WO2022202948A1

WO2022202948A1 - Driving control device

Info

Publication number: WO2022202948A1
Application number: PCT/JP2022/013756
Authority: WO
Inventors: 健司吉岡
Original assignee: いすゞ自動車株式会社
Priority date: 2021-03-25
Filing date: 2022-03-23
Publication date: 2022-09-29
Also published as: JP2022149043A

Abstract

A driving control device 10 includes: a detection unit 122 that detects a fault in at least one of a plurality of devices related to a plurality of driving control functions; an identification unit 123 that identifies, as a faulty function, a driving control function whose operation is impeded by the fault detected by the detection unit 122 from among the plurality of driving control functions; a driving control unit 124 that executes at least one of the plurality of driving control functions to control the driving of a vehicle V, and performs control corresponding to the faulty function identified by the identification unit 123; and a notification unit 125 that notifies a driver of information corresponding to the faulty function identified by the identification unit 123.

Description

Operation control device

The present invention relates to an operation control device.

Conventionally, systems that perform driving control such as driving support for vehicle drivers are known. In such a system, when a failure occurs in a device that detects information necessary for operation control, operation control is stopped and the driver is notified that there is a failure in the device (for example, Patent Document 1 ).

JP-A-11-020498

In the conventional system, when a failure occurred in one of the multiple devices for performing operation control, regardless of the type of device, the operation control was stopped and a failure occurred in the device for performing operation control. was notified to the driver uniformly. Therefore, regardless of the degree of failure, the driver needs to drive the vehicle without relying on operation control, and there is a problem that the driver cannot grasp the degree of failure and take appropriate action.

SUMMARY OF THE INVENTION Accordingly, the present invention has been made in view of these points, and an object of the present invention is to reduce the burden on the driver when the device fails and to enable the driver to act according to the degree of the failure. .

A driving control device according to a first aspect of the present invention includes a detecting unit for detecting a failure of at least one of a plurality of devices related to a plurality of driving control functions, which are functions related to driving control of a vehicle; a specifying unit that specifies, among functions, a driving control function whose operation is hindered by a failure detected by the detecting unit as a malfunctioning function; and a driving control unit that performs control corresponding to the failure function specified by the specifying unit, and a notification unit that notifies the driver of information corresponding to the failure function specified by the specifying unit.

An automatic driving function that performs driving control of the vehicle without requiring a driving operation by the driver is realized by the plurality of driving control functions related to automatic driving, and the specifying unit relates to the automatic driving function as the failure function. When an operation control function is specified, it is specified whether or not the operation control function can be complemented by a redundant function, and the operation control unit determines whether the failure function specified by the identification unit can be complemented by a redundant function. The notification unit may notify the driver of information based on whether or not the failure function identified by the identification unit can be complemented by a redundant function.

When the specifying unit specifies that the failure function related to the automatic driving function can be complemented by the redundant function, the driving control unit controls the automatic driving during manual driving that is driven only by the operation of the driver. When the operation to perform is performed, the automatic operation function is executed, and when the automatic operation function is executed, the automatic operation function is continuously executed, and the notification unit detects that an abnormality occurs in the failure function during the manual operation. and information indicating that the automatic driving function can be executed but prompts the vehicle to be inspected, and when the automatic driving function is executed, the malfunction function is abnormal. Notifying the driver of information indicating that the automatic driving has occurred, information indicating that the automatic driving can be continued, but prompting inspection of the vehicle, and information indicating that the automatic driving function is to be continued. You may

When the identifying unit identifies that the failure function related to the automatic driving function can be complemented by the redundant function, the notification unit continues to execute the automatic driving function by the redundant function. and information indicating that the automatic driving function cannot be executed if the redundant function fails.

A plurality of driving control functions related to driving support realize a driving support function that controls driving of the vehicle on condition that the driver performs a driving operation, and the automatic driving function includes the driving support function. , realized by a plurality of the driving control functions related to the automatic driving, and when the identifying unit identifies that the driving control function related to the identified automatic driving function cannot be supplemented by a redundant function, the driving support function It further specifies whether it is possible to perform limited operation control or whether it is necessary to perform manual operation that is operated only by the operation of the driver, and the operation control unit performs the operation control function related to the specified automatic operation function can not be supplemented by the redundant function, control is performed based on whether it is possible to perform operation control limited to the driving support function or whether it is necessary to switch to the manual operation. , When the specifying unit specifies that the specified driving control function related to the automatic driving function cannot be complemented by the redundant function, the notification unit can perform driving control by limiting to the driving support function. Alternatively, the driver may be notified of information based on whether it is necessary to switch to manual operation.

When the specifying unit specifies that the failure function related to the automatic driving function cannot be complemented by the redundant function and that operation control limited to the driving support function is possible, the operation control unit When the automatic operation is performed during manual operation, the driving support function is executed, and when the automatic driving function is executed, the operation control by the automatic driving function is shifted to the driving control by the driving support function, The notification unit notifies the driver of information indicating that the automatic driving is impossible during the manual driving and that the driving support function is executable, and when the automatic driving function is executed, the automatic driving function is executed. The driver may be notified of information indicating transition from driving control by the driving function to driving control by the driving support function.

When the specifying unit specifies that the failed function related to the automatic operation function cannot be complemented by the redundant function and the manual operation needs to be performed, the operation control unit automatically operates during the manual operation. is performed, the automatic driving function and the driving support function are not executed, and when the automatic driving function is executed, the operation control by the automatic driving function is shifted to the manual operation, and the notification unit is During the manual driving, the driver is notified of information indicating that the automatic driving and the driving assistance are impossible, and when the automatic driving function is executed, the driving control by the automatic driving function is shifted to the manual driving. The driver may be notified of information indicating to do so.

The identifying unit further identifies whether or not the failure detected by the detecting unit will interfere with running of the vehicle. When specified, all of the plurality of operation control functions are stopped, and when the specifying unit specifies that the running of the vehicle will be hindered, the notification unit will hinder the running of the vehicle due to the failure of the device. The driver may be notified of information indicating that.

According to the present invention, it is possible to reduce the burden on the driver when the device breaks down, and the driver can act in accordance with the degree of the breakdown.

It is a figure which shows typically the internal structure of the vehicle which concerns on this embodiment. It is a figure which shows an example of information for trouble range identification. 4 is a flowchart showing an example of the flow of processing in the operation control device when the vehicle according to the present embodiment is running in manual operation; It is a flowchart which shows an example of the flow of a process in an operation control apparatus when the vehicle which concerns on this embodiment is driving|running|working by automatic operation.

[Overview of Operation Control Device 10]
The operation control device 10 according to the embodiment is a device that is mounted on a vehicle V and performs operation control of the vehicle V. As shown in FIG. The driving control device 10 performs driving control of the vehicle V, such as automatic driving of the vehicle V and driving assistance for the driver, by executing at least one of a plurality of driving control functions.

Before explaining the operation control device 10, the operation support function, automatic operation function, and manual operation will be explained. The driving support function is a function that performs driving control of the vehicle V on condition that the driver performs a driving operation using a plurality of driving control functions related to driving support. The driving support function is, for example, a function corresponding to automatic driving levels 1 and 2 defined by the Society of Automotive Engineers of Japan (JASO). The automatic driving function is a function that controls the operation of the vehicle V without requiring the driver's driving operation by using a plurality of driving control functions related to automatic driving, including the driving support function. The automatic driving function is, for example, a function corresponding to automatic driving level 3 or higher. Manual driving means that the driving support function and the automatic driving function are not operating, and the driving is performed only by the driver's operation.

When the operation control device 10 detects a failure in at least one of the plurality of devices related to the plurality of operation control functions of the vehicle V, it identifies the operation control function whose operation is affected by the failure. The operation control device 10 controls continuation of automatic operation, switching from automatic operation to operation support, or switching from automatic operation to manual operation, in response to the operation control function identified as having trouble in operation due to failure. . In addition, the operation control device 10 notifies the driver of information corresponding to the operation control function identified as having trouble in operation due to failure. In this manner, the operation control device 10 can reduce the burden on the driver by performing control according to the situation with respect to operation control functions that cause trouble in operation. In addition, since the operation control device 10 notifies the driver of information corresponding to the operation control function that causes trouble in operation, the driver can act according to the information.

[Configuration of vehicle V]
Before describing the operation control device 10 in detail, the internal configuration of the vehicle V will be described. FIG. 1 is a diagram schematically showing the internal configuration of a vehicle V according to this embodiment. The vehicle V has various sensors 1 , a plurality of imaging devices 2 , an operation unit 3 , a sound output device 4 , a display device 5 , various ECUs 6 , and an operation control device 10 .

Various sensors 1 are sensors that measure information about the vehicle V, and include, for example, speed sensors, acceleration sensors, accelerator sensors, brake sensors, steering sensors, and the like. The various sensors 1 also include a steering angle sensor used to detect that the driver is steering. Further, the various sensors 1 include sensors used for performing travel control of the vehicle V, including LiDAR (Light Detection and Ranging) and SRR (Short Range Radar). The various sensors 1 perform measurements, for example, at predetermined time intervals, and output measurement data indicating the results of the measurements to the operation control device 10 . The plurality of imaging devices 2 are, for example, cameras that capture front, side, and rear images of the vehicle V, and output captured images to the operation control device 10 .

The operation unit 3 is, for example, a button provided on the vehicle V or a touch panel superimposed on the display device 5, and receives operation input from the driver. For example, the operation unit 3 receives an operation for causing the operation control device 10 to perform automatic driving and an operation for causing the operation control device 10 to perform driving assistance from the driver. In the following description, an operation for causing the operation control device 10 to perform automatic operation is referred to as an operation for performing automatic operation. Further, an operation for causing the operation control device 10 to perform driving assistance is referred to as an operation for performing driving assistance.

The sound output device 4 is, for example, a speaker, and outputs sound based on the audio signal output from the operation control device 10 .
The display device 5 is, for example, a display device, and displays various information under the control of the operation control device 10 .

The various ECUs 6 are, for example, ECUs provided in the vehicle V, and include an engine control ECU, a brake control ECU, a transmission control ECU, a power steering ECU, and the like. Various ECUs 6 control the engine, the brakes, the transmission, and the power steering according to the control of the operation control device 10 . Here, the vehicle V is redundantly designed such as by duplicating a communication path for steering control in order to cope with a failure during automatic driving. The vehicle V may be designed redundantly not only for the steering but also for the engine control system, the brake control system, and the like, in order to cope with failures during automatic driving.

[Configuration of Operation Control Device 10]
Next, the configuration of the operation control device 10 will be described. The operation control device 10 has a storage unit 11 and a control unit 12, as shown in FIG. The control unit 12 has a position acquisition unit 121 , a detection unit 122 , a specification unit 123 , an operation control unit 124 and a notification unit 125 .

The storage unit 11 is, for example, ROM (Read Only Memory) or RAM (Random Access Memory). The storage unit 11 stores various programs for causing the control unit 12 to function. The storage unit 11 stores a program that causes the control unit 12 to function as a position acquisition unit 121 , detection unit 122 , identification unit 123 , operation control unit 124 and notification unit 125 .

The control unit 12 is a computational resource including a processor such as a CPU (Central Processing Unit) (not shown). The control unit 12 functions as a position acquisition unit 121 , a detection unit 122 , an identification unit 123 , an operation control unit 124 and a notification unit 125 by executing programs stored in the storage unit 11 .

The position acquisition unit 121 acquires vehicle position information indicating the position of the vehicle V. For example, the position acquisition unit 121 receives radio waves emitted by positioning satellites such as GNSS (Global Navigation Satellite System) and GPS (Global Positioning System), and acquires vehicle position information based on the received radio waves. The position acquisition unit 121 outputs the acquired vehicle position information to the operation control unit 124, for example.

The detection unit 122 detects failure of at least one of the plurality of devices related to the plurality of operation control functions. For example, the detection unit 122 detects failure of at least one of various sensors 1, imaging device 2, and various ECUs 6 as failures of a plurality of devices related to a plurality of operation control functions.

For example, the detection unit 122 acquires error information indicating that radio waves or sound waves cannot be emitted or received from LiDAR, SRR, and sonar included in the various sensors 1, thereby detecting failure of these sensors. to detect

The detection unit 122 detects that the imaging device 2 has failed by acquiring error information indicating that the optical axis has deviated and that the luminance cannot be secured from the imaging device 2 . Further, when the image cannot be obtained from the imaging device 2 , the detection unit 122 detects that a failure has occurred in which the image cannot be obtained from the imaging device 2 .

When the detection unit 122 cannot receive radio waves emitted by positioning satellites such as GNSS and GPS, it detects that the position acquisition unit 121 has failed. Further, when the detection unit 122 receives error information indicating that the ECU has failed from various ECUs 6 and when there is no response from the ECU, the detection unit 122 detects that the ECU has failed. A failure related to the ECU includes a failure of the communication unit of the ECU, a failure of the CPU, and the like. It is assumed that the detection unit 122 can identify the device ID for identifying the failed device and the type of failure.

The identifying unit 123 identifies, as a faulty function, an operation control function whose operation is hindered by a failure detected by the detection unit 122, among the plurality of operation control functions. In addition, the identifying unit 123 identifies whether or not the failure detected by the detecting unit 122 will hinder the vehicle V from traveling. A state in which traveling of the vehicle V is hindered is a state in which traveling is hindered not only during automatic driving and driving assistance, but also during manual driving.

For example, in the storage unit 11, a device ID corresponding to a device, information indicating the type of failure of the device, a function ID for identifying an operation control function that is hindered by the failure of the device, the failed device and Information for identifying a range of trouble is stored in which the type of trouble of the device is associated with the information indicating whether or not the running of the vehicle V is impeded. Here, the trouble range identification information includes not only function IDs for identifying operation control functions that cause trouble in operation due to device failure, but also functions related to running of the vehicle V, such as brakes and gear changes. A function ID for doing is also included.

FIG. 2 is a diagram showing an example of trouble range identification information. The information for specifying the trouble range shown in FIG. It can be confirmed that the function name is associated with the travel obstacle information. As shown in FIG. 2, it can be confirmed that the lane change function, constant speed driving function, and follow-up driving function are the driving control functions that hinder the operation when a failure occurs in which the front camera cannot acquire an image. Further, it can be confirmed that the running of the vehicle V is not hindered even if the front camera fails to obtain an image. Further, it can be confirmed that the running of the vehicle V is hindered when the water pump fails.

The identifying unit 123 refers to the failure range identifying information stored in the storage unit 11, and identifies the device ID of the device in which the detecting unit 122 has detected a failure and the function ID associated with the type of failure. By doing so, the operation control function that causes trouble in operation is identified as the faulty function. Further, the identifying unit 123 refers to the trouble range identifying information and to the traveling obstacle information associated with the device ID of the device in which the detecting unit 122 has detected a failure and the type of the failure. Identify whether or not there will be any hindrance to the running of the vehicle.

In addition, when the identifying unit 123 identifies an operation control function related to an automatic operation function as a faulty function, it identifies whether or not the operation control function can be complemented by a redundant function. For example, the storage unit 11 stores redundant function information indicating a relationship between an operation control function and a redundant function of the operation control function. When the operation control function related to the automatic operation function is specified as the failed function, the specifying unit 123 refers to the redundant function information and specifies the redundant function corresponding to the failed function. The identifying unit 123 identifies whether the failed function can be complemented by the redundant function by determining whether the identified redundant function is operable.

In addition, when the identifying unit 123 identifies the driving control function related to the automatic driving function as the malfunctioning function, and identifies that the malfunctioning function cannot be supplemented by the redundant function, the driving control is limited to the driving support function. It is further specified whether it is possible to perform manual operation or whether it is necessary to switch from operation control related to automatic operation to manual operation and perform manual operation. For example, when the driving control unit 124 cannot control the brake, or when both the main function and the redundant function for the steering control are identified as faulty functions, the identifying unit 123 identifies that manual driving is necessary. . In addition, when the operation control unit 124 cannot control the brake, or when both the main function and the redundant function for steering control are specified as failure functions, when automatic driving is performed, driving related to automatic driving Identify the need to switch from control to manual operation.

The operation control unit 124 controls the operation of the vehicle V by executing at least one of a plurality of operation control functions. For example, when the vehicle V is traveling on a highway, the driving control unit 124 receives from the driver a setting of an automatic driving mode for automatically driving the vehicle V, and executes the automatic driving function to control the vehicle V. automatic operation. The driving control unit 124 may execute the automatic driving function to automatically drive the vehicle V when the setting of the automatic driving mode is received while the vehicle is traveling on a general road.

When the operation control unit 124 executes at least one of a plurality of operation control functions to control the operation of the vehicle V, the detection unit 122 detects a device failure, and the identification unit 123 identifies the malfunctioning function. Then, control corresponding to the failure function is performed. When the identification unit 123 identifies the operation control function related to the automatic operation function as the malfunction function, the operation control unit 124 performs control based on whether or not the malfunction function can be complemented by the redundant function. In addition, the operation control unit 124, when the failed function cannot be complemented by the redundant function and the automatic operation function cannot be executed, is it possible to perform operation control by limiting the automatic operation function to the driving support function? Control is performed based on whether it is necessary to switch from operation control related to the automatic operation function to manual operation and perform manual operation.

The notification unit 125 notifies the driver of information corresponding to the failure function identified by the identification unit 123 . The notification unit 125 causes the sound output device 4 to output a sound corresponding to the failed function specified by the specifying unit 123, or causes the display device 5 to display a screen corresponding to the failed function specified by the specifying unit 123. , to inform the driver of information corresponding to the faulty function.

The notification unit 125 notifies the driver of information based on whether or not the malfunction function can be complemented by the redundant function when the identification unit 123 identifies the operation control function related to the automatic driving function as the malfunction function. In addition, the notification unit 125 determines whether it is possible to perform operation control by limiting the automatic operation function to the driving support function when the malfunction function cannot be complemented by the redundant function, or whether the operation control related to automatic operation can be manually performed. To notify a driver of information based on whether it is necessary to switch to driving and perform manual driving. Details of the operation control unit 124 and the notification unit 125 will be described below separately for manual operation and automatic operation.

[Processing during manual operation]
First, the control of the operation control unit 124 and the notification unit 125 during manual operation will be described.

[When a failure occurs that can be supplemented by the redundancy function]
When the identification unit 123 identifies that the failure function related to the automatic operation function can be complemented by the redundant function during manual operation, the operation control unit 124 performs operation control related to the automatic operation function when an operation to perform automatic operation is performed. to run. For example, if one of the wiring paths for the steering is disconnected and the redundant wiring is available, the operation control unit 124 switches control so that steering is controlled using the redundant wiring. enables execution of the automatic driving function.

In this case, the notification unit 125 notifies the driver of information indicating that an abnormality has occurred in the failure function and information indicating that the automatic driving function can be executed but that the vehicle V should be inspected. By doing so, the burden on the driver can be reduced because the automatic driving function can be executed. Also, the driver can recognize that an abnormality has occurred in the driving support function, and can promptly perform inspection.

[When a failure occurs that cannot be supplemented by the redundant function, and operation control limited to the driving support function is possible]
When the specifying unit 123 specifies that the failure function related to the automatic driving function cannot be complemented by the redundant function during manual operation and that the operation control limited to the driving support function is possible, the operation control unit 124 performs automatic driving is performed, the driving support function is executed instead of the automatic driving function.

For example, it is assumed that the imaging device 2 that captures an image in front of the vehicle V performs vehicle detection and lane detection in front, and the vehicle detection in front is complemented by LiDAR. In this case, if the image pickup device 2 that picks up an image in front of the vehicle V fails, the LiDAR can detect the vehicle and supplement the vehicle detection by the image pickup device 2, but the LiDAR alone cannot maintain the lane. Therefore, when an operation for automatic driving is performed, the driving control unit 124 executes the driving support function (following the preceding vehicle).

In this case, the notification unit 125 outputs information indicating that an abnormality has occurred in the failure function, information indicating that the inspection of the vehicle V is to be urged, and information indicating that automatic driving is impossible and that only the driving support function can be executed. The driver is notified of the information indicating that the By doing so, the driver can recognize that the automatic driving is impossible, and can quickly perform the inspection. In addition, since the driving control unit 124 can perform only driving support functions, it is possible to reduce the burden on the driver.

[When a failure that cannot be supplemented by the redundant function occurs and it is necessary to shift to manual operation]
When the identification unit 123 identifies that the failure function related to the automatic operation function cannot be complemented by the redundant function during manual operation, and it is necessary to switch from the operation control related to automatic operation to the manual operation, the operation control unit 124 When an operation for automatic driving is performed, control is performed so that the automatic driving function and the driving support function are not executed, and the driver continues manual driving. Further, when an operation for driving assistance is performed, the driving control unit 124 performs control so as not to execute the driving assistance function, and allows the driver to continue manual driving.

For example, if the brake ECU cannot control the brakes, or if both the main function and the redundant function for steering control fail, the control corresponding to the automatic driving function and the driving support function cannot be performed, and the manual driving by the driver cannot be performed. Is required. In this case, the driving control unit 124 controls not to execute the automatic driving function and the driving support function even if an operation for automatic driving or an operation for driving assistance is performed, and causes the driver to continue manual driving.

In this case, the notification unit 125 provides information indicating that an abnormality has occurred in the failure function, information indicating that automatic driving and driving assistance are impossible, information indicating that there is no problem in manual driving, and vehicle The driver is notified of the information indicating that the inspection of the V is to be urged. By doing so, the driver can recognize that automatic driving and driving assistance are impossible, and can promptly perform inspections.

[When there is a problem with the running of the vehicle]
When the specifying unit 123 specifies that the malfunction detected by the detecting unit 122 during manual driving interferes with the running of the vehicle V, the driving control unit 124 performs automatic driving or driving assistance operation. Control so that the automatic driving function and driving support function are not executed, and allow the driver to continue manual driving. In this case, the notification unit 125 provides information indicating that an abnormality has occurred in the failure function, information indicating that automatic driving and driving assistance are impossible, and information that the failure will hinder the running of the vehicle V. and information indicating that the vehicle V should be inspected are notified to the driver. When the running of the vehicle V is hindered, the notification unit 125 emphasizes that the vehicle V needs to be inspected. You may emphasize information that indicates a prompt to

[Processing during automatic operation]
Next, the control of the operation control unit 124 and the notification unit 125 during automatic operation, that is, during execution of the automatic operation function will be described.

[When a failure occurs that can be supplemented by the redundancy function]
When the identification unit 123 identifies that the failure function related to the automatic operation function can be complemented by the redundant function during automatic operation, the operation control unit 124 switches from the failure function to the redundant function to continue the automatic operation function. to run. In this case, the notification unit 125 provides information indicating that an abnormality has occurred in the failure function, information indicating that the automatic driving function can be continued without hindrance, but prompting inspection of the vehicle V, and information indicating that the automatic driving function to the driver. By doing so, the automatic driving is maintained, so it is possible to suppress an increase in the burden on the driver due to the failure of the device. Also, the driver can recognize that an abnormality has occurred in the driving support function, and can promptly perform inspection.

Further, when the identification unit 123 identifies that the failure function related to the automatic operation function can be complemented by the redundant function, the notification unit 125 provides information indicating that the automatic operation function is continuously executed by the redundant function and , or information indicating that the automatic driving function cannot be executed if the redundant function also fails. By doing so, the driver can understand that the automatic driving function cannot be executed if the redundant function also fails, and can promptly request inspection and repair so that the automatic driving function can be executed without hindrance. .

[When a failure occurs that cannot be supplemented by the redundant function, and operation control limited to the driving support function is possible]
When the identification unit 123 identifies that the failure function related to the automatic driving function cannot be complemented by the redundant function during automatic driving, and the operation control limited to the driving support function is possible, the operation control unit 124 automatically operates Shift from operation control by function to operation control by driving support function.

Further, in this case, the notification unit 125 changes information indicating that an abnormality has occurred in the failure function, information indicating that the vehicle V should be inspected, and driving control from the automatic driving function to the driving support function. The driver is notified of the information indicating that the transition is to be made. The notification unit 125 may continue to notify the driver of information indicating transition to driving control by the driving support function until the various sensors 1 detect that the driver has steered the vehicle. By doing so, it is possible to make the driver aware of the shift from automatic driving to driving assistance, and to safely switch to driving using the driving assistance function. It is possible to reduce the burden on the driver. In addition, the driver can recognize that an abnormality has occurred in the automatic driving function and promptly perform inspection.

In addition, when the failed function cannot be complemented by the redundant function and the operation control limited to the driving support function is possible, the operation control unit 124 changes the operation control from the automatic driving function to the driving control by the driving support function. Migrate, but not limited to this. The driving control unit 124 may receive a selection of whether to shift from automatic driving to driving assistance or switch from automatic driving to manual driving through the operation unit 3 . The driving control unit 124 shifts from driving control by the automatic driving function to driving control by the driving assistance function in response to receiving a selection to shift from automatic driving to driving assistance. In addition, the operation control unit 124 switches from operation control by the automatic operation function to manual operation in response to receiving a selection to switch from automatic operation to manual operation.

[When a failure that cannot be supplemented by the redundant function occurs and it is necessary to shift to manual operation]
During automatic operation, the failure function related to the automatic operation function cannot be complemented by the redundant function, and if the identification unit 123 identifies that it is necessary to switch from the operation control related to automatic operation to manual operation, the operation control unit 124 Shift from operation control by the automatic operation function to manual operation. In this case, the notification unit 125 provides information indicating that an abnormality has occurred in the failure function, information indicating that automatic operation and driving assistance are impossible, but manual operation is not hindered, and operation by the automatic operation function. The driver is notified of information indicating that control is to be shifted to manual operation. By doing so, the driver can be made to recognize that the automatic operation will shift to the manual operation, and the operation can be safely switched to the manual operation. In addition, the driver can recognize that an abnormality has occurred in the automatic driving function and promptly perform inspection.

[When there is a problem with the running of the vehicle]
When the identification unit 123 identifies that the failure detected by the detection unit 122 during automatic driving will hinder the running of the vehicle V, the operation control unit 124 stops all of the plurality of operation control functions, and the automatic driving function stop the operation control by In this case, the notification unit 125 provides information indicating that an abnormality has occurred in the failure function, information indicating that automatic driving and driving assistance are impossible, and information indicating that the failure will hinder the running of the vehicle V. The driver is notified of the information and information indicating that the vehicle V should be inspected. By doing so, the driver is made to recognize that the traveling of the vehicle V will be hindered and that the automatic operation will be shifted to the manual operation, and the driver is instructed to stop the traveling of the vehicle V or to go to the repair shop. Appropriate measures can be taken, such as directing.

[Flow of processing in operation control device 10]
Next, the flow of processing in the operation control device 10 will be described. FIG. 3 is a flowchart showing an example of the flow of processing in the operation control device 10 when the vehicle V according to the present embodiment is manually operated. The flowchart shown in FIG. 3 starts when the detection unit 122 detects a device failure.

First, the identification unit 123 identifies an operation control function that causes a problem in operation due to a device failure (S1). In addition, the identifying unit 123 identifies whether or not the malfunction detected by the detecting unit 122 will hinder the running of the vehicle V (S2).

Subsequently, the notification unit 125 determines whether or not there is an obstacle to running of the vehicle V (S3). If the notification unit 125 determines that there is no hindrance to the running of the vehicle V, the process proceeds to S4, and if it determines that there is no hindrance to the running of the vehicle V, the process proceeds to S5. It should be noted that the operation control unit 124 may determine whether or not there is an obstacle in running the vehicle V. In the following description as well, the branching determination may be performed by the operation control unit 124 instead of the notification unit 125 .

In S4, the notification unit 125 notifies the driver of information indicating that the vehicle V will be hindered in traveling due to the failure. In addition, the notification unit 125 notifies the driver of information indicating that an abnormality has occurred in the failure function and information indicating that automatic driving and driving assistance are impossible. After completing the process of S4, the notification unit 125 ends the process related to this flowchart.

In S5, the notification unit 125 determines whether or not the operation control function (failed function) that hinders the operation is an operation control function related to the automatic operation function, and whether or not the operation control function can be complemented by a redundant function. If the notification unit 125 determines that the operation control function can be complemented by the redundant function, the process proceeds to S6, and if it determines that the operation control function cannot be complemented by the redundant function, the process proceeds to S8.

In S6, the notification unit 125 notifies the driver of information indicating that the automatic driving function can be executed but that the vehicle V should be inspected. In addition, the notification unit 125 also notifies the driver of information indicating that an abnormality has occurred in the failure function.

In S7, the driving control unit 124 executes the automatic driving function in response to the driver's operation for automatic driving. When the process of S7 ends, the operation control unit 124 ends the process related to this flowchart.

In S8, the notification unit 125 determines whether the faulty function is the operation control function related to the automatic operation function, the operation control function cannot be complemented by the redundancy function, and the operation control is possible by the operation support function. When the notification unit 125 determines that the operation control function cannot be complemented by the redundancy function and that the operation control is possible by the operation support function, the process proceeds to S9. When the notification unit 125 determines that the operation control function cannot be complemented by the redundancy function and that the operation control is not possible by the operation support function, the process proceeds to S11.

In S9, the notification unit 125 notifies the driver of information indicating that the automatic driving function is impossible and that only the driving support function can be executed. In addition, the notification unit 125 notifies the driver of information indicating that an abnormality has occurred in the malfunctioning function and information indicating that an inspection of the vehicle V should be urged.

In S10, when the driver performs an operation for automatic driving, the driving control unit 124 executes the driving support function instead of the automatic driving function. In this case, the notification unit 125 notifies the driver of information indicating that the driving support function will be executed instead of the automatic driving function. When the process of S10 ends, the operation control unit 124 ends the process related to this flowchart.

In S11, the notification unit 125 determines whether the malfunction function is an operation control function related to the automatic operation function, the operation control function cannot be supplemented by a redundant function, and whether it is necessary to shift from the execution of the automatic operation function to the manual operation. determine whether When the notification unit 125 determines that the operation control function cannot be complemented by the redundant function and that the execution of the automatic operation function needs to be shifted to the manual operation, the process proceeds to S12. Moreover, the notification part 125 will complete|finish the process which concerns on this flowchart, if it determines with the said driving|running control function being non-replenishable by a redundancy function, and the transition from execution of an automatic driving|running function to a manual driving|operating function being unnecessary.

In S12, the notification unit 125 notifies the driver of information indicating that automatic driving and driving assistance are impossible. In addition, the notification unit 125 notifies the driver of information indicating that an abnormality has occurred in the malfunctioning function, information indicating that there is no problem in manual operation, and information indicating that the vehicle V should be inspected. do.

FIG. 4 is a flow chart showing an example of the flow of processing in the operation control device 10 when the vehicle V according to this embodiment is traveling by automatic operation. Similar to the flowchart shown in FIG. 3, the flowchart shown in FIG. 4 starts when the detection unit 122 detects a device failure.

First, the identification unit 123 identifies an operation control function that will hinder the operation of the device due to a failure (S21), and determines whether or not the failure detected by the detection unit 122 will hinder the running of the vehicle V. Specify (S22).

Subsequently, the notification unit 125 determines whether or not there is an obstacle to running of the vehicle V (S23). If the notifying unit 125 determines that there is an obstacle to running of the vehicle V, the process proceeds to S24.

In S24, the notification unit 125 notifies the driver of information indicating that the vehicle V will be hindered in traveling due to the failure. In addition, the notification unit 125 notifies the driver of information indicating that an abnormality has occurred in the failure function and information indicating that the operation control by automatic operation will be shifted to manual operation.

In S25, the operation control unit 124 stops all of the plurality of operation control functions, and stops operation control by the automatic operation function. When the process of S25 ends, the operation control unit 124 ends the process related to this flowchart.

In S26, the notification unit 125 determines whether the malfunctioning function is an operation control function related to the automatic operation function, and whether or not the operation control function can be complemented by a redundant function. If the notification unit 125 determines that the operation control function can be supplemented by the redundant function, the process proceeds to S27, and if it determines that the operation control function cannot be supplemented by the redundant function, the process proceeds to S29.

In S27, the notification unit 125 notifies the driver of information indicating that the automatic driving function can be continued but that the vehicle should be inspected. In addition, the notification unit 125 also notifies the driver of information indicating that an abnormality has occurred in the failure function.

In S28, the operation control unit 124 continues to execute the automatic operation function by switching from the failure function to the redundancy function. When the process of S28 ends, the operation control unit 124 ends the process related to this flowchart.

In S29, the notification unit 125 determines whether the faulty function is the operation control function related to the automatic operation function, the operation control function cannot be complemented by the redundant function, and the operation control is possible by the operation support function. When the notification unit 125 determines that the operation control function cannot be supplemented by the redundancy function and that the operation control is possible by the operation support function, the process proceeds to S30. Further, when the notification unit 125 determines that the operation control function cannot be complemented by the redundancy function and that the operation control is not possible by the operation support function, the process proceeds to S32.

In S30, the notification unit 125 notifies the driver of information indicating that the automatic driving function is disabled and that the driving control by the automatic driving function will be shifted to the driving control by the driving support function. In addition, the notification unit 125 notifies the driver of information indicating that an abnormality has occurred in the malfunctioning function and information indicating that an inspection of the vehicle V should be urged.

In S31, the driving control unit 124 shifts from driving control by the automatic driving function to driving control by the driving support function. When the process of S31 ends, the operation control unit 124 ends the process related to this flowchart.

In S32, the notification unit 125 determines whether the malfunction function is an operation control function related to the automatic operation function, the operation control function cannot be supplemented by a redundant function, and whether it is necessary to shift from the execution of the automatic operation function to the manual operation. determine whether When the notification unit 125 determines that the operation control function cannot be complemented by the redundant function and that the execution of the automatic operation function needs to be shifted to the manual operation, the process proceeds to S33. Moreover, the notification part 125 will complete|finish the process which concerns on this flowchart, if it determines with the said driving|running control function being non-replenishable by a redundancy function, and the transition from execution of an automatic driving|running function to a manual driving|operating function being unnecessary.

In S<b>33 , the notification unit 125 notifies the driver of information indicating that the operation control by automatic operation will shift to manual operation. In addition, the notification unit 125 notifies the driver of information indicating that an abnormality has occurred in the malfunctioning function, information indicating that there is no problem in manual operation, and information indicating that the vehicle V should be inspected. do.
In S34, the operation control unit 124 shifts from operation control by the automatic operation function to manual operation.

[Effect of this embodiment]
As described above, the operation control device 10 according to the present embodiment identifies an operation control function whose operation is hindered by a detected failure among a plurality of operation control functions as a failure function, and responds to the failure function. In addition to performing control, the driver is notified of information corresponding to the malfunction function. By doing so, the operation control device 10 can reduce the burden on the driver when the device fails, and can make the driver act according to the degree of the failure.

Although the present invention has been described above using the embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes are possible within the scope of the gist thereof. be. For example, all or part of the device can be functionally or physically distributed and integrated in arbitrary units. For example, the storage unit 11 may store a contact address in case the vehicle V breaks down. Then, in response to the fact that the notification unit 125 detects a failure in at least one of the plurality of devices related to the plurality of operation control functions, the contact information stored in the storage unit 11 is sent to the function that is hindered by the failure. and information indicating whether or not there is an obstacle in driving. Also, some of the functions of the operation control device 10 may not be installed in the vehicle V, but may be provided in an external server that can communicate with the vehicle V. FIG. In addition, new embodiments resulting from arbitrary combinations of multiple embodiments are also included in the embodiments of the present invention. The effect of the new embodiment caused by the combination has the effect of the original embodiment.

10 operation control device 11 storage unit 12 control unit 121 position acquisition unit 122 detection unit 123 identification unit 124 operation control unit 125 notification unit 1 various sensors 2 imaging device 3 operation unit 4 sound output device 5 display device 6 various ECUs
V vehicle

Claims

a detection unit that detects a failure of at least one of a plurality of devices related to a plurality of driving control functions, which are functions related to vehicle driving control;
an identifying unit that identifies, as a malfunctioning function, one of the plurality of operation control functions, the operation of which is hindered by a failure detected by the detection unit;
an operation control unit that performs operation control of the vehicle by executing at least one of the plurality of operation control functions, and performs control corresponding to the malfunction function identified by the identification unit;
a notification unit that notifies a driver of information corresponding to the failure function identified by the identification unit;
An operation control device having
An automatic driving function that performs driving control of the vehicle without the need for driving operation by the driver is realized by the plurality of driving control functions related to automatic driving,
When the identifying unit identifies an operation control function related to the automatic operation function as the failure function, identifies whether the operation control function can be complemented by a redundant function,
The operation control unit performs control based on whether the failure function identified by the identification unit can be complemented by a redundant function,
The notification unit notifies the driver of information based on whether or not the faulty function identified by the identification unit can be complemented by a redundant function.
The operation control device according to claim 1.
When the specifying unit specifies that the failure function related to the automatic driving function can be complemented by the redundant function,
The driving control unit executes the automatic driving function when the automatic driving operation is performed during manual driving in which the operation is performed only by the driver, and continues the automatic driving function when the automatic driving function is executed. and run
The notification unit provides the driver with information indicating that an abnormality has occurred in the failure function and information indicating that the automatic driving function can be executed but that the vehicle should be inspected during manual operation. Information indicating that an abnormality has occurred in the malfunction function when the automatic driving function is executed, information indicating that the automatic driving can be continued but prompts inspection of the vehicle, and the automatic driving function and notifying the driver of information indicating that the
The operation control device according to claim 2.
When the identifying unit identifies that the failure function related to the automatic driving function can be complemented by the redundant function, the notification unit continues to execute the automatic driving function by the redundant function. and information indicating that the automatic driving function cannot be executed if the redundant function fails,
The operation control device according to claim 3.
A plurality of driving control functions related to driving support realize a driving support function that controls driving of the vehicle on condition that the driver performs a driving operation, and the automatic driving function includes the driving support function. , realized by a plurality of the operation control functions related to the automatic operation,
When the identification unit identifies that the driving control function related to the identified automatic driving function cannot be complemented by the redundant function, the identification unit determines whether it is possible to perform driving control by limiting to the driving support function. Further identify whether manual driving is required to drive only by operation,
When the identifying unit identifies that the driving control function related to the identified automatic driving function cannot be complemented by a redundant function, the driving control unit can perform driving control by limiting it to the driving support function. or perform control based on whether it is necessary to perform the manual operation,
When the specifying unit specifies that the driving control function related to the specified automatic driving function cannot be complemented by the redundant function, the notification unit is limited to the driving support function Is it possible to perform driving control? , notifying the driver of information based on whether it is necessary to switch to manual driving;
The operation control device according to any one of claims 2 to 4.
When the specifying unit specifies that the failure function related to the automatic driving function cannot be complemented by the redundant function and that operation control limited to the driving support function is possible,
The driving control unit executes the driving support function when an operation for performing the automatic driving is performed during the manual driving, and when the automatic driving function is executed, from the driving control by the automatic driving function, the driving support function shift to operation control by
The notification unit notifies the driver of information indicating that the automatic driving is impossible and that the driving support function is executable during the manual driving, and the automatic driving function is executed when the automatic driving function is executed. Notifying the driver of information indicating transition from driving control by the driving function to driving control by the driving support function;
The operation control device according to claim 5.
When the specifying unit specifies that the failure function related to the automatic operation function cannot be complemented by the redundant function and that the manual operation needs to be performed,
The driving control unit does not execute the automatic driving function and the driving support function when an operation to perform automatic driving is performed during the manual driving, and when the automatic driving function is executed, from the driving control by the automatic driving function Shifting to the manual operation,
The notification unit notifies the driver of information indicating that the automatic driving and the driving assistance are impossible during the manual driving, and when the automatic driving function is executed, from the driving control by the automatic driving function Notifying the driver of information indicating that the shift to manual operation is to be performed;
The operation control device according to claim 5 or 6.
The specifying unit further specifies whether or not the malfunction detected by the detecting unit interferes with the running of the vehicle,
The driving control unit stops all of the plurality of driving control functions when the identifying unit identifies that the running of the vehicle is hindered,
When the specifying unit specifies that the running of the vehicle will be hindered, the notification unit notifies the driver of information indicating that the failure of the device will hinder the running of the vehicle.
The operation control device according to any one of claims 1 to 7.