JP2019142246A - Vehicle control device - Google Patents

Abstract

To continue automatic operation and call attention of a driver who may rely on automatic operation too much so as not to perform appropriate operation even when there is a fault on a sensor or an actuator during automatic operation.SOLUTION: In an automatic operation mode, the vehicle control device presumes time (TTC) until a vehicle reaches a detected target, and automatically performs braking when the TTC is smaller than a prescribed braking threshold value. Also, the device sets the braking threshold value to be larger when there is a fault on a sensor and an actuator, and furthermore makes a change so as to quicken a timing of alarm to the driver, to increase strength and to lengthen the time, and performs control so as to quicken the timing of braking and to increase the strength.SELECTED DRAWING: Figure 5

Description

  The present invention relates to a vehicle control device for performing, for example, automatic driving and driving assistance of an automobile.

  In automatic driving or driving assistance of a vehicle, a specific direction or all directions of the vehicle are monitored by a sensor, and the automatic driving of the vehicle at an appropriate route and at an appropriate speed is controlled according to the monitoring result. Assist driving. If a sensor such as a camera or a braking / driving / steering drive unit fails during automatic driving with such a configuration, the vehicle or driver needs to deal with it. In Patent Document 1, when a vehicle is equipped with two object detection means and both the first object detection means and the second object detection means perform object detection, the object is detected only by the first object detection means. When detecting, a technique for shifting the driving support control to the suppression side in the order in which object detection is performed only by the second object detecting means is disclosed.

Japanese Patent No. 4193765

  In automatic driving, there may be a delay in control due to a failure of a sensor or a driving unit, and it may be necessary to alert the driver. However, during automatic driving, if the system continues to control, the driver's response to the system alert may be delayed.

  The present invention has been made in view of the above-described conventional example, and provides a vehicle control device that continues automatic driving even if a failure occurs, makes it easier to alert the driver, and reduces the risk of collision. The purpose is to provide.

  In order to achieve the above object, the present invention has the following configuration.

That is, according to one aspect of the present invention, the present invention provides:
Perimeter monitoring means (41, 42, 43) capable of monitoring the perimeter of the own vehicle;
Travel control means (20-29, 315, 317) for performing travel control from the output of the periphery monitoring device;
The travel control means performs at least one of output of an alarm or automatic braking of the own vehicle when an operation condition based on a relative relationship between the target detected by the surrounding monitoring means and the own vehicle is established.
When at least a part of the travel control means, the periphery monitoring device, and the travel control means has failed,
In the vehicle control apparatus, the operation change process (S505) for changing the operation condition or the degree of operation is performed.

Alternatively, according to another aspect of the invention, the invention
Perimeter monitoring means (41, 42, 43) capable of monitoring the perimeter of the own vehicle;
Travel control means (20-29, 315, 317) for performing travel control from the output of the periphery monitoring device;
The travel control means performs at least one of output of an alarm or automatic braking of the own vehicle when an operation condition based on a relative relationship between the target detected by the surrounding monitoring means and the own vehicle is established.
When at least a part of the travel control means, the periphery monitoring device, and the travel control means has failed,
The vehicle control apparatus is characterized in that an alarm change process (S521) for changing to an alarm different from an alarm when no failure has occurred is performed.

  According to the present invention, it is possible to provide a vehicle control device that can continue automatic driving even when a failure occurs and can reliably alert the driver.

  Other features and advantages of the present invention will become apparent from the following description with reference to the accompanying drawings. In the accompanying drawings, the same or similar components are denoted by the same reference numerals.

The accompanying drawings are included in the specification, constitute a part thereof, show an embodiment of the present invention, and are used to explain the principle of the present invention together with the description.
FIG. 1 is a diagram illustrating a configuration of a vehicle system for an autonomous driving vehicle according to an embodiment. FIG. 2 is a diagram illustrating an example of a detection range by the autonomous driving vehicle according to the embodiment. FIG. 3 is a block diagram for automatic operation control. FIG. 4 is a flowchart showing a part of a self-diagnosis and local map creation processing procedure by the operation control unit. FIG. 5 is a flowchart illustrating a part of an action candidate determination processing procedure by the operation control unit in one embodiment.

<First embodiment>
● Outline of automatic driving and driving support Next, an outline of an example of automatic driving will be described. In automatic driving, a driver sets a destination from a navigation system mounted on a vehicle before traveling, and determines a route to the destination using a server or a navigation system. When the vehicle is started, a vehicle control device (or an operation control device) constituted by an ECU or the like of the vehicle drives the vehicle to the destination along the route. In the meantime, determine appropriate actions in a timely manner according to the external environment such as the route and road conditions, the driver's condition, etc., and drive the vehicle by performing drive control, steering control, braking control, etc. for that action, for example. . These controls may be collectively referred to as travel control.

  In automatic driving, there are several levels (or modes) depending on the automation rate (or the amount of tasks required of the driver). For example, at the highest level, the driver may focus on things other than driving. This is performed when the control is relatively easy, for example, when following a preceding vehicle due to a traffic jam on a highway. At the lower level, the driver may not have a handle, but he needs to pay attention to the surroundings. This level may be applied, for example, when traveling while maintaining a lane on a highway. This level is sometimes called the second mode in this example. Note that the driver's attention to the surroundings can be detected by a driver state detection camera, and that the driver has a handle can be detected by a handle grip sensor. Furthermore, at the lower level, the driver does not have to perform the steering operation or the throttle operation, but needs to pay attention to driving by holding the steering wheel in preparation for the takeover to the driver. This level may be applied to forks and junctions on highways, for example. This level is sometimes called the first mode in this example. Furthermore, at that lower level, the automation rate is lower. The lowest level is manual driving, but may include partially automated driving assistance.

  The above-described driving support is a function that supports driving operation by a driver who is a driving subject by monitoring the surroundings or partially automating the driving operation. For example, there are an automatic braking function that performs braking control when an obstacle is detected by monitoring only the front side, a rear monitoring function that detects a vehicle obliquely behind and alerts the driver, and a parking function in a parking space.

  Even during automatic driving, there may be intervention by the driver. For example, when the driver performs steering or braking operation during automatic driving, the automatic driving level may be lowered to the driving support level, and the driving operation by the driver may be prioritized. In that case, after the driver stops the operation, the automatic driving level may be reset according to the own vehicle state and the external environment to continue the automatic driving. For example, as an example of the steering operation in the present embodiment, there is a winker lever operation while traveling on a highway with automatic driving at an automation rate equal to or higher than the first mode described above. For example, when the driver performs a blinker operation in such a state, the vehicle changes the lane to the lane on the side instructed to have been instructed to change the lane. In this case, control such as steering, braking, and driving is performed by a travel control unit configured by an ECU or the like while monitoring obstacles and the like around the vehicle.

  When the automatic driving level (or mode) is switched, this is notified from the vehicle to the driver by voice, display, vibration, or the like. For example, when the automatic driving is switched from the first mode to the second mode, the driver is notified that the handle may be released. In the opposite case, the driver is notified to grip the handle. This notification is repeated until it is detected by the handle grip sensor that the driver grips the handle. For example, if the handle is not gripped within the time limit or until the mode switching limit point, an operation such as stopping at a safe place may be performed. Automatic operation is generally performed as described above, and the configuration and control for that purpose will be described below.

FIG. 1 is a block diagram of a vehicle control device according to an embodiment of the present invention, which controls the vehicle 1. In FIG. 1, the outline of a vehicle 1 is shown in a plan view and a side view. The vehicle 1 is a sedan type four-wheeled passenger car as an example.

  The control device of FIG. 1 includes a control unit 2. The control unit 2 includes a plurality of ECUs 20 to 29 that are communicably connected via an in-vehicle network. Each ECU includes a processor represented by a CPU, a storage device such as a semiconductor memory, an interface with an external device, and the like. The storage device stores a program executed by the processor, data used by the processor for processing, and the like. Each ECU may include a plurality of processors, storage devices, interfaces, and the like.

  Hereinafter, functions and the like which the ECUs 20 to 29 are in charge of will be described. Note that the number of ECUs and the functions in charge can be appropriately designed for the vehicle 1, and can be further subdivided or integrated as compared with the present embodiment.

  The ECU 20 executes control related to automatic driving of the vehicle 1. In automatic operation, at least one of steering and acceleration / deceleration of the vehicle 1 is automatically controlled. In a control example to be described later, both steering and acceleration / deceleration are automatically controlled.

  The ECU 21 controls the electric power steering device 3. The electric power steering device 3 includes a mechanism that steers the front wheels in accordance with the driving operation (steering operation) of the driver with respect to the steering wheel 31. In addition, the electric power steering device 3 includes a motor that assists the steering operation or that exhibits a driving force for automatically steering the front wheels, a sensor that detects a steering angle, and the like. When the driving state of the vehicle 1 is automatic driving, the ECU 21 automatically controls the electric power steering device 3 in response to an instruction from the ECU 20 to control the traveling direction of the vehicle 1.

  The ECUs 22 and 23 control the detection units 41 to 43 that detect the surrounding situation of the vehicle and perform information processing on detection results. The detection unit 41 is a camera that captures the front of the vehicle 1 (hereinafter may be referred to as the camera 41). In the present embodiment, two detection units 41 are provided in the vehicle 1 room. By analyzing the image captured by the camera 41, it is possible to extract the outline of the target and the lane markings (white lines, etc.) on the road. The detection unit 41a is a camera for detecting the state of the driver (hereinafter sometimes referred to as the driver state detection camera 41a), and is installed so as to capture the driver's facial expression. Are connected to an ECU that processes the image data. As a sensor for detecting the driver state, there is a handle grip sensor (not shown). This makes it possible to detect whether or not the driver is holding the handle.

  The detection unit 42 is a lidar (Light Detection and Ranging or Laser Imaging Detection and Ranging (hereinafter sometimes referred to as a lidar 42), and detects a target around the vehicle 1 or a distance from the target. In the present embodiment, five riders 42 are provided, one at each corner of the front of the vehicle 1, one at the center of the rear, and one at each side of the rear. The detection unit 43 is a millimeter wave radar (hereinafter may be referred to as a radar 43), detects a target around the vehicle 1, and measures a distance from the target. In the case of the embodiment, five radars 43 are provided, one at the front center of the vehicle 1, one at each front corner, and one at each rear corner.

  The ECU 22 performs control of one camera 41 and each rider 42 and information processing of detection results. The ECU 23 performs control of the other camera 41 and each radar 43 and information processing of detection results. By providing two sets of devices that detect the surroundings of the vehicle, the reliability of the detection results can be improved, and by providing different types of detection units such as cameras, lidars, and radars, analysis of the surrounding environment of the vehicle Can be performed in many ways.

  The ECU 24 controls the gyro sensor 5, the GPS sensor 24b, and the communication device 24c and performs information processing on detection results or communication results. The gyro sensor 5 detects the rotational movement of the vehicle 1. The course of the vehicle 1 can be determined based on the detection result of the gyro sensor 5, the wheel speed, and the like. The GPS sensor 24 b detects the current position of the vehicle 1. The communication device 24c performs wireless communication with a server that provides map information and traffic information, and acquires these information. The ECU 24 can access the map information database 24a constructed in the storage device, and the ECU 24 searches for a route from the current location to the destination.

  The ECU 25 includes a communication device 25a for inter-vehicle communication. The communication device 25a performs wireless communication with other vehicles in the vicinity and exchanges information between the vehicles.

  The ECU 26 controls the power plant 6. The power plant 6 is a mechanism that outputs a driving force for rotating the driving wheels of the vehicle 1 and includes, for example, an engine and a transmission. For example, the ECU 26 controls the output of the engine in response to the driver's driving operation (accelerator operation or acceleration operation) detected by the operation detection sensor 7a provided on the accelerator pedal 7A, the vehicle speed detected by the vehicle speed sensor 7c, or the like. The gear position of the transmission is switched based on the information. When the driving state of the vehicle 1 is automatic driving, the ECU 26 automatically controls the power plant 6 in response to an instruction from the ECU 20 to control acceleration / deceleration of the vehicle 1.

  The ECU 27 controls a lighting device (headlight, taillight, etc.) including the direction indicator 8. In the case of the example in FIG. 1, the direction indicator 8 is provided at the front part, the door mirror, and the rear part of the vehicle 1.

  The ECU 28 controls the input / output device 9. The input / output device 9 outputs information to the driver and receives input of information from the driver. The voice output device 91 notifies the driver of information by voice. The display device 92 notifies the driver of information by displaying an image. The display device 92 is disposed on the driver's seat surface, for example, and constitutes an instrument panel or the like. In addition, although an audio | voice and a display were illustrated here, you may alert | report information by a vibration or light. In addition, information may be notified by combining a plurality of voice, display, vibration, or light. Furthermore, the combination may be varied or the notification mode may be varied depending on the level of information to be notified (for example, the degree of urgency). The input device 93 is a switch group that is arranged at a position where the driver can operate and gives an instruction to the vehicle 1, but a voice input device may also be included.

  The ECU 29 controls the brake device 10 and a parking brake (not shown). The brake device 10 is, for example, a disc brake device, and is provided on each wheel of the vehicle 1. The vehicle 1 is decelerated or stopped by applying resistance to the rotation of the wheel. For example, the ECU 29 controls the operation of the brake device 10 in response to a driver's driving operation (brake operation) detected by an operation detection sensor 7b provided on the brake pedal 7B. When the driving state of the vehicle 1 is automatic driving, the ECU 29 automatically controls the brake device 10 in response to an instruction from the ECU 20 to control deceleration and stop of the vehicle 1. The brake device 10 and the parking brake can be operated to maintain the vehicle 1 in a stopped state. Moreover, when the transmission of the power plant 6 includes a parking lock mechanism, this can be operated to maintain the vehicle 1 in a stopped state.

  Further, each ECU other than the ECU 20 may detect the state and notify the ECU 20, for example, when there is a failure in a sensor or drive unit that is the control target, and in that case, the ECU 20 will describe the received state later. Save as sensor status or drive status. The state of failure during operation may be determined by, for example, a deviation from a normal signal level or delay time for a signal from a drive unit (actuator) such as a motor or a solenoid or a sensor.

Perimeter Monitoring Device The camera 41, lidar 42, and radar 43 shown in FIG. 1 constitute a perimeter monitoring device that detects a target around the vehicle. FIG. 2 shows an example of a range detected by the periphery monitoring device. In FIG. 2, areas 204, 206, and 207 indicated by halftone dots indicate detection ranges by the radar 43. In particular, the region 204 is a front region of the vehicle 1 and the regions 206 and 207 are rear regions. The corresponding radar 43 detects an object such as an obstacle or a vehicle in each area and measures the distance. The radar 43 can detect, for example, a vehicle or an obstacle traveling forward and backward. Regions 201, 202, 205, etc. enclosed by dotted lines indicate detection ranges by the lidar 42. In particular, the areas 201 and 202 are the front area of the vehicle 1, and the area 205 is the area behind the vehicle 1. The corresponding lidar 42 detects a target such as an obstacle or a vehicle in each area, and measures the distance. The rider 42 can detect, for example, a vehicle traveling right rearward or a vehicle passing the right lane. A region 203 indicated by oblique lines indicates a detection range by the camera 41. In this example, two cameras 41 are provided, but only one is shown in order to set a substantially overlapping area as a detection range. The image captured by the camera 41 is recognized, and for example, a white line indicating a travel lane is identified from the image and is referred to for lane maintenance or lane change.

  Thus, since the detection ranges by different sensors overlap, sensor redundancy is realized. This further increases the reliability, and by comparing the detection results of different sensors with the same region as the detection range, it is possible to specify the possibility of sensor failure or failure. For example, it is assumed that there is a target that is detected by one sensor and not detected by the other sensor while the same region is detected by two types of sensors, the lidar 42 and the radar 43. In this case, it can be estimated that either one has failed. Alternatively, a sensor output signal or the like can be monitored by a self-diagnosis circuit (not shown), and the failure of the sensor itself can be known therefrom. In this way, it is possible to estimate the failure of the sensor, that is, the periphery monitoring device.

● Local map A local map is map information composed of information indicating targets and lanes such as vehicles and obstacles in a certain range centered on the own vehicle. The local map may be in a format suitable for information processing, and includes, for example, information indicating the position and range of a target, distance, information indicating road and lane boundaries, and the like. The local map shows the targets around the vehicle detected by each sensor shown in FIG. 2 within a certain range centered on the vehicle, and is updated periodically, for example, according to the travel of the vehicle. The update interval may be a period that allows safe control even when the relative speed between the host vehicle and the oncoming vehicle is taken into account, for example. By continuing to update this local map 307, it is possible to refer to obstacles and road conditions around the host vehicle in real time. Further, when traveling forward or backward, the time (TTC) required for the host vehicle to reach the target can be calculated based on the relative speed of the host vehicle with respect to the target on the course, for example. it can. When a plurality of targets are detected, the minimum value of the TTC for each is selected. When the TTC falls below a predetermined threshold value (hereinafter referred to as a braking threshold value), if the vehicle is in automatic driving or driving assistance, the driving control device automatically applies braking to the vehicle and there is no driving assistance. Warn the driver during manual operation. That is, it is determined that an operation condition such as automatic braking is established based on the relative relationship between the target and the host vehicle. Note that the above-described braking threshold is, for example, the time required to decelerate from the current relative speed of the host vehicle to the target until the relative speed becomes zero or the host vehicle speed becomes zero, whichever is earlier. Further, it may be a time obtained by adding the delay of the vehicle system and the margin. Of course, this is only an example. This is the same whether forward or backward. In addition, when the relative speed with respect to this target is larger than the own vehicle speed, it may be accompanied by steering or the like, but in this embodiment, it is not considered so much.

[Operation Control Device] FIG. 3 shows a functional block diagram of an operation control device for automatic driving or driving support. This operation control device is realized, for example, when the ECU 20 shown in FIG. 1 executes the procedure shown in FIG. Of course, the procedure shown in FIG. 4 and below is only a part of the functions related to the automatic driving and driving support realized by the driving control device according to the present embodiment. For example, when the driver instructs the destination and automatic driving, the ECU 20 automatically controls the traveling of the vehicle 1 toward the destination according to the guidance route searched by the ECU 24. During the automatic control, the ECU 20 acquires information on the surroundings of the vehicle 1 from the ECUs 22 and 23, etc., and instructs the ECU 21, ECUs 26 and 29, etc. based on the acquired information to control the steering and acceleration / deceleration of the vehicle 1. FIG. 3 shows this procedure as a functional block.

  The external environment recognition unit 301 indicates, for example, relative speed, position and shape, and images of surrounding targets from the external environment information indicating the surrounding conditions acquired by the surrounding monitoring device such as the camera 41, the lidar 42, and the radar 43. Information 303 is generated. Based on the information 303, the self-position recognition unit 305 determines the position of the own vehicle on the road, the shape of the vehicle traveling around the vehicle, the arrangement around the own vehicle, and the shape and arrangement of the surrounding structures. A local map 307 is generated. In addition, in order to create the local map 307, in addition to the information 303, information acquired from other than the periphery monitoring device such as map information may be referred to. In this example, in addition to the local map 307, the state of the host vehicle such as information indicating the sensitivity (detection distance and detection range) of the sensor is also passed to the action candidate determination unit 309 along with the local map.

  The action candidate determination unit 309 determines a future action candidate using the local map 307 as an input. The action candidate is information indicating an action that is a candidate for determining the action of the host vehicle. The behavior of the host vehicle is determined with reference to not only the local map 307 but also the state of the host vehicle in addition to the route information to the destination. The state of the host vehicle includes, for example, the possibility that a sensor such as the camera 41, the lidar 42, and the sensor 43 included in the periphery monitoring device, and an actuator such as the brake device 10 may fail. For example, when a target in the advancing direction (front or rear) is detected, the time (TTC) required for the host vehicle to reach the target is estimated, and TTC is set to a predetermined threshold (the braking threshold described above). If it is less than), braking with a warning to the driver is determined as an action candidate. Here, when each TTC is obtained for a plurality of targets, the minimum value among them is compared with the braking threshold. That is, it can be said that the operating condition for operating braking is that TTC is below a predetermined threshold. For example, the action candidate may be information including information indicating the action and information indicating the degree of the action. When the determined action is braking, for example, information indicating that the action is braking, Information indicating a start timing, a braking intensity, and the like may be included. When one of the determined action candidates is braking, another action candidate may be prepared, or only braking may be used as a candidate in order to shorten the time required for the subsequent steps. In addition, the behavior candidate determination unit 309 may determine a behavior candidate with reference to the states of sensors, actuators, and the like stored in a state information storage unit 321 described later. This will be described later with reference to FIG. Of course, this is only an example, and other actions involving steering and drive control can be determined as candidates.

  The route selection unit 311 selects one behavior from the behavior candidates determined by the behavior candidate determination unit 309. This is an action to be executed, and therefore steering, driving, and braking are controlled by the vehicle control device. When there is one action candidate, there is no room for selection, so only one action candidate is selected. Which candidate is selected from among a plurality of candidates can be determined based on various criteria. For example, when the action candidate includes braking, the braking may be selected with priority. Each action candidate may be evaluated and the action candidate having the highest evaluation may be selected. In any case, these are examples of selection criteria, and other criteria may be applied. Further, the route selection unit 311 generates route information and speed information 313 according to the selected action. The route information and speed information 313 are input to the travel control unit 315. Alternatively, when the selected action is braking, information indicating the degree of brake operation, such as braking timing and strength, may be generated. Further, the route selection unit 311 may select an action with reference to states of sensors, actuators, and the like stored in a state information storage unit 321 described later.

  The travel control unit 315 controls an operation unit (actuator) such as steering, driving, and braking based on the input route information and speed information 313. Furthermore, the steering, driving, and braking are controlled promptly based on the situation such as an obstacle around the host vehicle detected by the periphery monitoring device. Although the self-position recognition unit 305, the action candidate determination unit 309, and the route selection unit 311 can be realized by the ECU 20, the travel control unit 315 is further realized by performing travel control by the ECUs 21, 26, 29, and the like. Of course, if necessary, processing by another ECU may be included. The travel control unit 315 may convert the route and speed into the control amount of the actuator using, for example, a conversion map that associates the input route and speed with the control amount of each actuator 317. Then, traveling control is performed using the converted control amount.

  In the present embodiment, the vehicle control device further includes a self-diagnosis unit 319 and a state storage unit 321. The state storage unit 321 includes a sensor state storage unit 3211 and an operation unit state storage unit 3212. The self-diagnosis unit 319 is performed, for example, as part of the initial processing when the vehicle power supply is turned on, or in a state where the processing load is light, such as when the automatic driving automation level is low and the vehicle is running at a low speed. The target may be, for example, sensors such as the camera 41, the rider 42, and the radar 43, an actuator such as the brake device 10 (for example, a motor that operates the brake), and a control circuit thereof. In the case of the brake device 10, the actuator can be an operation unit such as a motor of a drive pump. Of course, portions other than those described here may be targeted. Information for self-diagnosis may be acquired from the external environment recognition unit 301 and the travel control unit 315. For example, the diagnosis is performed by collecting the state determined by the external recognition unit 301 or the travel control unit 315 based on the signal received from the sensor device or the actuator, or by transmitting a predetermined pilot signal to the sensor or the actuator and returning the response. The state may be determined based on the received response signal. The self-diagnosis unit 319 that has acquired the states of the sensors and the drive units (actuators) and their control circuits stores the respective states in the sensor state storage unit 3211 and the operation unit state storage unit 3212. The state of the control circuit may be stored in a state storage unit corresponding to the control target.

  Furthermore, even if the self-position recognizing unit 305 has a sensor that can detect a target and a sensor that cannot detect a target in an area where the detection areas of a plurality of sensors overlap, even if the self-diagnosis is not being performed, It can be determined that there is a risk of sensor failure. In that case, the self-position recognizing unit 305 may store the sensor that may be in failure and its state in the sensor state storage unit 3211. The traveling control unit 315 may also store the state detected when the actuator is controlled in the operating unit state storage unit 3212.

Saving of Sensor and Actuator State FIG. 4A shows an example of a processing procedure by the self-diagnosis unit 319. This procedure is executed by the ECU 20, for example, in hardware. First, self-diagnosis results are collected from the external environment recognition unit 301 and the travel control unit 315, specifically, from the ECUs constituting them (S401). The self-diagnosis result includes a result of diagnosing based on a response by transmitting a diagnostic signal targeting a sensor or an actuator. The collected diagnostic results are stored in the state storage unit 321 (S403). The sensor state is stored in the sensor state storage unit 3211, and the operation unit state is stored in the operation unit state storage unit 3212. Then, it is determined whether the stored state, that is, the diagnosis result includes a warning output (S405). If it is included, the warning is output at this stage by display, sound, vibration, etc. (S407). In the case of the manual operation mode, the display may simply be performed to indicate that there is a possibility of failure. In this way, the state of the sensor, actuator, etc. is acquired and stored by self-diagnosis.

  FIG. 4B shows a procedure of local map creation processing by the self-position recognition unit 305. First, a local map based on the own vehicle is created based on the self-position, the vehicle shape and arrangement of surrounding vehicles, the shape and arrangement of surrounding structures (S411). At this time, it is determined whether there are sensors that do not detect the same target in the overlapping detection ranges (S412), and if there is a sensor state storage unit, there is a possibility of failure as the state of those sensors. It is stored in 3211 (S415). If not, the sensor state storage unit 3211 stores the normal state with no failure as the state of those sensors (S413). If there are sensors that do not detect the same target among sensors with overlapping detection ranges, it is desirable to create a local map as if the target was detected. In this way, even a sensor that is operating can specify and store its state. Although not shown, similarly, the state determined by the travel control unit 315 during operation can be stored in the operation unit storage means 3212 from an actuator (operation unit) such as the brake device 10.

  FIG. 5 shows a part of each process executed by the action candidate determination unit 309 and the route selection unit 311. As described above, since these are realized by the ECU 20, the procedure of FIG. 5 is also a process executed by the ECU 20. The action candidate determination unit 309 acquires the state information stored in the local map 307 and the state storage unit 321 (S501). Next, based on the acquired state information, it is determined whether or not there is a possibility that the sensor or the operating unit has failed (S503). If it is determined that the referenced state information indicates failure or possibility of failure, the braking threshold value is changed from the standard value to a larger threshold value (S505). The standard value is a threshold value in a normal state. The degree to which the braking threshold value is increased in step S505 may be, for example, a predetermined fixed value, or may be changed according to the degree of failure. For example, in the case of a sensor, the degree of failure is the number of sensors that may be lost. In the case of an actuator, the response time may be delayed. If step S505 is skipped, the process branches to step S507. In this case, a standard threshold is set.

  Next, among the targets in the advancing direction (forward or backward) calculated from the local map, the target (TTC) required for the host vehicle to reach the target is smaller than the set braking threshold. It is determined whether there is any (S507). If there is, it is determined whether the current operation mode is automatic operation or manual operation (S509). If it is determined that the operation is manual operation, it is further determined whether or not there is a possibility that the sensor or the operating unit has failed (S511). This determination is performed based on the same criteria as in step S503. Here, for example, the target sensor is a sensor that detects the traveling direction, and the target actuator is related to braking, for example, the brake device 10. If there is a possibility of failure, a failure display is performed for the corresponding sensor or operating unit (S513). On the other hand, if there is no possibility of failure, the process ends as it is. At this time, immediately before step S511, an alarm (or warning) that there is a target reaching within the time of the braking threshold described above may be output. In the case of the manual operation mode, it is not necessary to perform the travel control according to the action plan, so the process may be terminated here.

  On the other hand, when it determines with automatic driving | operation in step S509, about the target determined to exist in step S507, the action of stopping before reaching there is determined as an action candidate (S515). The action determined here includes applying a brake (may further include the timing and intensity of braking) and an output of a warning (alarm). The warning at this time is a normal one, and is a warning when the vehicle sensor or the operation unit is operating normally. Next, it is determined whether or not there is a possibility that the sensor or the operating unit has failed (S519). This determination is performed based on the same criteria as in step S511. If there is a possibility of failure, the warning level determined in step S515 is reset to a stronger one (S521). Thereafter, the process proceeds to processing for route selection. On the other hand, if it is determined in step S507 that there is no corresponding target, an action corresponding to the situation at that time is determined as a candidate for action (S517). If a plurality of actions can be taken, a plurality of actions are determined as candidates. Thereafter, the process branches to step S519.

  Note that in step S521, the degree of the alarm may be strengthened by, for example, increasing the intensity of the alarm output as an alarm, increasing the timing, or increasing the timing. To increase the sound level, for example, the sound volume may be increased by increasing the volume or increasing the pitch. In the case of a display alarm, for example, the brightness may be increased, blinked, or displayed with a conspicuous color or design. For a vibration alarm, for example, the amplitude may be increased or the vibration cycle may be decreased. To advance the timing is literally to advance the timing of the alarm output. To make it longer is to increase the duration of the alarm. Also, the degree to which the alarm is strengthened may depend on the degree of failure or the possibility of failure. For example, when a plurality of sensors are made redundant, the alarm may be strengthened according to the number of sensors that are lost or possibly. In this case, the greater the number of sensors that can fail, the stronger, faster or longer the alarm. For example, the alarm may be increased by 1 second for each sensor that has failed. Some of them may be combined. Alternatively, the alarm may be strengthened according to the degree of failure or the degree of possibility. For example, as the delay with respect to the input signal or the degree of unclearness of the captured image by the camera 41 increases, the intensity of the alarm may be increased, the timing may be advanced, and the duration may be increased. Further, if the actuator has failed, for example, an alarm having a higher intensity than that when the sensor has failed may be output. further. The alarm intensity may be changed according to the type of the actuator that has failed. For example, if it is determined that there is a possibility of failure in the brake device 10, an alarm having a higher strength than that of other actuators may be output. If the degree of actuator failure can be detected, an alarm having a strength corresponding to the degree may be output.

  Further, in step S521, not only the alarm but also the contents of the operation may be changed according to the degree or number of failures. For example, if there is a possibility that the brake device 10 has failed, the braking start timing may be advanced or the braking force may be increased. Although the case where the action to be performed is mainly braking has been described above as an example, the same may be applied to the case where the action is turning, changing lanes, turning left or right, and the like. That is, if there is a possibility that a sensor or actuator related to the action to be performed has failed, the alarm may be an alarm different from the normal alarm. Alternatively, the contents of the operation of the actuator that realizes the action may be different between normal and failure times.

  As described above, an action that is a candidate for the next action can be determined. After this, one action is decided from the candidates. For this purpose, the route selection unit 311 first determines whether there are a plurality of action candidates. If there is one, the candidate is selected as the next action, and the route / speed information of the action is determined. On the other hand, when there are a plurality of candidates, one of them is selected. Therefore, the candidate behavior information of each behavior candidate is evaluated. Then, the candidate action with the highest evaluation is selected as the next action, and the route / speed information of the action is determined. The route information and speed information created in this way are input to the travel control device (or travel control unit), and each action unit is controlled by the route and speed to realize the selected action. When the travel control device is composed of a plurality of ECUs, each ECU controls each actuator to be controlled according to the determined route and speed. When the action is braking, the brake device 10 is operated according to the setting to perform braking control. When the selected action is an alarm output, the alarm is output by voice, display, vibration, or the like.

  In this way, the behavior during traveling is determined and realized. When braking control is performed by automatic driving, the state of the sensor and the operating unit is monitored, and if there is a possibility of failure, the braking threshold value, which is an example of the operating condition, is changed so that braking can be applied more easily. Is done. Further, the alarm output to the driver is changed to a different alarm when there is a possibility of failure. Furthermore, the content of the operation of the actuator is changed to a content different from normal when there is a possibility of failure. As a result, warnings and warnings are made different between a failure time and a normal time to prevent the driver from hearing the warnings and warnings. Furthermore, by making the operation timing and content different between the time of failure and the normal time, safer automatic operation can be realized.

  In this embodiment, braking is performed based on the local map. However, for example, the above-described embodiment is similarly applied to a system in which TTC for a detected target is managed separately from the local map and braking is performed under the condition that TTC is smaller than a predetermined threshold. it can. Such a system is what is called driving assistance rather than automatic driving. That is, the invention according to the present embodiment can be applied not only to automatic driving but also to a driving support system.

● Summary of Embodiments The above-described embodiment can be summarized as follows.
(1) The first aspect of the present embodiment is a periphery monitoring means (41, 42, 43) capable of monitoring the periphery of the host vehicle;
Travel control means (20-29, 315, 317) for performing travel control from the output of the periphery monitoring device;
The travel control means performs at least one of output of an alarm or automatic braking of the own vehicle when an operation condition based on a relative relationship between the target detected by the surrounding monitoring means and the own vehicle is established.
When at least a part of the travel control means, the periphery monitoring device, and the travel control means has failed,
In the vehicle control apparatus, the operation change process (S505) for changing the operation condition or the degree of operation is performed.
With this configuration, in the event of a failure, it is possible to perform control that appropriately changes the operating condition or the operating site in consideration of safety.

(2) The second aspect of the present embodiment is a periphery monitoring means (41, 42, 43) capable of monitoring the periphery of the host vehicle;
Travel control means (20-29, 315, 317) for performing travel control from the output of the periphery monitoring device;
The travel control means performs at least one of output of an alarm or automatic braking of the own vehicle when an operation condition based on a relative relationship between the target detected by the surrounding monitoring means and the own vehicle is established.
When at least a part of the travel control means, the periphery monitoring device, and the travel control means has failed,
The vehicle control apparatus is characterized in that an alarm change process (S521) for changing to an alarm different from an alarm when no failure has occurred is performed.
With this configuration, with this configuration, it is possible to perform control for appropriately changing the alarm in consideration of safety in the event of a failure.

(3) A third aspect of the present embodiment is the vehicle control device according to (1) or (2),
The periphery monitoring means has a plurality of sensors (41, 42, 43),
At least one of the operation change process or the alarm change process determines the operation condition or the content of the alarm change based on the degree of failure of the plurality of sensors or the number of the plurality of sensors lost. The vehicle control apparatus is characterized by the above.
With this configuration, the alarm can be changed according to the degree of sensor failure or the like.

(4) A fourth aspect of the present embodiment is the vehicle control device according to (1) or (2),
The travel control unit includes a determination unit (309) and an operation unit (317) based on a result of the determination unit.
In the vehicle control device, the travel control means determines the operating condition or the degree of change in the operation based on the degree of failure of the operating means.
With this configuration, it is possible to appropriately notify the driver of the state by changing the operating condition or the degree of change of the operation in accordance with the degree of failure of the operating means.

(5) A fifth aspect of the present embodiment is the vehicle control device according to (1),
The travel control means is capable of automatic braking of the host vehicle in a driving support state,
In the driving support state, when the periphery monitoring device or the travel control unit fails, the operation change process and an output of a warning that there is a failure are performed, and the driving support state is not In the vehicle control apparatus, a warning that there is a failure is output.
With this configuration, it is possible to operate even in the case of failure only in the case of automatic driving.

(6) A sixth aspect of the present embodiment is the vehicle control device according to (2),
The travel control means is capable of automatic braking of the host vehicle in a driving support state,
In the driving support state, when the periphery monitoring device or the travel control unit fails, the alarm change process and the output of an alarm indicating that there is a failure are performed and the state is not the driving support state In the vehicle control apparatus, a warning that there is a failure is output.
With this configuration, it is possible to operate even in the case of failure only in the case of automatic driving.

(7) A seventh aspect of the present embodiment is the vehicle control device according to (1) or (5),
The periphery monitoring means monitors at least a target in the traveling direction of the host vehicle,
The travel control means, as the operating condition, that the target may reach the target within a predetermined time,
When a part of the periphery monitoring device or the traveling control means has failed,
In the vehicle control device, the predetermined time is set to a longer time by the operation change process.
With this configuration, when there is a possibility of a failure, a warning suitable for the situation can be issued to the driver by setting the threshold for determining the possibility of the target to be longer.

(8) An eighth aspect of the present embodiment is the vehicle control device according to (1) or (5),
The vehicle control device according to claim 2 or 6,
The periphery monitoring means monitors at least a target in the traveling direction of the host vehicle,
The travel control means, as the operating condition, that the target may reach the target within a predetermined time,
When a part of the periphery monitoring device or the traveling control means has failed,
The vehicle control apparatus characterized by advancing the alarm timing, increasing the intensity of the alarm, or extending the alarm time by the alarm change process.
With this configuration, when there is a possibility of failure, the warning can be given to the driver more appropriately according to the situation by making the timing of the warning earlier and stronger.

(9) A ninth aspect of the present embodiment is the vehicle control device according to (7), wherein the automatic change timing is further advanced or the strength of the automatic brake is increased by the operation change process. The vehicle control device is characterized.
With this configuration, it is possible to realize safer control by advancing the automatic braking timing as well as the alarm.

301 external world recognition unit, 305 self-position recognition unit, 307 local map, 309 action candidate determination unit, 311 route selection unit, 315 travel control unit, 317 actuator, 319 self-diagnosis unit, 321 state storage unit

Claims (9)

Perimeter monitoring means (41, 42, 43) capable of monitoring the perimeter of the own vehicle;
Travel control means (20-29, 315, 317) for performing travel control from the output of the periphery monitoring device;
The travel control means performs at least one of output of an alarm or automatic braking of the own vehicle when an operation condition based on a relative relationship between the target detected by the surrounding monitoring means and the own vehicle is established.
When at least a part of the travel control means, the periphery monitoring device, and the travel control means has failed,
A vehicle control device that performs an operation change process (S505) for changing the operation condition or the degree of operation. Perimeter monitoring means (41, 42, 43) capable of monitoring the perimeter of the own vehicle;
Travel control means (20-29, 315, 317) for performing travel control from the output of the periphery monitoring device;
The travel control means performs at least one of output of an alarm or automatic braking of the own vehicle when an operation condition based on a relative relationship between the target detected by the surrounding monitoring means and the own vehicle is established.
When at least a part of the travel control means, the periphery monitoring device, and the travel control means has failed,
A vehicle control device that performs an alarm change process (S521) for changing to an alarm different from an alarm when there is no failure. The vehicle control device according to claim 1 or 2,
The periphery monitoring means has a plurality of sensors (41, 42, 43),
At least one of the operation change process or the alarm change process determines the operation condition or the content of the alarm change based on the degree of failure of the plurality of sensors or the number of the plurality of sensors lost. A vehicle control device. The vehicle control device according to claim 1 or 2,
The travel control unit includes a determination unit (309) and an operation unit (317) based on a result of the determination unit.
The vehicle control apparatus, wherein the travel control means determines the operating condition or the degree of change of the operation based on a degree of failure of the operating means. The vehicle control device according to claim 1,
The travel control means is capable of automatic braking of the host vehicle in a driving support state,
In the driving support state, when the periphery monitoring device or the travel control unit fails, the operation change process and an output of a warning that there is a failure are performed, and the driving support state is not Outputs a warning that there is a failure. The vehicle control device according to claim 2,
The travel control means is capable of automatic braking of the host vehicle in a driving support state,
In the driving support state, when the periphery monitoring device or the travel control unit fails, the alarm change process and the output of an alarm indicating that there is a failure are performed and the state is not the driving support state Outputs a warning that there is a failure. The vehicle control device according to claim 1 or 5,
The periphery monitoring means monitors at least a target in the traveling direction of the host vehicle,
The travel control means, as the operating condition, that the target may reach the target within a predetermined time,
When a part of the periphery monitoring device or the traveling control means has failed,
The vehicle control device characterized in that the predetermined time is set to a longer time by the operation change process. The vehicle control device according to claim 2 or 6,
The periphery monitoring means monitors at least a target in the traveling direction of the host vehicle,
The travel control means, as the operating condition, that the target may reach the target within a predetermined time,
When a part of the periphery monitoring device or the traveling control means has failed,
The vehicle control apparatus characterized by advancing the alarm timing, increasing the intensity of the alarm, or extending the alarm time by the alarm change process. The vehicle control device according to claim 7,
The vehicle control device characterized in that the automatic braking timing is further advanced or the strength of the automatic braking is increased by the operation changing process.

Images