 to follow the individual remote control value. Basically, the server device 3 may make the forcing information significant when an emergency occurs, and make the recommendation information significant when the vehicle 2 is traveling in a parking lot 95.
[0056] Furthermore, if the server device 3 determines that there is a problem with its own control, it transmits a notification of the problem to each vehicle 2 .
[0057] In step S11, the vehicle CPU 73 of the driving control device 12 determines whether the vehicle communication device 29 has received a malfunction notification from the server device 3. If a malfunction notification has been received from the server device 3, the vehicle CPU 73 proceeds to step ST16 to execute autonomous driving control. In this case, the vehicle CPU 73 proceeds to step ST16 without determining by itself in step ST15 that there is a malfunction in the server device 3. If a malfunction notification has not been received from the server device 3, the vehicle CPU 73 proceeds to step ST12.
[0058] In step S12, the vehicle CPU 73 of the driving control device 12 diagnoses the operation of its own driving control device 12 and determines for itself whether or not there is a malfunction in its own autonomous driving control. The vehicle CPU 73 may determine that there is a malfunction in its own autonomous driving control if it cannot obtain periodic control values from its own autonomous driving control, which is operating steadily. The vehicle CPU 73 may also determine that there is a malfunction in its own driving control if a watchdog timer that is reset in its own autonomous driving control has timed out. If it determines that there is a malfunction in its own driving control, the vehicle CPU 73 proceeds to step ST20 to execute subordinate driving control. If it does not determine that there is a malfunction in its own driving control, the vehicle CPU 73 proceeds to step ST13.
[0059] In step S13, the vehicle CPU 73 of the driving control device 12 determines whether a collision of the vehicle is predicted based on images captured by the exterior camera 22, etc. For example, the vehicle CPU 73 may predict the possibility of a collision with another vehicle, etc., based on detection information from the vehicle sensor, such as an image of the driving direction. If a collision of the vehicle is predicted, the vehicle CPU 73 proceeds to step ST16 to execute autonomous driving control to deal with the collision. If a collision of the vehicle is not predicted, the vehicle CPU 73 proceeds to step ST14.
[0060] In step S14, the vehicle CPU 73 of the driving control device 12 determines whether or not there is a malfunction in the server device 3. Details of the determination will be described later.
[0061] In step S15, the vehicle CPU 73 of the driving control device 12 determines, based on the determination result of step S14, whether or not there is a malfunction in the server device 3. If it is determined that there is no malfunction in the server device 3, the vehicle CPU 73 proceeds to step ST20 to execute secondary driving control. If it is determined that there is a malfunction in the server device 3, the vehicle CPU 73 proceeds to step ST16.
[0062] In step S16, the vehicle CPU 73 of the driving control device 12 starts autonomous driving control. The vehicle CPU 73 first obtains the latest remote control information obtained from the server device 3. As described above, in the remote control information, only one of the mandatory information and the recommended information can be set to be significant.
[0063] In step S17, the vehicle CPU 73 of the driving control device 12 determines whether the compulsion information is determined to be significant in the remote control information acquired in step S16. If the compulsion information is determined to be significant, the vehicle CPU 73 proceeds to step ST19. If the compulsion information is not determined to be significant, the vehicle CPU 73 proceeds to step ST18.
[0064] In step S18, because the forcible information is not significant, the vehicle CPU 73 of the driving control device 12 executes autonomous driving control using the detection information of the vehicle's sensors to continue the current driving. Thereafter, the vehicle CPU 73 terminates this control. In this manner, if the vehicle CPU 73 of the driving control device 12 determines that the server device 3 has a malfunction and, further, if the remote control recommendation information in the remote control information received from the server device 3 is significant, the vehicle CPU 73 can continue driving the vehicle through autonomous driving control. If the vehicle CPU 73 determines that the server device 3 has a malfunction, it executes autonomous driving control that generates a control value using information from the vehicle's sensors, without using the individual remote control value received as individual control information from the server device 3. Alternatively, the vehicle CPU 73 may generate a control value using information obtained by manual operation by an occupant of the vehicle.
[0065] In step S19, because the compulsory information is determined to be significant, the vehicle CPU 73 of the driving control device 12 executes autonomous driving control using the detection information from the vehicle's sensors to bring the vehicle to an emergency stop. The vehicle CPU 73 then terminates this control. In this way, the vehicle CPU 73 of the driving control device 12 determines that there is a malfunction in the server device 3, and if the remote control compulsory information received from the server device 3 indicates that the remote control information is significant, the vehicle CPU 73 can bring the vehicle to an emergency stop through autonomous driving control. When the vehicle CPU 73 determines that there is a malfunction in the server device 3, it executes autonomous driving control that generates a control value using the information from the vehicle's sensors, without using the individual remote control value received as individual control information from the server device 3.
[0066] In step S20, the vehicle CPU 73 of the driving control device 12 executes subordinate driving control to generate control values using the individual remote control values received from the server device 3 along with information from the host vehicle's own sensors. Thereafter, the vehicle CPU 73 terminates this control. In this way, when the vehicle CPU 73 of the driving control device 12 does not determine that there is a malfunction in the server device 3, it can generate control values using the individual remote control values through subordinate driving control. Furthermore, when the vehicle CPU 73 of the driving control device 12 determines that there is a malfunction in its own autonomous driving control, it can generate control values using the individual remote control values through subordinate driving control even when it does not determine that there is a malfunction in the server device 3.
[0067] 8 is a flowchart of the control of determining whether there is a malfunction in the server device 3 by the driving control device 12 of the automobile 2 in FIG. 3. The vehicle CPU 73 of the driving control device 12 executes the control of determining whether there is a malfunction in the server device 3 in FIG. 8 in step ST14 in FIG.
[0068] 8 determines a malfunction of the server device 3 based on a comparison between the envelopes of a plurality of individual remote control values received from the server device 3 and the envelopes of a plurality of control values generated by the autonomous driving control in the host vehicle, as exemplified in Fig. 10 or 11 described later. The vehicle CPU 73 may also execute a determination control other than that shown in Fig. 8 in step ST14 of Fig. 7.
[0069] In step S31, the vehicle CPU 73 of the driving control device 12 plots the multiple individual remote control values received by the vehicle communication device 29 over a predetermined period on a graph such as those shown in Figures 10 and 11, which will be described later. Each individual remote control value may be plotted on the graph based on its value and time.
[0070] In step S32, the vehicle CPU 73 of the driving control device 12 generates envelopes for the multiple individual remote control values and counts the waveform features included in the envelopes. Here, the waveform features may be, for example, the number of changes in the waveform slope in the envelope or the number of waveform poles included in the envelope.
[0071] In step S33, the vehicle CPU 73 of the driving control device 12 plots a plurality of control values (hereinafter referred to as autonomous control values) that the autonomous driving control generates based only on the detection values of the vehicle's own sensors during the above-mentioned predetermined period on a graph such as those shown in Figures 10 and 11. Each autonomous control value may be plotted on the graph based on its value and time.
[0072] In step S34, the vehicle CPU 73 of the driving control device 12 generates envelopes for the plurality of autonomous control values and counts the waveform features included in the envelopes. Here, the waveform features are assumed to be the same as those used for the individual remote control values.
[0073] In step S35, the vehicle CPU 73 of the driving control device 12 calculates the difference between the count value for the individual remote control value in step ST32 and the count value for the autonomous control value in step ST34.
[0074] In step S36, the vehicle CPU 73 of the driving control device 12 acquires the latest remote control information received from the server device 3. As described above, in the remote control information, only one of the mandatory information and the recommended information can be set as significant.
[0075] In step S37, the vehicle CPU 73 of the driving control device 12 reads a threshold value corresponding to the remote control information that is significant in step S36. For example, if recommendation information is significant in the remote control information, the vehicle CPU 73 reads a first threshold value corresponding to the recommendation information. On the other hand, if compulsion information is significant in the remote control information, the vehicle CPU 73 reads a second threshold value corresponding to the compulsion information. Here, the first threshold value and the second threshold value may be recorded in the vehicle memory 72. Furthermore, the second threshold value may be a value greater than the first threshold value. For example, if the first threshold value is 3, the second threshold value may be greater than 3, for example, 5. The first threshold value and the second threshold value may be natural numbers less than or equal to 10, for example.
[0076] In step S38, the vehicle CPU 73 of the driving control device 12 compares the difference in the count values of the waveform features calculated in step ST35 with the threshold value acquired in step ST37. If the difference in the count values of the waveform features is equal to or greater than the threshold value, the vehicle CPU 73 proceeds to step ST39. On the other hand, if the difference in the count values of the waveform features is smaller than the threshold value, the vehicle CPU 73 proceeds to step ST40. At this time, if the vehicle CPU 73 has received significant remote control mandatory information from the server device 3, it uses a second threshold value that is greater than the first threshold value used when significant remote control recommendation information has been received from the server device 3 as the threshold value to be compared with the difference in the count values of the waveform features.
[0077] In step S39, the vehicle CPU 73 of the driving control device 12 determines that the difference in the count values of the waveform features is equal to or greater than the threshold value, and therefore determines that there is a malfunction in the server device 3. Thereafter, the vehicle CPU 73 ends this control and returns the processing to FIG.
[0078] In step S40, the vehicle CPU 73 of the driving control device 12 determines that there is no malfunction in the server device 3 because the difference in the count values of the waveform features is smaller than the threshold value. Thereafter, the vehicle CPU 73 ends this control and returns the process to FIG. 7.
[0079] In this way, the vehicle CPU 73 of the driving control device 12 can determine whether or not there is a malfunction in the server device 3 by comparing the individual remote control values received from the server device 3 with the control values generated by the autonomous driving control in the vehicle. Furthermore, if it is determined that there is a malfunction in the server device 3, it can further determine this in step ST15 of Figure 7 and switch the driving control of the vehicle from subordinate driving control to autonomous driving control.
[0080] Fig. 9 is a flowchart of basic remote control information transmission control by the server device 3 of Fig. 1. The server CPU 34 of the server device 3 repeatedly executes the remote control information transmission control of Fig. 9 to generate remote control information. As a result of the remote control information transmission control of Fig. 9, the server CPU 34 switches the individual control information to be transmitted to each vehicle 2 between individual remote control values and individual traffic control information.
[0081] In step S51, the server CPU 34 of the server device 3 generates a communication reliability value with the automobile 2 from which it is receiving travel information. The communication reliability value may have an initial value of 100, for example, and be subtracted if there is a communication dropout or a large delay, and may be returned to the initial value when there are no more communication dropouts or large delays. In this case, every time the server CPU 34 receives travel information from the automobile 2, it evaluates the communication and updates the communication reliability value.
[0082] In step S52, the server CPU 34 of the server device 3 determines whether the communication reliability value updated in step S51 is equal to or greater than a threshold. If the communication reliability value is equal to or greater than the threshold, the communication state is good. In this case, the server CPU 34 proceeds to step ST53. If the communication reliability value is not equal to or greater than the threshold, the server CPU 34 proceeds to step ST57 because the communication state may not be suitable for continuing to transmit individual remote control values.
[0083] In step S53, the server CPU 34 of the server device 3 determines whether or not it has received a notification of server malfunction determination from the automobile 2. After determining that the server device 3 has a malfunction in step ST15 of FIG. 7, for example, when transmitting the driving information in step ST72 of FIG. 6, the driving control device 12 of the automobile 2 adds information indicating that the host vehicle has determined that the server device 3 has a malfunction, and transmits the information to the server device 3. The server CPU 34 may determine whether or not it has received a notification of server malfunction determination based on whether or not such additional information is included in the driving information. If it has not received a notification of server malfunction determination, the server CPU 34 proceeds to step ST54. If it has received a notification of server malfunction determination, the server CPU 34 proceeds to step ST57 to generate individual control information instead of individual remote control values.
[0084] In step S54, the server CPU 34 of the server device 3 determines whether or not there is a malfunction in the automobile 2. If a malfunction has occurred in the automobile 2, the driving control device 12 of the automobile 2 includes that information in the driving information and transmits it. The server CPU 34 may determine whether or not there is a malfunction in the automobile 2 based on whether or not such information is included in the driving information. If there is a malfunction in the automobile 2, the server CPU 34 proceeds to step ST60 to suppress the execution of autonomous driving control of the automobile 2. If there is no malfunction in the automobile 2, the server CPU 34 proceeds to step ST55.
[0085] In step S55, the server CPU 34 of the server device 3 determines whether or not forced remote control is necessary in the individual control of the automobile 2. The server CPU 34 may determine that forced remote control is necessary, for example, when it is necessary to accommodate the passing of an emergency vehicle. If forced remote control is necessary, the server CPU 34 proceeds to step ST60 to prevent the automobile 2 from executing autonomous driving control. If forced remote control is not necessary, the server CPU 34 proceeds to step ST56.
[0086] In step S56, the server CPU 34 of the server device 3 determines whether or not it is necessary to recommend remote control in the individual control of the automobile 2. The server CPU 34 may determine that it is necessary to recommend remote control, for example, when the automobile 2 is parked in a parking lot 95. If it is necessary to recommend remote control, the server CPU 34 proceeds to step ST62 to suppress the execution of autonomous driving control of the automobile 2. If it is not necessary to recommend remote control, the server CPU 34 proceeds to step ST57 to have the automobile 2 execute subordinate driving control under the individual control information.
[0087] In step S57, the server CPU 34 of the server device 3 does not make the compulsion information and recommendation information included in the remote control information significant, so that the remote control information does not include significant information.
[0088] In step S58, the server CPU 34 of the server device 3 generates individual control information.
[0089] In step S59, the server CPU 34 of the server device 3 transmits the information generated for the individual control to the corresponding vehicle 2. If step S58 is being executed, the server CPU 34 transmits the individual control information together with the remote control information that does not contain any significant information. Thereafter, the server CPU 34 ends this control.
[0090] In step S60, the server CPU 34 of the server device 3 determines whether the compulsion information included in the remote control information is significant and whether the recommendation information is not significant. The remote control information includes significant compulsion information.
[0091] In step S61, the server CPU 34 of the server device 3 generates an individual remote control value. In this case, the server CPU 34 transmits the individual remote control value together with the remote control information in which the forcing information has been set to significant in step S59. Thereafter, the server CPU 34 ends this control.
[0092] In step S62, the server CPU 34 of the server device 3 sets the recommendation information included in the remote control information as significant and sets the compulsion information as insignificant. The remote control information includes significant recommendation information.
[0093] In step S63, the server CPU 34 of the server device 3 generates an individual remote control value. In this case, the server CPU 34 transmits the individual remote control value together with the remote control information in which the recommendation information has been made significant in step S59. Thereafter, the server CPU 34 ends this control.
[0094] In this way, the server device 3 determines whether an emergency response is required for each of the multiple vehicles 2, and for the vehicle 2 for which it has determined that an emergency response is required, it can transmit remote control information in which the remote control enforcement information has been made significant in addition to the individual remote control value. Furthermore, when the server device 3 receives a server malfunction determination result from a malfunction-determined vehicle that has been determined to have a malfunction in the server device 3, it can switch the information for driving control to be transmitted to the malfunction-determined vehicle from the individual remote control value that can be used as is for driving control of the malfunction-determined vehicle to individual control information including a request for driving control of the vehicle 2.
[0095] Next, a specific example of server malfunction determination by the driving control device 12 of the automobile 2 will be described.
[0096] 10 and 11 are explanatory diagrams of a method for determining whether or not there is a malfunction in the server device 3 by the driving control device 12 of the automobile 2. FIG. 10 shows an example of a case where it is not determined that there is a malfunction in the server device 3. In contrast, FIG. 11 shows an example of a case where it is determined that there is a malfunction in the server device 3. In the graphs shown in these figures, the horizontal axis represents time, and the vertical axis represents value.
[0097] Reference numeral 51 denotes a plurality of individual remote control values transmitted by the server device 3 to each automobile 2. Reference numeral 52 denotes an envelope of the individual remote control values based on the plurality of individual remote control values 51. Reference numeral 53 denotes a plurality of autonomous control values generated by the autonomous driving control based on detection by the host vehicle sensor. The driving control device 12 may, for example, constantly and repeatedly execute the autonomous driving control of FIG. 4 to repeatedly generate autonomous control values based on detection by the host vehicle sensor along with control values to be actually used for control. Reference numeral 52 denotes an envelope of the autonomous control values based on the plurality of autonomous control values.
[0098] In the example of FIG. 10 , where the server device 3 is not determined to have a malfunction, the envelope 52 based on the multiple individual remote control values 51 has a waveform with three poles. In contrast, the envelope 54 based on the multiple autonomous control values 53 has a waveform with one pole. In this case, the cruise control device 12 calculates "2 (=3-1)" as the difference in the number of waveform features in step ST35 of FIG. 8 . Also, if the threshold value acquired in step ST37 is, for example, 3, the cruise control device 12 determines in step ST38 that the difference in the number of waveform features is smaller than the threshold value and proceeds to step ST40. Thereafter, the cruise control device 12 determines in step ST15 of FIG. 7 that the server device 3 has no malfunction and executes the subordinate cruise control in step ST20.
[0099] In contrast, in the example of FIG. 11 , in which it is determined that there is a malfunction in the server device 3, the envelope 52 based on the multiple individual remote control values 51 has a waveform with seven poles. In contrast, the envelope 54 of the multiple autonomous control values 53 has a waveform with two poles. In this case, the cruise control device 12 calculates "5 (= 7 - 2)" as the difference in the number of waveform features in step ST35 of FIG. 8 . Furthermore, if the threshold value acquired in step ST37 is, for example, 3, the cruise control device 12 determines in step ST38 that the difference in the number of waveform features is equal to or greater than the threshold value, and proceeds to step ST39. Thereafter, the cruise control device 12 determines in step ST15 of FIG. 7 that there is a malfunction in the server device 3, and executes autonomous cruise control in step ST18 or step ST19.
[0100] As described above, in this embodiment, in each of the multiple automobiles 2, the driving control device 12 capable of generating control values for controlling the driving of the host vehicle determines whether the server device 3 has a malfunction. If it is determined that the server device 3 does not have a malfunction, the driving control device 12 performs subordinate driving control to generate control values using information from the host vehicle's own vehicle sensors and individual remote control values received from the server device 3. This allows each automobile 2 to drive in accordance with the individual remote control values of the server device 3 that has not been determined to have a malfunction. Furthermore, if it is determined that the server device 3 has a malfunction, the driving control device 12 performs autonomous driving control to generate control values using information from the host vehicle's own vehicle sensors or information obtained by manual operation. In this case, the driving control device 12 generates control values without using the individual remote control values received from the server device 3 that has been determined to have a malfunction. This allows each automobile 2 to not drive in accordance with the individual remote control values of the server device 3 that has been determined to have a malfunction.
[0101] In this manner, in this embodiment, each vehicle 2 in the vehicle 2 control system 1 that uses the server device 3 for driving control of the vehicle 2 can respond to any malfunctions in the server device 3.
[0102] The above-described embodiment is an example of a preferred embodiment of the present invention, but the present invention is not limited to this, and various modifications and changes are possible within the scope of the gist of the invention.
[0103] 1...control system, 2...automobile (vehicle), 3...server device, 4...server main body, 5...server DB, 6...communication system, 7...base station, 8...communication network, 10...control system, 11...sensor control device, 12...driving control device, 13...drive control device, 14...steering control device, 15...braking control device, 16...external vehicle communication control device, 19...vehicle network, 21...GNSS receiver, 22...external vehicle camera, 23...acceleration sensor, 29...vehicle communication device, 31...server vehicle communication device, 32...server GNSS receiver, 33...server memory, 34...server CPU, 39...server internal bus, 51...individual remote control value, 52...envelope based on a plurality of individual remote control values, 53...autonomous control value, 54...envelope based on a plurality of autonomous control values, 71...input / output device, 72...vehicle memory, 73...vehicle CPU, 74...high-precision map data, 79...vehicle internal bus, 90...road, 95...parking lot, 110...GNSS satellite
Claims
1. A plurality of vehicles each having a driving control unit capable of generating a control value for controlling the driving of the vehicle; a server device that generates individual remote control values for each of the plurality of vehicles based on driving information for the plurality of vehicles and transmits the individual remote control values to the plurality of vehicles; A vehicle control system, wherein the driving control unit of each of the plurality of vehicles generates a control value for driving control of the vehicle by using the individual remote control value addressed to the vehicle received from the server device, The driving control unit of each of the plurality of vehicles determining whether or not there is a malfunction in the server device; When it is determined that the server device does not have a malfunction, a secondary driving control is executed to generate the control value using the individual remote control value received from the server device together with the information from the vehicle sensor. When it is determined that the server device has a malfunction, an autonomous driving control is executed to generate the control value using information from the vehicle's own sensor or information from a manual operation, without using the individual remote control value received from the server device. Vehicle control system.
2. The driving control unit of each of the plurality of vehicles determining whether or not the server device has a malfunction by comparing an individual remote control value received from the server device with the control value generated by the autonomous driving control in the vehicle; The vehicle control system according to claim 1 .
3. The driving control unit of each of the plurality of vehicles comparing an envelope for a plurality of individual remote control values received from the server device with an envelope for a plurality of the control values generated by the autonomous driving control in the host vehicle; determining whether a difference between the number of waveform features contained in each of the envelopes being compared is equal to or greater than a threshold; If the difference in the number of waveform features is equal to or greater than the threshold, it is determined that the server device has a malfunction.
3. A vehicle control system according to claim 2.
4. The driving control unit of each of the plurality of vehicles In the slave driving control, which generates the control value using the individual remote control value received from the server device, the control value is generated so as to suppress changes in driving compared to a case where the individual remote control value received from the server device is used as the control value as it is. A vehicle control system according to any one of claims 1 to 3.
5. The driving control unit of each of the plurality of vehicles When a malfunction notification is received from the server device, the autonomous driving control is executed.
5. A vehicle control system according to claim 4.
6. The server device includes: determining whether an emergency response is required for each of the plurality of vehicles, and for a vehicle for which it is determined that an emergency response is required, transmitting remote control information that can make one of forced information and recommended information of remote control significant in addition to the individual remote control value; The driving control unit of each of the plurality of vehicles when it is determined that there is a malfunction in the server device when the remote control compulsion information in the remote control information received from the server device is significant, the vehicle is brought to an emergency stop by the autonomous driving control; When it is determined that there is a malfunction in the server device in a case where the remote control recommendation information in the remote control information received from the server device is significant, the autonomous driving control is performed to continue driving the host vehicle.
6. A vehicle control system according to claim 5.
7. The driving control unit of each of the plurality of vehicles When significant forced information of the remote control is received from the server device, a second threshold value that is greater than the first threshold value when significant recommended information of the remote control is received from the server device is used as a threshold value for comparison with the difference in the number of waveform features.
7. A vehicle control system according to claim 6.
8. The driving control unit of each of the plurality of vehicles Determine whether or not there is a malfunction in the autonomous driving control of the vehicle itself, When it is determined that there is a problem in the autonomous driving control of the vehicle itself, the control value is generated using the individual remote control value by the secondary driving control.
8. A vehicle control system according to claim 7.
9. The server device includes: When a determination result indicating a malfunction of the server device is received from the malfunction-determined vehicle in which it has been determined that the server device has a malfunction, information for driving control to be transmitted to the malfunction-determined vehicle is switched from the individual remote control value that can be used as is for driving control in the malfunction-determined vehicle to individual control information including a request for driving control of the vehicle.
9. A vehicle control system according to claim 8.
10. A vehicle communication device that communicates with a server device that generates individual remote control values for each of the plurality of vehicles based on driving information about the plurality of vehicles and transmits the individual remote control values to the plurality of vehicles; A vehicle sensor provided in a vehicle; a driving control unit capable of generating a control value for controlling driving of the vehicle, the vehicle being the vehicle, by using the individual remote control value addressed to the vehicle and received from the server device by the vehicle communication device; having The traveling control unit is determining whether or not there is a malfunction in the server device; When it is determined that the server device does not have a malfunction, a secondary driving control is executed to generate the control value using the individual remote control value received from the server device together with the information from the vehicle sensor. When it is determined that the server device has a malfunction, an autonomous driving control is executed to generate the control value using information from the vehicle's own sensor or information from a manual operation, without using the individual remote control value received from the server device. vehicle.
11. A server communication device that communicates with a plurality of vehicles, each of which has a driving control unit capable of generating a control value for controlling driving of the vehicle; a server control unit that generates individual remote control values for each of the plurality of vehicles based on driving information for the plurality of vehicles received by the server communication device, and transmits the individual remote control values from the server communication device to each of the plurality of vehicles; The server control unit When a determination result indicating a malfunction of the server device is received from a malfunction-determined vehicle among the plurality of vehicles that transmit the individual remote control values, information for driving control to be transmitted to the malfunction-determined vehicle is switched from the individual remote control value that can be used as is for driving control in the malfunction-determined vehicle to individual control information including a request for driving control of the vehicle. Server device.