Vehicle control system, vehicle control method, travel monitoring system, travel monitoring method, and program

Abstract

In this vehicle control system, a travel control unit (51A) imposes at least a partial restriction on the control of automatic travel when a failure occurs during automatic travel. After imposing the restriction, the travel control unit (51A) removes the restriction upon receiving a removal command for the restriction from a travel monitoring system 10. This system makes it possible to, after a restriction is imposed on the control of automatic travel due to a failure in the automatic travel, remove the restriction at an appropriate point in time.

Description

Vehicle control system, vehicle control method, travel monitoring system, travel monitoring method, and program

[0001] The present disclosure relates to a vehicle control system, a vehicle control method, a travel monitoring system, a travel monitoring method, and a program.

[0002] Conventionally, systems for remotely monitoring and supporting autonomous vehicles have been proposed. For example, in the system disclosed in Patent Document 1 below, under normal circumstances, a driving schedule is periodically transmitted from a driving control center to the vehicle, and the vehicle drives according to that schedule. On the other hand, if a communication failure occurs, the vehicle drives autonomously along a pre-stored driving route. Also, in the system disclosed in Patent Document 2, under normal circumstances, a host computer determines the possibility of contact between the vehicle and an obstacle and transmits an alert to the vehicle as necessary. On the other hand, if a communication failure occurs, the vehicle determines the possibility of contact between the vehicle and an obstacle and presents an alert to the driver as necessary.

[0003] JP 2021-009429 A International Publication No. 2013 / 099391

[0004] As seen in Patent Documents 1 and 2, in conventional systems, when a failure occurs in remotely monitored and supported autonomous driving, an operation that does not depend on communication is executed in the vehicle. However, in systems that remotely monitor and support autonomous vehicles, how to resume normal autonomous driving after a communication failure occurs is also an important issue.

[0005] (1) An example of a control system proposed in this disclosure is a system mounted on an autonomous vehicle, and includes a communication unit capable of communicating with a driving monitoring system via a network, and a control unit that controls the vehicle so that the vehicle drives autonomously. When a fault occurs during the autonomous driving, the control unit imposes at least a partial restriction on the control of the autonomous driving. After imposing the restriction, the control unit removes the restriction when it receives a command to remove the restriction from the driving monitoring system. This system removes the restriction imposed on the autonomous driving based on a command from the driving monitoring system, rather than a decision made by the vehicle itself, allowing autonomous driving to resume with the restriction removed at an appropriate time.

[0006] (2) The control system described in (1) may include a detection unit that detects the occurrence of the fault.

[0007] (3) In the control system of (1) or (2), the communication unit may include a first communication unit that communicates with the driving monitoring system during the autonomous driving, and a second communication unit that communicates with the driving monitoring system when a failure occurs in communication by the first communication unit. This ensures redundancy in communication, which can speed up the resumption of autonomous driving of the vehicle and make it easier for a monitor to grasp the vehicle's condition, leading to early recovery of services using the vehicle.

[0008] (4) In the control system described in (3), the communication unit may determine that the failure has occurred in communication by the first communication unit when communication by the first communication unit with the driving monitoring system becomes impossible for a predetermined period of time.

[0009] (5) In the control system described in (4), the control unit at least partially restricts the autonomous driving of the vehicle when a failure occurs in communication by the first communication unit, thereby reducing the occurrence of risks caused by a failure in communication by the first communication unit.

[0010] (6) In the control system described in (3) to (5), the first communication unit and the second communication unit may communicate with the driving monitoring system using first identification information and second identification information, respectively, stored in a common SIM (Subscriber Identity Module).

[0011] (7) In the control system according to any one of (1) to (6), when the control unit receives the command to remove the restriction, the control unit may determine whether a predetermined condition is satisfied and then resume the autonomous driving of the vehicle. This can reduce the occurrence of problems when the autonomous driving is resumed.

[0012] (8) In the control system described in (1) to (7), if the predetermined condition is not satisfied, the control unit may notify the driving monitoring system through the communication unit that the vehicle cannot resume autonomous driving.

[0013] (9) In the control system described in (3), the control unit may at least partially impose the restriction on the autonomous driving of the vehicle when a failure occurs in communication by the first communication unit. Then, after the restriction is imposed, the control unit may receive a command to remove the restriction through the second communication unit. This allows the restriction on autonomous driving to be removed early even if recovery of communication by the first communication unit is delayed.

[0014] (10) In the control system described in (9), after receiving the command to remove the restriction, the control unit may control the vehicle so that the vehicle drives automatically while communicating with the driving monitoring system through the second communication unit.

[0015] (11) In the control system described in (3), the first communication unit may repeatedly transmit first information to the vehicle monitoring system during the autonomous driving. The control unit may impose the restriction at least partially on the autonomous driving of the vehicle when a failure occurs in communication by the first communication unit. The second communication unit may transmit second information to the vehicle monitoring system after the restriction is imposed. This allows the bandwidth of communication by the second communication unit and the bandwidth of communication by the first communication unit to be different, thereby reducing the cost required for communication by the second communication unit. Furthermore, depending on the type of second information, the vehicle monitoring system can grasp the status of the vehicle and any obstacles.

[0016] (12) In the control system described in (3), the amount of data of the second information transmitted per unit time may be smaller than the amount of data of the first information transmitted per unit time.

[0017] (13) In the control system described in (11), the second information may include information about the vehicle and / or a fault in the vehicle monitoring system. This allows the vehicle monitoring system to diagnose the vehicle and / or a fault and take appropriate action based on the diagnosis result.

[0018] (14) In the control system described in (3), the communication unit may receive a command to restore communication by the first communication unit from the driving monitoring system via the second communication unit after a failure occurs in communication by the first communication unit. This allows for earlier restoration to autonomous driving using communication by the first communication unit.

[0019] (15) In the control system described in (1) to (14), the restrictions imposed on the control of the autonomous driving may include a first restriction that stops the vehicle and a second restriction that allows the vehicle to travel while partially restricting the control of the autonomous driving. The control unit may select one of the first restriction and the second restriction based on an obstacle and / or environment that has occurred in the vehicle. This makes it possible to impose a restriction according to an obstacle and / or environment that has occurred in the vehicle.

[0020] (16) In the control system described in (15), the control unit may stop the vehicle when a predetermined condition is satisfied after the second restriction is selected.

[0021] (17) In the control system described in (15), the control unit may, in response to the cancellation command, run the vehicle in a state in which the control of the autonomous driving is partially restricted while allowing the vehicle to run, and then resume the autonomous driving without the restriction when a predetermined condition is satisfied. This can reduce the occurrence of problems when the autonomous driving without the restriction is resumed.

[0022] (18) A vehicle control method proposed in the present disclosure includes a step of communicating with a driving monitoring system via a network and a step of controlling the vehicle so that the vehicle drives autonomously. The step of controlling the vehicle includes a step of at least partially restricting control of the autonomous driving when a fault occurs during the autonomous driving, and a step of lifting the restriction when a command to lift the restriction is received from the driving monitoring system after the restriction is imposed.

[0023] (19) A program proposed in the present disclosure causes one or more computers to function as a control system for controlling an autonomously driving vehicle. The program causes the one or more computers to function as a communication means for communicating with a driving monitoring system via a network and a control means for controlling the vehicle so that the vehicle drives autonomously. The control means includes a means for at least partially restricting control of the autonomous driving when a fault occurs during the autonomous driving, and a means for lifting the restriction when a command to lift the restriction is received from the driving monitoring system after the restriction is imposed.

[0024] (20) Another example of a control system proposed in the present disclosure is a system mounted on an autonomously driving vehicle, the system including a communication unit capable of communicating with a driving monitoring system via a network and a control unit that controls the vehicle so that the vehicle drives autonomously. The communication unit includes a first communication unit that transmits first information to the driving monitoring system during the autonomous driving, and a second communication unit. The control unit at least partially restricts the control of the autonomous driving when a failure occurs in communication by the first communication unit during the autonomous driving. The second communication unit transmits second information, which is a type different from the first information, to the driving monitoring system while the restriction is imposed on the autonomous driving of the vehicle. This allows the bandwidth of the communication line used by the second communication unit to be different from the bandwidth of the communication line used by the first communication unit, thereby reducing the cost required for communication by the second communication unit. Furthermore, depending on the type of second information, the driving monitoring system can grasp the status of the vehicle and any faults.

[0025] (21) Another example of a vehicle control method proposed in the present disclosure includes a first communication step of communicating with a driving monitoring system through a network and transmitting first information to the driving monitoring system during the autonomous driving; a step of controlling the vehicle so that the vehicle drives autonomously, and at least partially restricting the control of the autonomous driving when a failure occurs in communication by the first communication unit during the autonomous driving; and a second communication step of communicating with the driving monitoring system through a network and transmitting second information, different from the first information, to the driving monitoring system while the restriction is imposed on the autonomous driving of the vehicle.

[0026] (22) Another example of a program proposed in the present disclosure is a program that causes one or more computers to function as a control system to be mounted on an autonomously driving vehicle. This program causes one or more computers to function as: first communication means that communicates with a driving monitoring system via a network and transmits first information to the driving monitoring system during the autonomous driving; control means that controls the vehicle so that the vehicle drives autonomously and that at least partially restricts control of the autonomous driving when a failure occurs in communication by the first communication unit during the autonomous driving; and second communication means that communicates with the driving monitoring system via the network and transmits second information, which is different in type from the first information, to the driving monitoring system while the restriction is imposed on the autonomous driving of the vehicle.

[0027] (23) The driving monitoring system proposed in this disclosure is a system that monitors the driving of an autonomously driving vehicle, and includes a first communication unit and a second communication unit. The driving monitoring system includes a communication unit for communicating with the vehicle and a control unit. The communication unit communicates with the first communication unit of the vehicle via a network while the vehicle is driving autonomously. The communication unit also communicates with the second communication unit of the vehicle via a network when the autonomous driving of the vehicle is at least partially restricted due to a failure in communication with the first communication unit while the vehicle is driving autonomously. The control unit diagnoses the vehicle and / or the failure based on information received from the second communication unit. In this way, if a failure occurs in communication via the first communication unit, the driving monitoring system can determine the cause of the failure and the occurrence of other malfunctions via communication via the second communication unit.

[0028] (24) A monitoring method proposed in the present disclosure is a driving monitoring method for monitoring driving of an autonomously driving vehicle having a first communication unit and a second communication unit, the method including the steps of communicating with the first communication unit of the vehicle through a network while the vehicle is driving autonomously, communicating with the second communication unit of the vehicle through a network when the autonomous driving of the vehicle is at least partially restricted due to a failure in communication with the first communication unit while the vehicle is driving autonomously, and diagnosing the vehicle and / or the failure based on information received from the second communication unit.

[0029] (25) Another example of a program proposed in the present disclosure is a program that causes one or more computers to function as a driving monitoring system that monitors the driving of an autonomously driving vehicle having a first communication unit and a second communication unit. The program causes the one or more computers to function as communication means for communicating with the vehicle and control means. The communication means communicates with the first communication unit of the vehicle over a network while the vehicle is driving autonomously, and communicates with the second communication unit of the vehicle over the network when the autonomous driving is at least partially restricted due to a failure in communication with the first communication unit during the vehicle's driving autonomously. The control means diagnoses the and / or the failure based on information received from the second communication unit.

[0030] 1 is a diagram showing an operation system including a vehicle equipped with a control system proposed in the present disclosure and a travel monitoring system. FIG. 2 is a block diagram showing hardware equipped in the vehicle. FIG. 3 is a block diagram showing an example of functions of the control system equipped in the vehicle. FIG. 4 is a block diagram showing an example of functions of the travel monitoring system. FIG. 5 is a flow diagram showing a flow of processing executed by the control system and travel monitoring system mounted on the vehicle. FIG. 6 is a flow diagram showing another example of processing executed by the control system and travel monitoring system mounted on the vehicle. FIG. 7 is a flow diagram showing yet another example of processing executed by the control system and travel monitoring system mounted on the vehicle. FIG. 8 is a flow diagram showing an example of processing executed by the control system when a communication failure is detected. FIG. 9 is a flow diagram showing an example of processing executed by the control system when the vehicle resumes autonomous traveling.

[0031]

[0023] An example of a vehicle control system and a driving monitoring system proposed in the present disclosure will be described below. Fig. 1 is a diagram showing a driving system 100 including a vehicle 70 equipped with a control system 50 proposed in the present disclosure and a driving monitoring system 10.

[0032] [Vehicle Operation System] The vehicle 70 is a vehicle capable of automatically driving with a user on roads provided in various regions, such as urban areas, rural areas, and tourist facilities. The driving monitoring system 10 is connected to a plurality of vehicles 70 via a network N. The network N may include the Internet or a local area network (LAN). The driving monitoring system 10 receives driving information (e.g., current vehicle speed and current location) from the plurality of vehicles 70 and presents the information to a monitor. In the example shown in FIG. 1 , the driving monitoring system 10 is connected to two vehicles 70 via the network N, but the number of vehicles 70 monitored by the driving monitoring system 10 is not limited to two and may be one or more than two.

[0033] [Hardware of the Travel Monitoring System] The travel monitoring system 10 may include, for example, one or more of a server computer, a personal computer, a smartphone, and a tablet computer. When the travel monitoring system 10 includes, for example, a server computer and a personal computer, these may be connected via a network N. In this case, the travel information received by the server computer from the vehicle 70 may be transmitted to the personal computer and presented to the monitor.

[0034] As shown in FIG. 1, the vehicle monitoring system 10 includes a control device 11 , a display device 13 , an input device 14 , and a communication device 15 .

[0035] The control device 11 has an arithmetic unit including a CPU (Central Processing Unit) and a storage device. The storage device includes a RAM (Random Access Memory), a ROM (Read Only Memory), a HDD (Hard Disc Drive), an SSD (Solid State Drive), etc. The control device 11 executes programs stored in the storage device using the arithmetic unit to perform processing related to monitoring the vehicle 70. The processing performed by the control device 11 will be described in detail later.

[0036] The display device 13 is a display that displays driving information provided by the driving monitoring system 10. As the display device 13, for example, a liquid crystal display, an organic EL display, or the like can be used.

[0037] The input device 14 is a device for inputting instructions from the supervisor to the control device 11. As the input device 14, for example, a keyboard, a mouse pointer, a touch sensor provided on the display device 13, or the like can be used.

[0038] The communication device 15 is a communication module for performing two-way communication with the vehicle 70 via the network N. The communication device 15 may be a wireless LAN adapter or a wired LAN adapter.

[0039] 2 is a block diagram showing the hardware of a vehicle 70. The vehicle 70 has a control system 50. The control system 50 has a cruise control device 51, a communication control device 52, and identification information storage units 53A and 53B. The vehicle 70 also has a GNSS (Global Navigation Satellite System) receiver 54, a surroundings observation device 55, a sensor unit F, an output device 57, and an input device 58. The vehicle 70 further has a drive mechanism 61, a brake mechanism 62, and a steering mechanism 63.

[0040] The drive mechanism 61 includes an electric motor that drives the drive wheels of the vehicle 70, a drive circuit (e.g., an inverter circuit) that supplies power to the electric motor, and the like. The drive circuit supplies power from a battery mounted on the vehicle 70 to the electric motor in accordance with commands from the cruise control device 51. The drive source of the vehicle 70 is not limited to the electric motor, and may be an engine.

[0041] The steering mechanism 63 is connected to the steering wheels (specifically, the front wheels of the vehicle 70) and has a steering device that moves in conjunction with the left and right movement of the steering wheels. The steering device may include a steering wheel that can be operated by the occupant, a steering shaft connected to the steering wheel, etc. The steering mechanism 63 also has an actuator (steering motor) that moves the steering device and a drive circuit that supplies power to the actuator. The drive circuit supplies power from the battery to the actuator in accordance with commands from the cruise control device 51.

[0042] The drive mechanism 61 includes a brake device that applies braking force to the wheels of the vehicle 70, an actuator that operates the brake device, a drive circuit that supplies power to the actuator, etc. The drive circuit supplies power from the battery to the actuator in accordance with commands from the travel control device 51.

[0043] The GNSS receiver 54 includes an antenna and a processing device (receiver), and calculates the position (longitude and latitude information) of the vehicle 70 based on signals received from satellites, and inputs this information to the driving control device 51 .

[0044] The surroundings observation device 55 is a device for observing the surroundings of the vehicle 70. The surroundings observation device 55 may include, for example, one or more of a camera (a monocular camera and / or a stereo camera), a millimeter wave radar for measuring the distance to an object using millimeter waves, SONAR (sound navigation and ranging), and LiDAR (light detection and ranging).

[0045] The sensor unit F includes sensors, devices, and circuits that output signals related to the running and state of the vehicle. The sensor unit F includes, for example, a vehicle speed sensor that outputs a signal corresponding to the vehicle speed, a steering angle sensor that outputs a signal corresponding to the rotation angle (steering angle) of the steering shaft that constitutes the steering mechanism 63, an IMU (Inertial Measurement Unit) that outputs a signal corresponding to the acceleration and angular velocity acting on the vehicle 70, a temperature sensor that measures the temperature of the IMU, and a circuit that measures the current of the battery.

[0046] The sensors included in the sensor unit F are not limited to the examples described here. For example, when the vehicle 70 travels on a road on which an induction wire is installed, the sensor unit F may include a magnetic sensor for detecting the position of the induction wire using magnetic force. Furthermore, when the vehicle 70 travels on a road on which an RFID (Radio Frequency Identification) tag is installed, the sensor unit F may include an RFID reader.

[0047] The driving control device 51 has a calculation device including a CPU and a storage device. The storage device includes RAM, ROM, SSD, etc. The driving control device 51 may have multiple calculation devices that communicate with each other. In this case, each of the multiple calculation devices may be provided with one or multiple storage devices. The driving control device 51 executes programs stored in the storage device using the calculation device, and performs control related to the automatic driving of the vehicle 70 (control of the drive mechanism 61, steering mechanism 63, and drive mechanism 61).

[0048] The cruise control device 51 drives the vehicle 70 according to a driving plan without requiring any driving operation (such as accelerator operation, steering operation, or braking operation) by the occupant. The driving plan includes the route along which the vehicle 70 will travel, the speed at which the vehicle 70 should travel at each location, and the operations of the vehicle 70 (such as stopping, moving forward, reversing, and turning). The driving plan may be set by the operator of the vehicle 70, for example. The driving plan may also be set by the user of the vehicle 70, or calculated based on a destination input by the user via the input device 58. The cruise control device 51 may have, as one of its control modes, a manual driving mode in which the drive mechanism 61 and the like are controlled according to driving operations by the occupant.

[0049] The output device 57 includes a speaker and a display, and displays information output from the control system 50 on the display, and outputs audio signals output from the control system 50 from the speaker.

[0050] The input device 58 is a device for inputting instructions from the occupant to the control system 50. As the input device 58, for example, a microphone or a touch sensor provided on the display device can be used.

[0051] [Communication Control Device and Multiple Identification Information Storage Units] The communication control device 52 is connected to an antenna (not shown). The communication control device 52 includes a wireless module including a modulator / demodulator and an amplifier, a calculation device including a CPU, and a storage device. The storage device includes RAM, ROM, SSD, etc. The communication control device 52 executes programs stored in the storage device using the calculation device. The communication control device 52 performs bidirectional communication with the driving monitoring system 10 via a public wireless communication network conforming to standards such as fourth-generation mobile phone (4G), LTE (Long Term Evolution), and fifth-generation mobile phone (5G).

[0052] The communication control device 52 transmits driving information of the vehicle 70 to the driving monitoring system 10. The driving information transmitted to the driving monitoring system 10 includes the output of a sensor or device mounted on the vehicle 70. The driving information also includes information calculated based on the output of the sensor or device. Specifically, the driving information may include the vehicle speed, the direction of travel (forward / reverse), the current position information of the vehicle 70, the driving distance, the steering angle, etc.

[0053] The driving information transmitted to the driving monitoring system 10 may also include information indicating the status of sensors or devices mounted on the vehicle 70. Examples of such driving information may include the temperature of sensors, etc., or the operating mode of devices. The communication control device 52 transmits such driving information to the driving monitoring system 10 at predetermined time intervals (e.g., every 10 to 1000 milliseconds) during autonomous driving. The driving monitoring system 10 displays the received driving information on the display device 13.

[0054] As shown in FIG. 2 , the control system 50 has a first identification information storage unit 53A and a second identification information storage unit 53B. Identification information required for connecting to a public wireless communication network such as 4G or 5G is stored in the identification information storage units 53A and 53B. The identification information includes, for example, an International Mobile Subscriber Identity (IMSI) and an authentication key. The first identification information stored in the first identification information storage unit 53A is identification information required for communication through the communication network of a first communication carrier. The second identification information stored in the second identification information storage unit 53B is identification information required for communication through the communication network of a second communication carrier.

[0055] The identification information storage units 53A and 53B include, for example, a SIM (Subscriber Identity Module). In one example, the identification information storage units 53A and 53B are SIM cards that are detachable from slots, but are not limited to this and may include an eSIM, which is a storage device connected to the communication control device 52. One or both of the two identification information storage units 53A and 53B may include an eSIM.

[0056] The control system 50 may be equipped with only one SIM. In this case, two identification information storage units 53A and 53B are secured in the common SIM. That is, the identification information storage units 53A and 53B may be realized by a so-called dual SIM, and both the first identification information and the second identification information required for connecting to the communication networks of two communication carriers may be stored in one SIM.

[0057] The communication control device 52 selects one of the identification information stored in the two identification information storage units 53A and 53B depending on the state of the vehicle 70. Then, the communication control device 52 communicates with the vehicle monitoring system 10 using the communication carrier corresponding to the selected identification information. The processing of the communication control device 52 will be described in detail later.

[0058] [Overview of Processing by the Control System] If a failure occurs during the autonomous driving of the vehicle 70, the control system 50 imposes restrictions on the control of the autonomous driving. Specifically, the failure during the autonomous driving is a failure in communication between the driving monitoring system 10 and the control system 50 using the first communication carrier. When a communication failure occurs, the control system 50 executes an MRM (Minimum Risk Maneuver) as an example of a restriction to stop the vehicle 70. As described later, the MRM is an operation, for example, to slow down the vehicle 70 or move the vehicle 70 to a position that meets predetermined conditions (such as a shoulder or a wide road) and then stop the vehicle 70. This reduces the risk caused by the communication failure. If such a communication failure occurs, the control system 50 uses the second identification information stored in the second identification information storage unit 53B to connect to the driving monitoring system 10 via the communication network of the second communication carrier. This allows the vehicle 70 to resume autonomous driving more quickly and makes it easier for a monitor to grasp the status of the vehicle 70. The processing executed by the control system 50 will be described in detail below.

[0059] 3 is a block diagram showing the functions of the control system 50. The control system 50 has, as its functions, a driving control unit 51A and a communication unit 52A. The driving control unit 51A is mainly realized by the calculation unit of the driving control device 51 executing a program stored in a storage device provided in the driving control device 51. The communication unit 52A is mainly realized by the calculation unit of the communication control device 52 executing a program stored in a storage device provided in the communication control device 52.

[0060] [Driving Control Unit] The driving control unit 51A controls the vehicle 70 (specifically, the drive mechanism 61, brake mechanism 62, and steering mechanism 63 described above) so that the vehicle 70 drives automatically. That is, the driving control unit 51A drives the vehicle 70 without requiring the occupant to operate the steering mechanism 63 or the like. The driving control unit 51A controls the steering mechanism 63 or the like based on the outputs of the various sensors included in the sensor unit F, position information calculated from signals received by the GNSS receiver 54, surrounding information (e.g., camera images) obtained by the surroundings observation device 55, etc.

[0061] The driving control unit 51A drives the vehicle 70 according to a driving plan. The driving plan is stored, for example, in a storage device provided in the driving control device 51. The driving plan may include, for example, multiple coordinate information (waypoints) that define the driving route along which the vehicle 70 should travel. The multiple waypoints are arranged at regular intervals. The speed that the vehicle 70 should reach and the action that the vehicle 70 should take (such as turning or stopping temporarily) may be defined in association with the position of each waypoint. The driving control device 51 controls the drive mechanism 61 and the like so that the vehicle 70 travels according to this driving plan.

[0062] The vehicle 70 may be of an electromagnetic guidance type. In this case, the driving plan is defined by a guidance line laid on the driving path. The driving control unit 51A detects the position of the guidance line using a magnetic sensor and controls the steering mechanism 63 and the like so that the vehicle 70 moves along the guidance line. Alternatively, the driving plan may be defined by a plurality of RFID tags embedded in the driving path. In this case, the driving control unit 51A detects the position of an RFID tag using an RFID reader and controls the steering mechanism 63 and the like so that the vehicle 70 moves along the RFID tag.

[0063] 3, the driving control unit 51A has a restriction unit 51b. When a fault occurs during the automatic driving by the driving control unit 51A, the restriction unit 51b at least partially restricts the control of the automatic driving. This reduces the risk of occurrence due to the fault.

[0064] An example of a failure that may occur during autonomous driving is a communication failure. The communication failure may include a communication interruption and a communication delay. During autonomous driving, the first communication unit 52a (see FIG. 3) communicates with the driving monitoring system 10 and repeatedly transmits the above-described driving information (i.e., vehicle speed, position information, etc.) to the driving monitoring system 10. If communication by the first communication unit 52a with the driving monitoring system 10 becomes impossible (disrupted) due to a communication failure, the restriction unit 51b at least partially restricts the control of the autonomous driving. For example, the restriction unit 51b may slow down or stop the vehicle 70 without following the driving plan.

[0065] When an obstacle occurs during automated driving, the limiting unit 51b may move the vehicle 70 to a stopping position and then stop the vehicle 70. The stopping position may be, for example, a shoulder of a road defined as a driving path in the driving plan. In this case, the limiting unit 51b may detect a position where the vehicle 70 should stop from surrounding information (for example, a camera image) acquired by the surroundings observation device 55. Then, the limiting unit 51b may control the steering mechanism 63 and the like so that the vehicle 70 moves to that position.

[0066] The restriction performed by the restriction unit 51b is not limited to stopping the vehicle 70. The restriction unit 51b may also impose a restriction on the vehicle speed. That is, the restriction unit 51b may cause the vehicle 70 to travel along a travel route defined in the travel plan (a travel route defined by waypoints, guide lines, or RFID tags) at a speed lower than the vehicle speed defined in the travel plan. The restriction unit 51b may, for example, cause the vehicle 70 to travel slowly.

[0067] After traveling at such a low speed, the restriction unit 51b may stop the vehicle 70 when a predetermined condition is satisfied. Here, the predetermined condition may be, for example, that the vehicle 70 has reached a position where the road width is greater than a predetermined value, or that the vehicle 70 has reached a predetermined safe position. In other words, the restriction unit 51b may stop the vehicle 70 when the vehicle 70 has reached a position where the road width is greater than a predetermined value, or when the vehicle 70 has reached a safe position.

[0068] A plurality of types of restrictions may be defined for the restriction executed by the restriction unit 51b. As a first restriction, the restriction unit 51b stops the vehicle 70, for example. As a second restriction, the restriction unit 51b partially restricts the control of the automatic driving while allowing the vehicle 70 to travel. Here, the partial restriction is, for example, a restriction on the vehicle speed.

[0069] The restriction unit 51b may select one of the first restriction and the second restriction based on a fault that has occurred in the vehicle 70 and / or the environment around the vehicle 70. For example, if communication by the first communication unit 52a, which will be described later, is interrupted, the first restriction (stopping the vehicle 70) may be implemented. On the other hand, if a delay occurs in communication by the first communication unit 52a, the second restriction (slowing down the vehicle 70) may be implemented.

[0070] [Restriction Release Command] After the restriction is imposed by the restriction unit 51b, when the driving control unit 51A receives a restriction release command from the driving monitoring system 10, the driving control unit 51A releases the restriction on the autonomous driving. For example, when the vehicle 70 is stopped, the autonomous driving of the vehicle 70 is permitted by releasing the restriction. Then, the driving control unit 51A controls the steering mechanism 63 and the like based on the outputs of the various sensors included in the sensor unit F, position information, and the like, to resume autonomous driving.

[0071] A command to remove the restriction on autonomous driving may be transmitted from the driving monitoring system 10 to the vehicle 70 in response to an operation by the monitor. As described above, the driving monitoring system 10 has the input device 14. A command to remove the restriction may be transmitted to the vehicle 70, for example, by an operation by the monitor on the input device 14. In other words, the operation by the monitor may be involved in removing the restriction.

[0072] [Communication Unit] The communication unit 52A communicates with the vehicle monitoring system 10 through the network N. As shown in Fig. 3, the communication unit 52A includes a first communication unit 52a, a second communication unit 52b, and a detection unit 52c.

[0073] [First Communication Unit] The first communication unit 52a accesses the communication network of the first communication carrier using the first identification information stored in the first identification information storage unit 53A. Then, it connects to the traveling monitoring system 10 via this communication network. The first communication unit 52a communicates with the traveling monitoring system 10 and repeatedly transmits traveling information (e.g., vehicle speed, position information, steering angle) during autonomous traveling to the traveling monitoring system 10. For example, the first communication unit 52a transmits the traveling information to the traveling monitoring system 10 at predetermined time intervals (e.g., 10 to 1000 milliseconds). The first communication unit 52a may transmit surrounding information (e.g., camera images) obtained by the surroundings observation device 55 to the traveling monitoring system 10 as traveling information. The first communication unit 52a receives a response from the traveling monitoring system 10 indicating that the traveling information has been properly received by the traveling monitoring system 10.

[0074] [Second Communication Unit] The second communication unit 52b uses the second identification information stored in the second identification information storage unit 53B to access the communication network of the second communication carrier. The second communication unit 52b then communicates with the vehicle monitoring system 10 via this communication network. The second communication unit 52b uses the communication network of the second communication carrier when a failure occurs in communication via the first communication unit 52a. That is, when a failure occurs in communication via the first communication unit 52a, the communication unit 52A switches the carrier used for communication with the vehicle monitoring system 10 from the first communication carrier to the second communication carrier. When a communication connection via the second communication carrier is established, the communication connection via the first communication carrier may be terminated. Conversely, when a communication connection via the first communication carrier is established, the communication connection via the second communication carrier may be terminated.

[0075] As described above, the first identification information and the second identification information may be stored in a common SIM card. In this case, the first communication unit 52a uses the first identification information stored in the SIM card to access the communication network of the first communication carrier and establish communication with the vehicle monitoring system 10. The second communication unit 52b uses the second identification information stored in the SIM card to access the communication network of the second communication carrier and establish communication with the vehicle monitoring system 10.

[0076] [Resumption of Automated Driving Using Second Communication Unit] If a failure occurs in communication by the first communication unit 52a, the driving control unit 51A at least partially restricts control of the automated driving. As described above, one example of the restriction is MRM, specifically, stopping the vehicle 70 or slowing down the vehicle 70. In one example of the operation system 100, after communication with the driving monitoring system 10 is established by the second communication unit 52b, the driving control unit 51A receives a command to remove such a restriction from the driving monitoring system 10 via the second communication unit 52b. This allows the automated driving to be resumed without any restrictions.

[0077] Thereafter, the control system 50 causes the vehicle 70 to travel automatically while communicating with the travel monitoring system 10 through the second communication unit 52b. At this time, the second communication unit 52b, like the first communication unit 52a, transmits travel information (such as vehicle speed, steering angle, and position information) during the automatic travel to the travel monitoring system 10 at predetermined time intervals (for example, every 10 to 1000 milliseconds). At this time, the second communication unit 52b may transmit surrounding information (for example, camera images) obtained by the surroundings observation device 55 to the travel monitoring system 10 as travel information. The second communication unit 52b receives a response from the travel monitoring system 10 indicating that the travel information has been properly received by the travel monitoring system 10.

[0078] When the second communication unit 52b replaces the first communication unit 52a in this manner, the communication line of the second communication unit 52b may have substantially the same bandwidth as the communication line of the first communication unit 52a, thereby enabling the second communication unit 52b to transmit the same driving information as the first communication unit 52a to the driving monitoring system 10.

[0079] [Diagnosis Using the Second Communication Unit] After the second communication unit 52b establishes communication with the vehicle monitoring system 10, the second communication unit 52b may transmit to the vehicle monitoring system 10 information of a type different from the vehicle information transmitted by the first communication unit 52a. Here, the information transmitted by the second communication unit 52b may be, for example, information related to a fault that has occurred. One example of the information transmitted by the second communication unit 52b is information indicating that a communication connection with the communication network of the first communication carrier (a network element established by the first communication carrier) is unavailable. Another example of the information transmitted by the second communication unit 52b is information indicating that a communication connection with the communication network of the first communication carrier is maintained, but that a communication connection with the vehicle monitoring system 10 via the communication network of the first communication carrier is unavailable. By utilizing such information, the vehicle monitoring system 10 can diagnose the fault (estimate the cause and effect of the fault).

[0080] Specifically, such information includes an error code that has occurred or been received during communication by the first communication unit 52 a. The error code may be, for example, an error code that is generated by a network element of the first communication carrier in accordance with a communication protocol (e.g., GPRS Tunneling Protocol (GTP)) and transmitted to the first communication unit 52 a.

[0081] Another example of information transmitted by the second communication unit 52b is information related to the vehicle 70. In this case, the information transmitted by the second communication unit 52b may include only a portion of the multiple types of driving information transmitted by the first communication unit 52a. For example, if the driving information transmitted by the first communication unit 52a includes vehicle speed, the operating status of devices and sensors (including temperature), location information, and camera images, the information transmitted by the second communication unit 52b may include only a portion of the information (e.g., the operating status of devices and sensors and the location information). This information may be used, for example, for diagnostic processing of the vehicle 70 in the driving monitoring system 10 (determining whether autonomous driving is possible). In contrast, the information transmitted by the second communication unit 52b and the driving information transmitted by the first communication unit 52a do not need to overlap.

[0082] The amount of data of information transmitted by the second communication unit 52b per unit time may be smaller than the amount of data of information transmitted by the first communication unit 52a per unit time. For example, the information transmitted by the second communication unit 52b does not need to include surrounding information (e.g., camera images) obtained by the surroundings observation device 55. This allows the bandwidth of the communication line used by the second communication unit 52b to be narrower than the bandwidth of the communication line used by the first communication unit 52a. As a result, the cost of the communication line used by the second communication unit 52b can be reduced.

[0083] The information transmitted by the second communication unit 52b is not limited to information for diagnostic processing. For example, the second communication unit 52b may transmit the current location information of the vehicle 70 to the driving monitoring system 10. This allows the monitor (or the driving monitoring system 10) to grasp the location of the second communication unit 52b and, as a result, can arrange for a vehicle to rescue the vehicle 70, for example.

[0084] [Detection Unit] The detection unit 52c detects the occurrence of a fault in the autonomous driving. More specifically, the detection unit 52c monitors the communication status of the first communication unit 52a during the autonomous driving and determines whether a fault has occurred in the communication. As described above, the first communication unit 52a transmits driving information of the vehicle 70 during the autonomous driving to the driving monitoring system 10 at predetermined time intervals. The driving monitoring system 10 then transmits a response indicating receipt of the driving information to the vehicle 70. The detection unit 52c determines that a fault has occurred in the communication by the first communication unit 52a, for example, when the detection unit 52c does not receive this response for a predetermined period of time (or a predetermined number of times).

[0085] 4 is a block diagram showing an example of the functions of the vehicle monitoring system 10. The vehicle monitoring system 10 has, as its functions, a monitoring unit 10a, a diagnosis unit 10b, and a communication failure information acquisition unit 10c. These functions are mainly realized by the arithmetic unit of the control device 11 provided in the vehicle monitoring system 10 executing programs stored in a storage device.

[0086] [Monitoring Unit] The monitoring unit 10a receives driving information from the vehicle 70 (first communication unit 52a) during autonomous driving and displays it on the display device 13. Furthermore, when the state of the vehicle 70 ascertained from the driving information satisfies a predetermined condition, the monitoring unit 10a issues a warning to the monitor via the display device 13 or transmits a stop command to the vehicle 70. For example, when the position of the vehicle 70 exceeds a predetermined driving range, the monitoring unit 10a may transmit a stop command to the vehicle 70.

[0087] [Diagnostic unit] When a fault (e.g., a fault in communication with the first communication unit 52a) occurs during automatic driving, the diagnostic unit 10b receives a predetermined type of information from the second communication unit 52b and diagnoses the vehicle 70 or the fault based on this information.

[0088] As described above, one example of the information received from the second communication unit 52b is information indicating that a communication connection between the communication network of the first communication carrier (a network element established by the first communication carrier) and the vehicle 70 (first communication unit 52a) is unavailable. Another example of the information received from the second communication unit 52b is information indicating that a communication connection between the communication network of the first communication carrier and the vehicle 70 is maintained, but that a communication connection between the vehicle 70 and the driving monitoring system 10 via the communication network of the first communication carrier is unavailable. This information includes, for example, an error code that occurred during communication by the first communication unit 52a and was received by the vehicle 70 (first communication unit 52a). The diagnosis unit 10b can diagnose the failure (estimate the cause and effect of the failure) by referring to this error code. For example, the diagnosis unit 10b can estimate whether a communication failure by the first communication unit 52a is caused by the first communication carrier itself, the operation of the communication control device 52, or the operation of the driving monitoring system 10.

[0089] The information transmitted by the second communication unit 52b to the driving monitoring system 10 may be information related to the vehicle 70. In this case, the transmitted information may include only a portion of the multiple types of driving information transmitted by the first communication unit 52a. For example, the information transmitted by the second communication unit 52b may include the operating status (including temperature) of devices and sensors mounted on the vehicle 70, location information of the vehicle 70, etc. The diagnosis unit 10b may determine the state of the vehicle 70 (for example, whether or not it is capable of autonomous driving) based on this information.

[0090] [Communication Failure Information Acquisition Unit] The communication failure information acquisition unit 10c acquires information about the communication status of the first communication carrier. For example, if the first communication carrier stores information indicating the communication status in a device (e.g., a server computer) that is open to the beneficiary (in the example of this specification, the operator of the vehicle monitoring system 10), the communication failure information acquisition unit 10c accesses the server computer and acquires the information indicating the communication status. If a failure occurs in the communication network of the first communication carrier, failure information indicating the occurrence of the failure is stored in the server computer. The communication failure information acquisition unit 10c accesses the server computer and receives the failure information.

[0091] Even if a failure occurs in communication via the first communication unit 52a, if there is no failure in the communication network of the first communication carrier (if no failure information is stored in the server computer), the communication failure is presumed to be temporary. Therefore, in such a case, the vehicle monitoring system 10 may transmit a command to return from communication via the second communication carrier to communication via the first communication carrier. This allows the amount of information data that the second communication unit 52b must transmit per unit time to be less than the amount of information data that the first communication unit 52a must transmit per unit time. As a result, the cost associated with using the second communication carrier can be reduced.

[0092] [Processing Flow] A description will be given of the flow of processing executed by the control system 50 and the vehicle monitoring system 10. Fig. 5 is a flow chart showing an example of these processing.

[0093] First, the driving monitoring system 10 transmits a command to the vehicle 70 to start autonomous driving (S101). The control system 50 receives this command and starts autonomous driving (S102). That is, the driving control unit 51A controls the drive mechanism 61, the brake mechanism 62, and the steering mechanism 63 so that the vehicle 70 drives autonomously according to a driving plan including a driving route and a vehicle speed. During autonomous driving, the control system 50 (first communication unit 52a) transmits driving information including vehicle speed, position information, etc. to the driving monitoring system 10 at predetermined time intervals (S103). Upon receiving the driving information, the driving monitoring system 10 transmits a response indicating receipt to the control system 50 (S104).

[0094] During autonomous driving, the transmission of the driving information and the response are repeatedly executed, and the control system 50 (detection unit 52c) determines whether the communication is normal (S105). Specifically, the detection unit 52c starts timing from the time when the response is received. If the detection unit 52c receives the next response before a predetermined time (e.g., several seconds) has elapsed, the detection unit 52c determines that the communication is normal ("yes" in S105). On the other hand, if the time during which no response has been received exceeds the predetermined time, the detection unit 52c determines that a failure (disruption) has occurred in the communication by the first communication unit 52a ("no" in S105).

[0095] The control system 50 (restriction unit 51b) imposes a predetermined restriction on the control of the automatic driving (S106). The restriction unit 51b, for example, decelerates the vehicle 70, moves the vehicle 70 to the shoulder of the road, and stops the vehicle 70. At this time, the restriction unit 51b may detect a position where the vehicle 70 should stop from surrounding information (e.g., camera images) acquired by the surroundings observation device 55. Then, the restriction unit 51b may control the steering mechanism 63 and the like so that the vehicle 70 moves to that position.

[0096] The control system 50 determines whether the vehicle 70 has stopped (S107). If the vehicle 70 has not yet stopped, the restriction unit 51b continues the vehicle 70 traveling with the above-described restriction ("no" in S107). On the other hand, if the vehicle 70 has stopped ("yes" in S107), the communication unit 52A performs a communication carrier switching process (S108). Specifically, the second communication unit 52b transmits the second identification information stored in the second identification information storage unit 53B to the communication network of the second communication carrier (e.g., a base station). If the authentication process based on the second identification information is successful and the communication network of the second communication carrier becomes available, the second communication unit 52b requests a connection to the vehicle monitoring system 10 through the communication network of the second communication carrier (S109). The vehicle monitoring system 10 approves the connection request and transmits a response indicating this (S110).

[0097] The driving monitoring system 10 also transmits a command to remove the restriction to the vehicle 70 (S111). In other words, the driving monitoring system 10 transmits a command to start autonomous driving. The transmission of this removal command may be conditional on the monitor operating the input device 14. In other words, the driving monitoring system 10 may transmit the removal command upon receiving an explicit instruction from the monitor.

[0098] When the control system 50 receives this cancellation command, it determines that the start of autonomous driving has been permitted, and resumes autonomous driving of the vehicle 70 (S112). At this time, the driving control unit 51A may start driving the vehicle 70 after predetermined conditions are satisfied. For example, the driving control unit 51A may resume autonomous driving on conditions such as there being no obstacle ahead of the vehicle 70 and the same number of people aboard the vehicle 70 as when the vehicle 70 stopped. When autonomous driving is resumed in this manner, the second communication unit 52b, in place of the first communication unit 52a, transmits driving information including vehicle speed, position information, and the like to the driving monitoring system 10 at predetermined time intervals.

[0099] As described above, if a failure in communication by the first communication unit 52a is detected, the control system 50 (restriction unit 51b) imposes a restriction on the control of the autonomous driving. Even after such a restriction is imposed, the vehicle 70 may continue to travel at a low speed and move to a position that satisfies a predetermined condition. An example of a position that satisfies the predetermined condition is a position where the road width is greater than a predetermined value or a predetermined possible stopping position. If the vehicle 70 stops after going through this process, the position where the failure in communication by the first communication unit 52a was detected and the stopped position of the vehicle 70 are different. Therefore, in such a case, the control system 50 may transmit position information of the vehicle 70 at the time of stopping to the driving monitoring system 10 via communication by the second communication unit 52b before resuming autonomous driving.

[0100] [Another Example of Processing Flow (Example of Diagnosis)] Fig. 6 is a flow diagram showing a modified example of the processing executed by the control system 50 and the vehicle monitoring system 10 of the vehicle 70. This figure shows the processing after the communication carrier switching processing S108 shown in Fig. 5. The processing before S108 may be the same as the example shown in Fig. 5.

[0101] When the communication unit 52A performs the process of switching the communication carrier in S108, the second communication unit 52b requests a connection to the vehicle monitoring system 10 via the second communication carrier (S109). The vehicle monitoring system 10 approves the connection request and transmits a response to that effect (S110).

[0102] The traveling monitoring system 10 (diagnostic unit 10b) also requests information required for diagnosis from the vehicle 70 (S121). The communication unit 52A transmits the requested information to the traveling monitoring system 10 (S122). The information transmitted to the traveling monitoring system 10 (diagnostic unit 10b) is different from the traveling information transmitted by the first communication unit 52a during autonomous traveling and is, for example, information regarding a communication failure that has occurred. Another example of the information transmitted to the traveling monitoring system 10 is information regarding the vehicle 70. In this case, the transmitted information may include only a portion of the multiple types of traveling information transmitted by the first communication unit 52a. For example, the operating status (including temperature) of devices and sensors mounted on the vehicle 70 and the location information of the vehicle 70 may be transmitted to the traveling monitoring system 10. The traveling monitoring system 10 (diagnostic unit 10b) diagnoses, for example, a communication failure (estimates the cause and effect) based on the received information (S123). The diagnosis unit 10b presents the diagnosis results to the monitor, for example, by displaying them on the display device 13 (S124). Furthermore, the diagnosis unit 10b determines whether or not the vehicle 70 can resume autonomous driving (S125) based on information indicating the operating status of devices and sensors mounted on the vehicle 70. If autonomous driving is not possible ("no" in S125), the driving monitoring system 10 accesses, for example, another predetermined system and requests rescue for the vehicle 70 (S126).

[0103] On the other hand, if autonomous driving is possible ("yes" in S125), the driving monitoring system 10 transmits a restriction release command to the vehicle 70 (S127), similar to the example shown in FIG. 5 . The transmission of this release command may be conditional on the monitor operating the input device 14. Upon receiving this release command, the control system 50 determines that the start of autonomous driving is permitted, and resumes autonomous driving of the vehicle 70 (S128). When autonomous driving is resumed in this manner, the second communication unit 52b, in place of the first communication unit 52a, transmits driving information including vehicle speed, position information, and the like to the driving monitoring system 10 at predetermined time intervals.

[0104] [Another Example of Processing Flow (Example Using Communication Failure Information)] Figure 7 is a flow diagram showing yet another modified example of the processing executed by the control system 50 and the vehicle monitoring system 10 of the vehicle 70. This figure shows the processing after the communication carrier switching processing S108 shown in Figure 5. The processing before S108 may be the same as the example shown in Figure 5.

[0105] When the communication unit 52A performs the process of switching the communication carrier in S108, the second communication unit 52b requests a connection to the vehicle monitoring system 10 through the communication network of the second communication carrier (S109). The vehicle monitoring system 10 approves the connection request and transmits a response to that effect (S110).

[0106] The vehicle monitoring system 10 (communication fault information acquisition unit 10c) acquires fault information about the communication network of the first communication carrier (S131). As described above, if a fault occurs in the communication network of the first communication carrier, fault information indicating the occurrence of the fault is stored in the server computer of the first communication carrier. The communication fault information acquisition unit 10c, for example, accesses the server computer and receives the fault information about the first communication carrier. Note that the processing of the communication fault information acquisition unit 10c is not limited to this. For example, the communication fault information acquisition unit 10c may receive input from the monitor, via the display device 13 and the input device 14, indicating whether or not there is a fault in the first communication carrier.

[0107] Then, the driving monitoring system 10 determines whether or not a failure has occurred in the communication network of the first communication carrier (S132), and if a failure has occurred ('yes' in S132), the driving monitoring system 10 accesses, for example, another predetermined system and requests rescue for the vehicle 70 (S133).

[0108] On the other hand, if no failure has occurred in the communication network of the first communication carrier ("no" in S132), the failure in communication of the first communication unit 52a is likely to be temporary. Therefore, in this case, the vehicle monitoring system 10 transmits a communication carrier switching command (S134). That is, the vehicle monitoring system 10 instructs the vehicle to restore communication from the communication network of the second communication carrier to the communication network of the first communication carrier. The transmission of the switching command in S134 may be executed after waiting for a predetermined period of time. Furthermore, the transmission of the switching command in S134 may be executed on the condition that the monitor operates the input device 14. In this way, the communication carrier switching process is performed when an explicit command is given by the monitor.

[0109] When the control system 50 (communication unit 52A) receives a command to switch communication carriers from the vehicle monitoring system 10, it performs a communication carrier switching process (S135). Specifically, the first communication unit 52a transmits the first identification information stored in the first identification information storage unit 53A to the communication network (base station) of the first communication carrier. When the authentication process based on the first identification information is successful and the communication network of the first communication carrier becomes available, the first communication unit 52a requests connection to the vehicle monitoring system 10 through the communication network of the first communication carrier (S136). The vehicle monitoring system 10 approves the connection request and transmits a response indicating this (S137).

[0110] Furthermore, the driving monitoring system 10 transmits a command to remove the restriction to the vehicle 70 using the communication network of the first communication carrier (S138). In other words, the driving monitoring system 10 transmits a command to start autonomous driving. The transmission of this command to remove the restriction may be conditional on the monitor operating the input device 14.

[0111] When the control system 50 receives this cancellation command, it determines that the start of autonomous driving is permitted, and resumes autonomous driving of the vehicle 70 (S139). During the resumed autonomous driving, the first communication unit 52a transmits driving information including vehicle speed, position information, etc. to the driving monitoring system 10 at predetermined time intervals.

[0112] 7, the communication by the second communication unit 52b is not used to transmit driving information necessary for monitoring the autonomous driving. In particular, surrounding information of the vehicle 70 (e.g., camera images) included in the driving information is not transmitted by the communication by the second communication unit 52b. Therefore, the bandwidth of the communication by the second communication unit 52b can be narrower than the bandwidth of the communication by the first communication unit 52a, thereby reducing the cost associated with using the second communication carrier.

[0113] [Another Example of Processing Flow] Note that the diagnostic processing described in FIG. 6 may be executed during the processing shown in FIG. 7 . That is, in S110 shown in FIG. 7 , after a communication connection is established between the driving monitoring system 10 and the control system 50 using the communication network of the second communication carrier, the driving monitoring system 10 (diagnostic unit 10b) may request information required for diagnosis from the control system 50. The control system 50 (second communication unit 52b) may then transmit the requested information to the driving monitoring system 10. The requested information may be, for example, information regarding a communication failure that has occurred. More specifically, it may be an error code that was generated or received during communication by the first communication unit 52a. Further, other examples of the requested information may include the operating status (including temperature) of devices and sensors mounted on the vehicle 70, location information of the vehicle 70, etc. Based on the received information, the driving monitoring system 10 (diagnostic unit 10b) may diagnose the communication failure (estimate the cause and effect) or determine whether autonomous driving of the vehicle 70 can be resumed. The diagnosis unit 10b displays the diagnosis result on, for example, the display device 13. If autonomous driving of the vehicle 70 is not possible, the driving monitoring system 10 may, for example, access another predetermined system and request rescue for the vehicle 70 (S133). In addition to this diagnostic processing, the driving monitoring system 10 (communication failure information acquisition unit 10c) may acquire failure information about the communication network of the first communication carrier (S131) ​​and execute the subsequent processing shown in FIG. 7.

[0114] Even in this case, the communication by the second communication unit 52b is not used to transmit driving information necessary for monitoring the autonomous driving. Therefore, the bandwidth of the communication by the second communication unit 52b can be narrower than the bandwidth of the communication by the first communication unit 52a, thereby reducing the cost associated with using the second communication carrier.

[0115] Furthermore, when communication by the second communication unit 52b is not used for autonomous driving, the communication by the second communication unit 52b may be short-range wireless communication (e.g., Wi-Fi) rather than communication based on a standard such as fourth-generation mobile phone (4G), Long Term Evolution (LTE), or fifth-generation mobile phone (5G). In this case, location information indicating a communication area for short-range wireless communication may be stored in advance in the storage device of the driving control device 51. When a communication failure occurs in the communication by the first communication unit 52a, the restriction unit 51b may decelerate the vehicle 70 and move the vehicle 70 to the communication area. When the vehicle 70 reaches a communication area for short-range wireless communication, the second communication unit 52b may access a short-range wireless communication access point and establish a communication connection with the driving monitoring system 10. In this case, the second identification information storage unit 53B may store the SSID (Service Set IDentifier) ​​of the access point and a security key required for access.

[0116] The vehicle 70 has a microphone as the input device 58 and a speaker as the output device 57. Similarly, the traveling monitoring system 10 may have a speaker as the output device and a microphone as the input device. In this case, the monitoring person and the occupants of the vehicle 70 may have a voice conversation using communication via the second communication unit 52b. In other words, the second communication unit 52b may be used to send and receive audio signals input from the microphone.

[0117] 8 is a flow diagram showing an example of processing executed by the control system 50 when a failure is detected in communication by the first communication unit 52 a. This processing may be executed by the control system 50 when, for example, S105 in FIG. 5 is “no.”

[0118] When a failure is detected in communication by the first communication unit 52a, the restriction unit 51b causes the vehicle 70 to travel with partial restrictions imposed on the autonomous travel. For example, the restriction unit 51b may cause the vehicle 70 to travel with a restriction (second restriction) imposed, such as lowering the speed of the vehicle 70 below a predetermined value or a value set in the travel plan (S201). The restriction unit 51b then determines whether a predetermined condition is satisfied (S202). For example, the restriction unit 51b may determine whether the vehicle 70 has reached a position where the road width is greater than a predetermined value or whether the vehicle 70 has reached a predetermined stopping position. Until the predetermined condition is satisfied, the restriction unit 51b causes the vehicle 70 to travel with a restriction imposed on, for example, the vehicle speed (S201). On the other hand, if such a predetermined condition is satisfied ("yes" in S202), the restriction unit 51b stops the vehicle 70 (S203, first restriction).

[0119] 9 is a flow diagram showing an example of processing executed by the control system 50 when a command to remove restrictions is received via communication by the second communication unit 52 b. This processing may be executed by the control system 50, for example, in S112 of FIG. 5, S128 of FIG. 6, or S139 of FIG. 7.

[0120] In response to receiving the cancellation command, the driving control unit 51A drives the vehicle 70 while allowing the vehicle 70 to drive and partially restricting the control of the autonomous driving. For example, the driving control unit 51A drives the vehicle 70 while imposing a restriction (second restriction) that reduces the speed of the vehicle 70 below a predetermined value or a value specified in the driving plan (S301). Then, the driving control unit 51A determines whether a predetermined condition is satisfied (S302). For example, the driving control unit 51A determines whether the outputs of the various sensors included in the sensor unit F, position information calculated from signals received by the GNSS receiver 54, and surrounding information (e.g., camera images) obtained by the surrounding observation device 55 are operating normally. If the predetermined condition is satisfied, the driving control unit 51A resumes the autonomous driving without the above-described restrictions, in other words, autonomous driving according to the driving plan (S303). On the other hand, if the predetermined condition is not satisfied for a predetermined time ("no" in S302), the control system 50 may transmit information indicating that to the monitoring system 10 (S304). At this time, the control system 50 may stop the vehicle 70.

[0121] [Summary] (1) As described above, the control system 50 includes a communication unit capable of communicating with the driving monitoring system 10 via the network N, and a driving control unit 51A that controls the vehicle 70 so that the vehicle 70 drives autonomously. The driving control unit 51A (restriction unit 51b) imposes at least partial restrictions on the control of the autonomous driving when a fault occurs during autonomous driving. After imposing the restriction, the driving control unit 51A lifts the restriction when it receives a command to lift the restriction from the driving monitoring system 10. According to this control system 50, the restriction imposed on the autonomous driving is lifted based on a command from the driving monitoring system 10, rather than based on a decision made by the vehicle 70. This allows the autonomous driving to resume with the restriction lifted at an appropriate time.

[0122] (2) In (1), the control system 50 includes a detector 52c that detects the occurrence of a failure. In the example described above, the detector 52c detects a failure in communication by the first communicator 52a.

[0123] (3) In (1) or (2), the communication unit 52A includes a first communication unit 52a that communicates with the driving monitoring system 10 during automatic driving, and a second communication unit 52b that communicates with the driving monitoring system 10 when a failure occurs in communication by the first communication unit 52a. This ensures redundancy in communication, which allows the vehicle 70 to resume automatic driving sooner, makes it easier for a monitor to grasp the state of the vehicle 70, and allows services using the vehicle 70 to be restored sooner.

[0124] (4) In (3), the communication unit 52A may determine that a failure has occurred in communication by the first communication unit 52a when communication with the driving monitoring system 10 by the first communication unit 52a is impossible for a predetermined period of time.

[0125] (5) In (4), when a failure occurs in communication by the first communication unit 52a, the driving control unit 51A at least partially restricts the autonomous driving of the vehicle 70. This reduces the occurrence of risks caused by a failure in communication by the first communication unit 52a.

[0126] (6) In any of (3) to (5), the first communication unit 52a and the second communication unit 52b communicate with the driving monitoring system 10 using the first identification information and the second identification information, respectively, stored in a common SIM (Subscriber Identity Module).

[0127] (7) In any of (1) to (6), when the driving control unit 51A shown in Fig. 9 receives a command to remove the restriction, it determines whether or not a predetermined condition is satisfied, and then resumes the autonomous driving of the vehicle 70. This reduces the occurrence of problems when the autonomous driving is resumed.

[0128] (8) In any of (1) to (7), if a predetermined condition is not satisfied, the driving control unit 51A shown in FIG. 9 notifies the driving monitoring system 10 via the communication unit 52A that the vehicle 70 cannot resume automatic driving.

[0129] (9) In (3), when a failure occurs in communication by the first communication unit 52a, the driving control unit 51A at least partially restricts the autonomous driving of the vehicle 70. After the restriction is imposed, the driving control unit 51A receives a command to remove the restriction through the second communication unit 52b. This allows the restriction on the autonomous driving to be removed earlier even if the recovery of communication by the first communication unit 52a is delayed.

[0130] In (10) (9), the driving control unit 51A shown in Figures 5 and 6 receives a command to remove the restriction, and then controls the vehicle 70 so that the vehicle 70 drives automatically while communicating with the driving monitoring system 10 through the second communication unit 52b.

[0131] (11) In (3), the first communication unit 52a repeatedly transmits driving information (first information) to the driving monitoring system 10 during autonomous driving. When a failure occurs in communication by the first communication unit 52a, the driving control unit 51A at least partially restricts the autonomous driving of the vehicle 70. After the restriction is imposed, the second communication unit 52b shown in FIG. 6 transmits information (second information) to the driving monitoring system 10 that is different from the transmission information transmitted by the first communication unit 52a. This allows the bandwidth of communication by the second communication unit 52b to be different from the bandwidth of communication by the first communication unit 52a, thereby reducing the cost required for communication by the second communication unit 52b. Furthermore, depending on the type of second information, the driving monitoring system can grasp the state of the vehicle and any faults.

[0132] (12) In (3), the amount of data of the second information transmitted per unit time is smaller than the amount of data of the first information transmitted per unit time.

[0133] (13) In (11), the second information includes information about the vehicle 70 and / or the fault that has occurred. This allows the driving monitoring system 10 to diagnose the condition of the vehicle 70 and the fault (estimate the cause and effect of the fault), and to take appropriate action based on the diagnosis results.

[0134] (14) In (3), after a failure occurs in communication by the first communication unit 52a, the communication unit 52A shown in Fig. 7 may receive a command to restore communication by the first communication unit 52a from the driving monitoring system 10 via the second communication unit 52b. This allows for earlier restoration to automatic driving using communication by the first communication unit 52a.

[0135] (15) In any of (1) to (14), the restrictions imposed on the control of the automatic driving may include a first restriction that stops the vehicle 70 and a second restriction that partially restricts the control of the automatic driving while allowing the vehicle 70 to drive. The driving control unit 51A may select one of the first restriction and the second restriction based on an obstacle and / or environment that has occurred to the vehicle 70. This makes it possible to impose a restriction according to an obstacle and / or environment that has occurred to the vehicle 70.

[0136] (16) In (15), after the second restriction is selected, the traveling control unit 51A may stop the vehicle 70 when a predetermined condition is satisfied (see FIG. 8).

[0137] (17) In (15), the driving control unit 51A shown in Fig. 9 may, in response to a release command, drive the vehicle 70 in a state where the vehicle is permitted to drive but where the control of the automatic driving is partially restricted, and then resume the automatic driving without restrictions when a predetermined condition is satisfied. This can reduce the occurrence of problems when the automatic driving without restrictions is resumed.

[0138] (20) As described above, the control system 50 includes a communication unit 52A capable of communicating with the driving monitoring system 10 via the network N and a driving control unit 51A that controls the vehicle 70 so that the vehicle 70 drives autonomously. The communication unit 52A includes a first communication unit 52a that transmits first information (driving information) to the driving monitoring system 10 during autonomous driving, and a second communication unit 52b. The driving control unit 51A at least partially restricts the control of the autonomous driving when a failure occurs in communication by the first communication unit 52a during autonomous driving. The second communication unit 52b transmits second information to the driving monitoring system 10, the second information being different from the driving information transmitted by the first communication unit 52a, when the autonomous driving of the vehicle 70 is restricted. This allows the bandwidth of the communication line transmitted by the second communication unit 52b to be different from the bandwidth of the communication line transmitted by the first communication unit 52a, thereby reducing the cost required for communication by the second communication unit 52b. Depending on the type of second information, the driving monitoring system 10 can also grasp the state of the vehicle 70 and any obstacles.

[0139] (23) The vehicle monitoring system 10 also includes a communication device 15 for communicating with the vehicle 70 and a control device 11. The communication device 15 communicates with a first communication unit 52a of the vehicle 70 via a network N while the vehicle 70 is autonomously traveling. Furthermore, when autonomous traveling is at least partially restricted due to a failure in communication with the first communication unit 52a while the vehicle 70 is autonomously traveling, the communication device 15 communicates with a second communication unit 52b of the vehicle 70 via the network N. The control device 11 (diagnostic unit 10b) diagnoses the vehicle 70 and / or the failure based on information received from the second communication unit 52b. Accordingly, if a failure occurs in communication via the first communication unit 52a, the vehicle monitoring system 10 can determine the cause of the failure and the occurrence of other malfunctions via communication via the second communication unit 52b.

[0140] [Others] The vehicle control system and vehicle monitoring system proposed in the present disclosure are not limited to the control system 50 and vehicle monitoring system 10 described above.

[0141] For example, in the control system 50, a fault detected during autonomous driving is a fault in communication with the first communication unit 52a. However, a fault detected during autonomous driving may not only be a communication fault, but also an abnormality in a sensor or device such as the sensor unit F or the surroundings observation device 55. Furthermore, a fault detected during autonomous driving may be the vehicle 70 deviating from a predetermined driving path (a driving path defined in a driving plan). In these cases, the control system 50 may have only the first identification information storage unit 53A, without having the second identification information storage unit 53B. In other words, the number of identification information storage units may be one.

[0142] For example, if an abnormality is detected in a sensor (if an obstacle occurs in the autonomous driving), the restriction unit 51b imposes a restriction on the control of the autonomous driving. More specifically, the restriction unit 51b stops the vehicle 70. Thereafter, the control system 50 may receive a command to remove the restriction from the driving monitoring system 10 via communication using the identification information in the first identification information storage unit 53A (communication using the communication network of the first communication carrier) and resume autonomous driving. Furthermore, if the vehicle 70 deviates from a predetermined driving path (a driving path specified in the driving plan), the restriction unit 51b may stop the vehicle 70. The control system 50 may receive a new driving path (a new driving plan) from the driving monitoring system 10 via communication using the identification information in the first identification information storage unit 53A (communication using the communication network of the first communication carrier). Thereafter, the control system 50 may receive a command to remove the restriction from the driving monitoring system 10 and start autonomous driving in accordance with the new driving plan.

[0143] Furthermore, if communication with the control system 50 via the first communication carrier becomes impossible and a communication connection with the control system 50 via the second communication carrier cannot be established, the diagnosis unit 10b of the traveling monitoring system 10 may determine that the communication control device 52 or the power supply of the communication control device 52 has failed. The power supply (battery) for the communication control device 52 may be provided separately from the battery for driving the electric motor of the drive mechanism 61. This can improve the robustness of the power supply for the communication control device 52 and reduce the occurrence of communication failures due to a power supply failure of the communication control device 52.

Claims

1. A control system to be mounted on a vehicle capable of autonomous driving, comprising: a communication unit capable of communicating with a driving monitoring system via a network; and a control unit that controls the vehicle so that the vehicle drives autonomously, wherein the control unit imposes at least partial restrictions on control of the autonomous driving when a fault occurs during the autonomous driving, and the control unit releases the restrictions when it receives a command to release the restrictions from the driving monitoring system after imposing the restrictions.

2. The vehicle control system according to claim 1, further comprising a detection unit that detects the occurrence of the fault.

3. A vehicle control system as described in claim 1, wherein the communication unit includes: a first communication unit that communicates with the driving monitoring system during the autonomous driving; and a second communication unit that communicates with the driving monitoring system when a failure occurs in communication by the first communication unit.

4. A vehicle control system as described in claim 3, wherein the communication unit determines that a failure has occurred in communication by the first communication unit when communication with the driving monitoring system by the first communication unit is impossible for a predetermined period of time.

5. A vehicle control system as described in claim 4, wherein the control unit at least partially restricts the autonomous driving of the vehicle when a failure occurs in communication by the first communication unit.

6. A vehicle control system as described in claim 3, wherein the first communication unit and the second communication unit communicate with the driving monitoring system using first identification information and second identification information, respectively, stored in a common SIM (Subscriber Identity Module).

7. The vehicle control system according to claim 1, wherein the control unit, upon receiving the command to remove the restriction, determines whether or not a predetermined condition is satisfied, and then resumes automatic driving of the vehicle.

8. The vehicle control system according to claim 7, wherein the control unit notifies the driving monitoring system through the communication unit that automatic driving of the vehicle cannot be resumed if the predetermined condition is not satisfied.

9. A vehicle control system as described in claim 3, wherein the control unit at least partially imposes the restriction on the autonomous driving of the vehicle when a failure occurs in communication by the first communication unit, and the control unit receives a command to remove the restriction through the second communication unit after the restriction is imposed.

10. A vehicle control system as described in claim 9, wherein the control unit, after receiving the command to remove the restriction, controls the vehicle so that the vehicle drives automatically while communicating with the driving monitoring system through the second communication unit.

11. A vehicle control system as described in claim 3, wherein the first communication unit repeatedly transmits first information to the driving monitoring system during the autonomous driving, the control unit at least partially imposes the restriction on the autonomous driving of the vehicle when a failure occurs in communication by the first communication unit, and the second communication unit transmits second information to the driving monitoring system after the restriction is imposed.

12. The vehicle control system according to claim 11, wherein the amount of data of the second information transmitted per unit time is smaller than the amount of data of the first information transmitted per unit time.

13. The vehicle control system according to claim 11, wherein the second information includes information relating to the vehicle and / or the fault.

14. A vehicle control system as described in claim 3, wherein the communication unit receives a command to restore communication by the first communication unit from the driving monitoring system via the second communication unit after a failure occurs in communication by the first communication unit.

15. A vehicle control system as described in claim 1, wherein the restrictions imposed on the control of the automatic driving include a first restriction that stops the vehicle and a second restriction that partially restricts the control of the automatic driving while allowing the vehicle to drive, and the control unit selects one of the first restriction and the second restriction based on an obstacle and / or the environment that has occurred to the vehicle.

16. The vehicle control system according to claim 15, wherein the control unit stops the vehicle when a predetermined condition is satisfied after the second restriction is selected.

17. A vehicle control system as described in claim 15, wherein the control unit, in response to the release command, drives the vehicle in a state in which control of the automatic driving is partially restricted while allowing the vehicle to drive, and then resumes the automatic driving without the restriction when predetermined conditions are satisfied.

18. A method for controlling a vehicle capable of autonomous driving, comprising: a step of communicating with a driving monitoring system through a network; and a step of controlling the vehicle so that the vehicle drives autonomously, wherein the step of controlling the vehicle includes a step of at least partially restricting control of the autonomous driving when a fault occurs during the autonomous driving; and a step of lifting the restriction when a command to lift the restriction is received from the driving monitoring system after the restriction is imposed.

19. A program that causes one or more computers to function as a control system that controls a vehicle capable of autonomous driving, the program comprising: a communication means for communicating with a driving monitoring system via a network; and a control means for controlling the vehicle so that the vehicle drives autonomously; a means for the control means to at least partially restrict control of the autonomous driving when a fault occurs during the autonomous driving; and a means for lifting the restriction when a command to lift the restriction is received from the driving monitoring system after the restriction has been imposed.

20. A control system to be mounted on a vehicle capable of autonomous driving, comprising: a communication unit capable of communicating with a driving monitoring system via a network; and a control unit that controls the vehicle so that the vehicle drives autonomously, wherein the communication unit includes a first communication unit that transmits first information to the driving monitoring system during the autonomous driving, and a second communication unit, wherein the control unit at least partially restricts control of the autonomous driving when a failure occurs in communication by the first communication unit during the autonomous driving, and the second communication unit transmits second information, which is of a different type from the first information, to the driving monitoring system while the restriction is imposed on the autonomous driving of the vehicle.

21. A method for controlling a vehicle capable of autonomous driving, comprising: a first communication step of communicating with a driving monitoring system through a network and transmitting first information to the driving monitoring system during the autonomous driving; a step of controlling the vehicle so that the vehicle drives autonomously, and when a failure occurs in communication by the first communication unit during the autonomous driving, at least partially restricting control of the autonomous driving; and a second communication step of communicating with the driving monitoring system through a network and transmitting second information, which is of a type different from the first information, to the driving monitoring system while the restriction is being imposed on the autonomous driving of the vehicle.

22. A program that causes one or more computers to function as a control system to be installed in a vehicle capable of autonomous driving, comprising: a first communication means that communicates with a driving monitoring system via a network and transmits first information to the driving monitoring system during the autonomous driving; a control means that controls the vehicle so that it drives autonomously, and that imposes at least partial restrictions on control of the autonomous driving when a failure occurs in communication by the first communication unit during the autonomous driving; and a second communication means that communicates with the driving monitoring system via a network and transmits second information, which is of a type different from the first information, to the driving monitoring system when the restriction is imposed on the autonomous driving of the vehicle.

23. A vehicle travel monitoring system that has a first communication unit and a second communication unit and monitors the travel of a vehicle capable of autonomous driving, comprising: a communication device for communicating with the vehicle; and a control device, wherein the communication device communicates with the first communication unit of the vehicle through a network while the vehicle is autonomously driving, and communicates with the second communication unit of the vehicle through the network when the autonomous driving is at least partially restricted due to a failure in communication with the first communication unit while the vehicle is autonomously driving, and the control device diagnoses the vehicle and / or the failure based on information received from the second communication unit.

24. A driving monitoring method for monitoring the driving of a vehicle capable of autonomous driving having a first communication unit and a second communication unit, comprising: a step of communicating with the first communication unit of the vehicle through a network while the vehicle is autonomously driving; a step of communicating with the second communication unit of the vehicle through a network when the autonomous driving is at least partially restricted due to a failure in communication with the first communication unit while the vehicle is autonomously driving; and a step of diagnosing the vehicle and / or the failure based on information received from the second communication unit.

25. A program that causes one or more computers to function as a driving monitoring system that monitors the driving of a vehicle capable of autonomous driving having a first communication unit and a second communication unit, the program causing the one or more computers to function as communication means for communicating with the vehicle and control means, the communication means communicating with the first communication unit of the vehicle through a network while the vehicle is autonomously driving, and communicating with the second communication unit of the vehicle through the network when the autonomous driving is at least partially restricted due to a failure in communication with the first communication unit while the vehicle is autonomously driving, and the control means diagnosing the vehicle and / or the failure based on information received from the second communication unit.

Images