JP7506289B2 - Automatic driving control device and vehicle - Google Patents

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

This international application claims priority based on Japanese Patent Application No. 2014-234665, filed with the Japan Patent Office on November 19, 2014, the entire contents of which are incorporated herein by reference.

This disclosure relates to an automatic driving control device that can automatically perform at least some of the various driving actions required for driving a vehicle, such as various decisions and operations by the driver, without the need for operation by the driver.

Various technologies have been proposed to realize autonomous driving of vehicles, some of which have been put to practical use. The following Patent Document 1 discloses an autonomous vehicle that can drive autonomously according to a preset driving plan.

JP 2012-59274 A

One of the ultimate goals of autonomous driving technology is to enable a vehicle to reach its destination simply by setting the destination, without the driver having to be involved in the driving. However, the current situation is that we have not yet reached a level of reliability that would make this possible.

Furthermore, the more advanced autonomous driving technology becomes, the more desirable it is to be able to respond appropriately to abnormalities in the onboard computer used to realize autonomous driving. Specifically, when autonomous driving technology is adopted, it is desirable to be able to disable at least a portion of the control that is being performed automatically and leave it to the driver's operation, or to forcibly control the vehicle's behavior in a safe direction, as necessary.

In one aspect of the present disclosure, in a vehicle that is capable of automatically executing at least some of the various driving controls required for driving without the need for driver operation, it is desirable to be able to forcibly stop at least some of the controls that are being automatically executed at an appropriate time.

An autonomous driving control device in one aspect of the present disclosure is mounted on a vehicle and includes a surrounding information acquisition unit, a driving mode setting unit, an automatic control unit, and a cancellation-required event determination unit.
The surrounding information acquisition unit acquires surrounding information, which is information about the surroundings of the vehicle. More specifically, the surrounding information is information that indicates the state of the surroundings of the vehicle and is necessary for automatically executing a plurality of types of driving operations required for driving the vehicle without requiring an operation by the driver.

The driving mode setting unit sets the driving mode of the vehicle to either a highly automated mode or a basic mode. The highly automated mode is a driving mode in which at least a part of the multiple types of driving operations required for driving the vehicle is automatically executed based on surrounding information. The basic mode is a driving mode in which the types of automatic driving operations, which are driving operations that are automatically executed, are fewer than those in the highly automated mode or are zero.

The automatic control unit executes the automatic driving operation set in the driving mode based on the driving mode set by the driving mode setting unit. The cancellation-required event determination unit determines whether or not a specified cancellation-required event has occurred, at least when the driving mode is the highly automated mode. A cancellation-required event is a specified event that requires cancellation (stopping execution) of at least one of the automatic driving operations that are set to be executed.

When the driving mode is set to at least the highly automated mode, if the cancellation-required event determination unit determines that a cancellation-required event has occurred, the automatic control unit stops the execution of at least one of the automatic driving operations that are set to be executed.

According to the automatic driving control device configured in this manner, when the driving mode is set to at least the highly automated mode (i.e., when at least one automatic driving operation is set to be executed), if a cancellation event occurs, at least one of the automatic driving operations that should be executed is cancelled as an execution target and will no longer be executed by the automatic control unit.

Therefore, even if a disabling event occurs that may cause the automatic driving operation to not be performed normally, it is possible to prevent the vehicle's driving from becoming unintentionally unstable.
When the driving mode is set to a driving mode having at least one automatic driving operation to be executed, if the cancellation event determination unit determines that a cancellation event has occurred, the automatic control unit may stop all automatic driving operations to be executed in that driving mode. In other words, if a cancellation event occurs, the automatic control unit does not perform the automatic driving operation. In this way, even if a cancellation event occurs that may cause the automatic driving operation to be unable to be performed normally, it is possible to more reliably prevent the vehicle's running from becoming unintentionally unstable.

Here, the system may include a notification unit and a release permission determination unit. When the release event determination unit determines that a release event has occurred, the notification unit notifies the vehicle occupant that a release event has occurred. The release permission determination unit determines whether or not a specific release permission action has been performed by the vehicle occupant after the notification by the notification unit. When the release permission determination unit determines that a release permission action has been performed, the automatic control unit may stop the execution of an automatic driving action that should be stopped. Then, when the release permission determination unit does not determine that a release permission action has been performed, the automatic control unit may execute a predetermined automatic stop process to stop the traveling of the vehicle.

In an automatic driving control device configured in this manner, when a cancellation event occurs, the automatic driving operation is not stopped unconditionally, but an alert is issued in advance. Then, if the vehicle occupant expresses their intention in response to the alert, the automatic driving operation is stopped. In this manner, it is possible to prevent the vehicle's driving state from becoming unstable due to the stopping of the automatic driving operation.

FIG. 1A is a side view of a vehicle according to an embodiment, and FIG. 1B is a top view of the vehicle according to the embodiment. 1 is a block diagram showing an electrical configuration of a vehicle according to a first embodiment; FIG. 3A is an explanatory diagram showing the autonomous driving levels of each driving mode, and FIG. 3B is an explanatory diagram showing that the control contents at each autonomous driving level may be set arbitrarily. FIG. 1 is an explanatory diagram for explaining an overview of autonomous driving. 4 is a flowchart of an autonomous driving level setting process. 6 is a flowchart showing details of an autonomous driving cancellation confirmation process in the autonomous driving level setting process of FIG. 5 . 7 is a flowchart showing details of the system monitoring process in the automatic driving cancellation confirmation process of FIG. 6 . 7 is a flowchart showing details of the interior/exterior behavior monitoring process in the autonomous driving cancellation confirmation process of FIG. 6 . 7 is a flowchart showing details of an environment monitoring process in the automatic driving cancellation confirmation process of FIG. 6 . FIG. 10A is a flowchart of the driving history recording process, and FIG. 10B is a flowchart showing details of the self-diagnosis process in the automatic driving cancellation confirmation process of FIG. 6 . FIG. 11 is a block diagram showing an electrical configuration of a vehicle according to a second embodiment. 10 is a flowchart of a control state monitoring process according to a second embodiment.

Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings.
[First embodiment]
(1) Configuration of vehicle 1 Fig. 1A shows a side view of the vehicle 1 of this embodiment, and Fig. 1B shows a top view of the vehicle 1. However, Fig. 1A and Fig. 1B show a simplified illustration of the arrangement of various cameras, radars, sensors, etc. in the vehicle 1, mainly for the purpose of clearly showing the arrangement of these devices.

As shown in Figures 1A and 1B, vehicle 1 is equipped with at least a front camera 2, a rear camera 3, a left side camera 4, a right side camera 5, and an interior camera 6 as cameras for capturing images of the inside and outside of vehicle 1. Each of cameras 2 to 6 is capable of capturing color images and videos. Each of cameras 2 to 6 may be a monocular camera, or may be a stereo camera equipped with multiple lenses that can also capture depth information.

The front camera 2 is mounted on the front end of the ceiling inside the vehicle cabin so as to face forward. This front camera 2 can capture a wide range of images in front of the vehicle 1. The rear camera 3 is mounted on the rear end of the ceiling inside the vehicle cabin so as to face backward. This rear camera 3 can capture a wide range of images in the rear of the vehicle 1.

The left side camera 4 is mounted on the left side of the vehicle 1 facing left. This left side camera 4 can capture a wide range of images of the left side of the vehicle 1. The right side camera 5 is mounted on the right side of the vehicle 1 facing right. This right side camera 5 can capture a wide range of images of the right side of the vehicle 1.

The interior camera 6 is installed at the front end of the ceiling inside the vehicle cabin so as to face rearward (inside the vehicle cabin). This interior camera 6 can capture images of at least the upper body of the driver inside the vehicle cabin.

As shown in Figures 1A and 1B, the vehicle 1 is equipped with a front radar device 11, a rear radar device 12, a left side radar device 13, and a right side radar device 14. In this embodiment, each of the radar devices 11 to 14 is a millimeter wave radar. As is well known, a millimeter wave radar is a radar that transmits millimeter wave radio waves and receives the reflected waves with multiple receiving antennas, and is capable of detecting target information related to targets around the vehicle 1 based on the relationship between the transmitted waves and each received wave and the relationship between each received wave. The target information that can be detected by each of the radar devices 11 to 14 includes the presence or absence of a target in the detection direction, the distance to the target, the direction of the target relative to the vehicle 1, and the moving speed of the target (relative speed to the vehicle 1).

Specifically, the front radar device 11 is provided at the front end of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the front of the vehicle 1. This front radar device 11 can acquire target information related to targets in front of the vehicle 1. The rear radar device 12 is provided at the rear end of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the rear of the vehicle 1. This rear radar device 12 can acquire target information related to targets behind the vehicle 1. The left side radar device 13 is provided on the left side of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the left side of the vehicle 1. This left side radar device 13 can acquire target information related to targets on the left side of the vehicle 1. The right side radar device 14 is provided on the right side of the vehicle 1 and transmits and receives millimeter waves of a predetermined frequency to the right side of the vehicle 1. This right side radar device 14 can acquire target information related to targets on the right side of the vehicle 1.

As shown in Figures 1A and 1B, the vehicle 1 is also equipped with a solar radiation sensor 16 and a rainfall sensor 17. The solar radiation sensor 16 is installed at the bottom of the windshield 9 at the front of the vehicle interior. This solar radiation sensor 16 is capable of detecting the amount of solar radiation on the vehicle 1, and therefore the brightness around the vehicle 1. The rainfall sensor 17 is installed at the top of the windshield 9 on the inside of the vehicle interior. This rainfall sensor 17 is capable of detecting the presence or absence of rainfall and the amount of rainfall.

(2) Electrical Configuration of Vehicle 1 The electrical configuration of the vehicle 1 will be specifically described with reference to FIG. 2. As shown in FIG. 2, the vehicle 1 is equipped with an automatic driving control device 30. The automatic driving control device 30 mainly has a mode switching function and an automatic driving function. The mode switching function is a function for setting the driving mode of the vehicle 1 to either a highly automated mode or a basic mode. The automatic driving function is a function for executing automatic driving according to the automatic driving level (see FIG. 3A. Details will be described later) of the set driving mode. As will be described later, the automatic driving control device 30 appropriately switches the driving mode of the vehicle 1 according to various factors such as the running state of the vehicle 1, the surrounding conditions of the vehicle 1, and the state of the driver of the vehicle 1.

Types of autonomous driving for vehicles include partial autonomous driving and fully autonomous driving. Partial autonomous driving is a form of autonomous driving in which some of the various driving actions required by the driver to drive the vehicle are automated. Note that automation here means that the vehicle can be executed without the need for driver operation. Fully autonomous driving is a form of autonomous driving in which driving to a set destination is fully automated without the need for driver operation. Hereinafter, the parameter indicating the degree of the types and number of driving actions that are automated in autonomous driving will be referred to as the autonomous driving level. Fully autonomous driving is a higher level of autonomous driving than partial autonomous driving. There are also various levels of partial autonomous driving depending on the types and number of driving actions that are automated.

The vehicle 1 of this embodiment is configured to be capable of partial autonomous driving as well as fully autonomous driving by the autonomous driving control device 30. In this embodiment, the driver can freely change the autonomous driving level, that is, which of the various driving operations required for driving are automated and which are performed by the driver.

More specifically, in this embodiment, there are seven main automatic control functions for achieving fully automated driving: automatic start/stop control, lane keeping control, vehicle distance control, lane change control, right/left turn control, collision prevention control, and parking control. The automated driving control device 30 is capable of executing these seven types of automatic control functions, and fully automated driving can be achieved by executing all seven types of automatic control functions.

Conversely, partial automated driving can be achieved by executing any six or fewer of the seven types of automatic control functions. In this embodiment, it is possible to arbitrarily set which of the seven types of automatic control functions are to be executed in the highly automated mode.

The specific contents of the seven types of automatic control functions will be explained in detail later.
The more of the seven types of automatic control functions that are executed, the higher the level of automatic driving becomes. Specifically, when none of the seven types of automatic control functions are executed, the level of automatic driving is level 0. When n types of the seven types of automatic control functions are executed, the level of automatic driving is level n. Therefore, in the level 0 driving mode, the driver is required to determine and operate the control operations corresponding to the seven types of automatic control functions. On the other hand, the driving modes of levels 1 to 6 are driving modes in which partial automatic driving is performed. The driving mode of level 7 is a driving mode in which fully automatic driving is performed.

In this embodiment, the highly automated mode is a driving mode in which autonomous driving is performed at an autonomous driving level of level 1 or higher. On the other hand, the basic mode is a driving mode in which the autonomous driving level is relatively lower than that of the highly automated mode. For example, if the highly automated mode is level n, the basic mode can be set to any of levels n-1 to 0.

In this embodiment, for the sake of simplicity and ease of understanding, the basic mode will be described assuming that the autonomous driving level is set to level 0. Level 0 is a level in which none of the seven types of automatic control functions described above are executed, and the driver must perform most of the various driving operations required for driving.

The automatic driving control device 30 has a control unit 30a and a memory 30b. More specifically, the memory 30b includes a ROM, a RAM, and various other storage media (e.g., an EEPROM, a flash memory). The control unit 30a executes various programs stored in the memory 30b to realize various functions including the mode switching function and the automatic driving function described above. The control unit 30a includes at least a CPU.

The various programs stored in the memory 30b include a program (so-called security software) capable of detecting external unauthorized operations, computer viruses, unauthorized software and data, etc. (hereinafter collectively referred to as "unauthorized factors"). The control unit 30a monitors the presence or absence of unauthorized factors at all times by having this security software resident during startup. If an unauthorized factor occurs, various unauthorized response processes are executed. The unauthorized response processes include a process of forcibly setting the automatic driving level to level 0 so that the automatic control function is not operated at all. There are various other possible specific contents of the unauthorized response processes. For example, a warning may be output to the driver by voice or the like, or the vehicle 1 may be forcibly decelerated or stopped. In addition, the connection between the control unit 30a and each communication unit 31 to 35 may be physically cut off so that the automatic driving control device 30 cannot be accessed from the outside via wireless communication.

The cameras 2-6, radar devices 11-14, and sensors 21-23 shown in Figures 1A and 1B are connected to the automatic driving control device 30. The control unit 30a of the automatic driving control device 30 individually controls the operation of each of the cameras 2-6, and acquires the photographing results (image data) from each of the cameras 2-6 and stores them in memory 30b. The acquisition and storage of image data is repeated at predetermined time intervals.

The control unit 30a can recognize various conditions inside and outside the vehicle based on the image data from each of the cameras 2 to 6. For example, the image data from the interior camera 6 can recognize the movements, facial expressions, line of sight, and eye state of the occupants (mainly the driver).

This allows the control unit 30a to determine whether the driver is behaving abnormally based on the image data from the interior camera 6. The abnormal behavior of the driver here means that the driver is in either of the following states: a state in which the driver himself/herself may not be able to operate the vehicle 1 normally, or a state in which the driver feels uneasy about the operation of the vehicle 1 due to the automatic driving function not operating normally. Specific examples of the former include the driver looking away from the vehicle for too long, falling asleep, or fainting. Specific examples of the latter include the driver having an expression of surprise, worry, or fear.

Based on the image data from the forward camera 2, the control unit 30a can also use various image recognition processes to recognize vehicles ahead, oncoming vehicles, vehicles in adjacent lanes traveling diagonally ahead, lane markings, crosswalks, pedestrians, intersections, other vehicles entering crossroads at intersections, the contents of road signs, traffic lights, and billboards in the direction of travel, rainfall conditions, snowfall conditions, fog conditions, ambient brightness, and other objects around the vehicle. Note that recognizable road signs also include letters and marks painted on the road surface.

This allows the control unit 30a to recognize pedestrian behavior, pedestrian behavior and line of sight, whether or not oncoming vehicles are flashing their lights, weather conditions, and the like, based on image data from the front camera 2. More specifically, weather conditions can be recognized as being whether a certain amount of rain or snow is falling, the occurrence of dense fog, and the like. From pedestrian behavior, it can be recognized whether or not the pedestrian feels uneasy about the vehicle 1. More specifically, if a pedestrian is looking at the vehicle 1 and their facial expression expresses a specific emotion such as surprise, worry, or fear, it can be determined that the pedestrian feels uneasy about the vehicle 1. In addition, if the gazes of a certain number or more pedestrians are directed at the vehicle 1, it can be recognized that the vehicle 1 may not be operating normally.

The control unit 30a can also recognize the distance and relative speed to the vehicle ahead, recognize the driving state of the vehicle relative to the road, and recognize the contents of road signs and billboards based on the image data from the forward camera 2. Therefore, based on the results of recognizing the contents of road signs and billboards, it can recognize various types of sign information such as speed limits, whether or not to stop, and whether or not parking is possible. It can also recognize, for example, areas with high accident rates, school zones, and other specific environments (for example, areas where animals are frequently seen).

In addition, based on the image data from the rear camera 3, the control unit 30a can recognize rear vehicles, vehicles in adjacent lanes traveling diagonally rearward, the surrounding brightness, pedestrians, sign information painted on the road surface, and other objects around the vehicle through various types of image recognition processing.

This allows the control unit 30a to recognize, for example, the relative distance and relative speed between the vehicle and the vehicle behind, and whether or not the vehicle behind is flashing its lights, based on the image data from the rear camera 3. In addition, like the image data from the front camera 2, the image data from the rear camera 3 can also recognize pedestrian behavior, pedestrian behavior and line of sight, weather conditions, and the like.

In addition, based on image data from the left side camera 4 and the right side camera 5, the control unit 30a can recognize vehicles to the sides of the vehicle (including vehicles on the front left, rear left, front right, and rear right), road signs on the side of the road on which the vehicle is traveling, lane markings, pedestrians, the surrounding brightness, and other objects around the vehicle through various types of image recognition processing.

This allows the control unit 30a to recognize, for example, the relative distance and relative speed between the vehicle and the vehicle on the side based on the image data of each of the side cameras 4 and 5. In addition, like the image data of the front camera 2, the image data of each of the side cameras 4 and 5 can also be used to recognize pedestrian behavior, pedestrian behavior and line of sight, weather conditions, and the like.

Furthermore, the control unit 30a of the automatic driving control device 30 individually controls each of the radar devices 11-14, and acquires target detection results from each of the radar devices 11-14 and stores them in the memory 30b. The acquisition and storage of the detection results from each of the radar devices 11-14 is repeated at predetermined time intervals. Based on the detection results of each of the radar devices 11-14, the control unit 30a can calculate and acquire the presence or absence of a target, the distance to the target, the direction of the target, the relative speed of the target as viewed from the vehicle 1, and the like.

The detection results of the front radar device 11 mainly provide information on targets in front of the vehicle (including diagonally forward to the left and right). The detection results of the rear radar device 12 mainly provide information on targets behind the vehicle (including diagonally backward to the left and right). The detection results of the left side radar device 13 mainly provide information on targets on the left side of the vehicle (including the front left and rear left). The detection results of the right side radar device 14 mainly provide information on targets on the right side of the vehicle (including the front right and rear right).

The control unit 30a of the automatic driving control device 30 can determine the brightness of the driving environment based on the detection signal from the solar radiation sensor 16, and can determine whether the brightness is that of nighttime or a similar situation (hereinafter simply referred to as "nighttime"). The vehicle 1 is equipped with headlights (not shown). The headlights can be turned on and off by the driver's operation, and can also be turned on and off automatically by setting the light mode to auto mode. When the light mode is set to auto mode, the control unit 30a automatically turns on the headlights when it is determined that it is nighttime based on the detection signal from the solar radiation sensor 16, and automatically turns off the headlights when it is not nighttime. In this embodiment, when the driving mode is set to the highly automated mode, the light mode is forcibly set to auto mode.

In addition, the control unit 30 a of the automatic driving control device 30 can determine the presence or absence of rain and the amount of rain based on a detection signal from the rainfall sensor 17 .
In addition, as components connected to the automatic driving control device 30, the vehicle 1 is equipped with a wheel speed sensor 18, a current sensor 19, a steering amount sensor 20, an interior contact sensor 21, an engine room temperature sensor 22, an engine room sound sensor 23, a tire air pressure sensor 24, a suspension sensor 25, an exterior sound sensor 26, and an impact sensor 27, as shown in FIG. 2.

The wheel speed sensors 18 are provided on the four wheels on the front, rear, left and right sides of the vehicle 1, and output detection signals (wheel speed signals) that indicate the rotational speed of the corresponding wheels. The wheel speed signals from each wheel speed sensor 18 are input to the automatic driving control device 30.

The control unit 30a can detect the rotational speed of each wheel based on the wheel speed signal from each wheel speed sensor 18. Then, from the detection result, it can detect, for example, whether or not slipping is occurring.

The current sensor 19 is provided for one or more of the numerous electrical wirings provided in the vehicle 1, and outputs a detection signal (current detection signal) indicating the current flowing through the electrical wiring. The current detection signal from the current sensor 19 is input to the automatic driving control device 30.

The control unit 30a can detect the current in the corresponding electrical wiring based on the current detection signal from the current sensor 19. Then, from the detection result, it can detect, for example, whether an overcurrent is flowing in a specific electrical wiring. The overcurrent here refers to a large current that theoretically should not flow when the vehicle 1 is operating normally, and could be, for example, a large current or surge current that may be generated by a lightning strike.

The current sensor 19 may be provided on the body of the vehicle 1 so as to detect the current flowing through the body. In this way, when the vehicle 1 is struck by lightning, it is possible to detect a large current flowing through the vehicle 1 to the ground. Where and how the current sensor 19 is installed may be appropriately determined so as to be able to detect that the vehicle 1 has been struck by lightning.

The steering amount sensor 20 is provided to directly or indirectly detect the steering amount of the steering wheel. The steering amount sensor 20 may be provided, for example, on a column shaft connecting the steering wheel 10 (see Figures 1A and 1B) and the steering mechanism. However, the vehicle 1 of this embodiment is equipped with an electric power steering device that can control the steering of the steering wheel by a motor, and is equipped with a rotation sensor for detecting the rotation position of the motor (and therefore the steering state) for steering control. Therefore, the steering amount sensor 20 does not have to be provided alone, and the rotation sensor may be used as the steering amount sensor 20. In other words, the specific configuration and installation location of the steering amount sensor 20 may be appropriately determined so that the steering amount can be detected.

The control unit 30a can detect the steering amount of the steering wheel based on the detection signal from the steering amount sensor 20. Then, from the detection result, for example, the change state and change rate of the steering amount can be detected. This makes it possible to determine whether the automatic steering control is being performed properly when the driving level is set so that steering is performed automatically (i.e., when the driving level is set so that at least one of lane keeping control, lane change control, and right/left turn control is executed). Specifically, for example, when the change rate of the steering amount is equal to or greater than a predetermined value (i.e., when the change rate is excessive), it can be determined that the automatic steering control is not being performed normally. Alternatively, it can be determined that the automatic steering control is not being performed normally when the vehicle is not traveling along the lane (for example, going beyond the lane markings) or when the vehicle goes straight when it should turn right or left.

The interior contact sensor 21 is a sensor for detecting when an occupant of the vehicle 1 touches a specific part inside the vehicle, and is provided at that specific part (hereinafter also referred to as the "specific contact part inside the vehicle"). The specific contact part inside the vehicle can be determined as appropriate, and could be, for example, a specific part on the driver's seat, the steering wheel 10 or its vicinity, etc.

As described below, the in-vehicle contact sensor 21 is provided so that the driver can quickly (emergently) cancel the autonomous driving when the autonomous driving level of the vehicle 1 is set to level 1 or higher. In other words, when the autonomous driving level is level 1 or higher and the driver wishes to cancel the autonomous driving for some reason, the autonomous driving is forcibly canceled if the driver touches a specific contact part in the vehicle. Therefore, the specific configuration and installation location of the in-vehicle contact sensor 21 may be appropriately determined so as to detect that the driver has touched a specific contact part in the vehicle.

In this embodiment, "cancelling" autonomous driving means setting the autonomous driving level to level 0. However, this is merely one example. For example, stopping at least one of the automatic control functions currently being executed may be defined as "cancelling" autonomous driving. For example, if a certain automatic control function is in operation and the driver senses that the automatic control function may not be operating normally and touches a specific contact point inside the vehicle, "cancelling" autonomous driving may be defined as forcibly stopping one or more automatic control functions, including at least that automatic control function.

The engine room temperature sensor 22 is provided in a predetermined location in or near the engine room of the vehicle 1, and outputs a detection signal corresponding to the temperature of the engine room. The control unit 30a can detect the temperature of the engine room based on the detection signal from the engine room temperature sensor 22. If the detected temperature of the engine room is excessive (for example, if it is equal to or higher than a predetermined temperature threshold), it can determine that some abnormality has occurred in the engine or its surroundings.

The engine room sound sensor 23 is installed in a predetermined location in or near the engine room of the vehicle 1 for the purpose of detecting sounds generated mainly in the engine room, and outputs a detection signal corresponding to the volume of the sound around the installation location. The control unit 30a can detect the sound generated in the engine room based on the detection signal from the engine room sound sensor 23. If the detected sound in the engine room is excessively loud (for example, above a predetermined volume threshold), it can determine that some abnormality has occurred in the engine or its surroundings.

The tire pressure sensors 24 are provided on the front, rear, left and right wheels of the vehicle 1, and output detection signals (air pressure signals) indicating the air pressure of the tires of the corresponding wheels. The air pressure signals from each tire pressure sensor 24 are input to the automatic driving control device 30.

The control unit 30a can detect the tire pressure of each wheel based on the air pressure signal from each tire pressure sensor 24. Then, from the detection result, it can detect, for example, whether or not an abnormality (e.g., a puncture) has occurred in any of the tires.

The suspension sensor 25 outputs a detection signal indicating the amount of expansion and contraction of the suspension of the vehicle 1 (e.g., the amount of expansion and contraction of a shock absorber or a spring). The control unit 30a can detect the behavior of the vehicle 1 (mainly the behavior in the vertical direction) based on the detection signal from the suspension sensor 25. When the automatic driving level of the vehicle 1 is set to level 1 or higher, if the automatic control function to be executed is not operating normally, the behavior of the vehicle 1 may become unstable. For example, unstable behavior such as sudden starting, sudden stopping, and sudden turning may automatically occur. Such unstable behavior appears as suspension behavior. Therefore, the control unit 30a can determine the stability of the behavior of the vehicle 1 based on the detection signal from the suspension sensor 25 (i.e., based on the amount of expansion and contraction of the suspension itself or its rate of change), and can therefore determine whether the automatic control function is operating normally when the automatic control function is operating.

The external sound sensor 26 is provided mainly for the purpose of detecting sounds generated around the vehicle 1. The control unit 30a can detect the type and volume of sounds generated around the vehicle 1 based on the detection signal from the external sound sensor 26. For example, it can detect when another vehicle is honking its horn.

When an impact is applied to the vehicle 1 from outside the vehicle 1, the impact sensor 27 outputs a detection signal according to the level of the impact. The control unit 30a can detect the presence or absence and level of an external impact on the vehicle 1 based on the detection signal from the impact sensor 27. Note that the impacts that can be detected by the impact sensor 27 include a wide range of levels of impact, from relatively large levels of impact, such as a collision with another vehicle or a road structure, to relatively low levels of impact, such as an impact caused by a person outside the vehicle 1 hitting the vehicle 1.

The vehicle 1 also includes, as components connected to the automatic driving control device 30, a GPS communication unit 31, a vehicle-to-vehicle communication unit 32, a road-to-vehicle communication unit 33, a pedestrian-to-vehicle communication unit 34, and an LTE communication unit 35, as shown in FIG. 2.

The GPS communication unit 31 receives radio waves from multiple GPS (Global Positioning System) satellites and outputs information contained in the received radio waves (GPS information) to the automatic driving control device 30. The control unit 30a of the automatic driving control device 30 can calculate the current position of the vehicle 1 based on the information received by the GPS communication unit 31.

The autonomous driving control device 30 also has a route guidance function, which is one of the various element functions for realizing the autonomous driving function. The route guidance function is a function that calculates an appropriate route from the current position to the destination based on the current position of the vehicle 1 calculated based on GPS information and the destination set by the driver, and guides and controls the vehicle 1 so that the vehicle 1 travels along that route to the destination.

The route guidance function includes a function to recognize the road conditions around the vehicle 1 (e.g., the shape of the route to the destination and the vehicle width), and a function to recognize the presence and operation status of infrastructure in the direction of travel (e.g., the status of traffic lights in the direction of travel, the presence or absence of intersections, the presence or absence of pedestrian crossings, speed limits, regulatory information, etc.). The control unit 30a uses these various recognition results to realize the above guidance control.

The content of the guidance control of the vehicle 1 in the route guidance function varies depending on the autonomous driving level. For example, when the autonomous driving level is set to fully autonomous driving level 7, the guidance control is to provide route information (information on which direction and which route the vehicle should travel) necessary to execute the multiple types of automatic control functions (seven types as described above in this embodiment) required to achieve fully autonomous driving. Also, for example, when the autonomous driving level is set to a predetermined level 1 to 6 (partially autonomous driving) that is lower than fully autonomous driving, the guidance control is to provide route information for the automatic control functions necessary for partial autonomous driving out of the multiple types of automatic control functions, and to guide the driver on the driving route (for example, voice guidance) as necessary.

When the autonomous driving level is set to any of levels 1 to 6, i.e., when one or more of the seven types of automatic control functions are set to be executed, the control unit 30a provides at least the information necessary for the set automatic control function as guidance control.

Map data and other various data required for the route guidance function are stored in memory 30b. The control unit 30a executes the program for the route guidance function stored in memory 30b while referring to the various data, thereby realizing the route guidance function (i.e., the above-mentioned guidance control).

The vehicle-to-vehicle communication unit 32 is a communication module for wirelessly transmitting and receiving various data to and from other vehicles other than the vehicle itself. The control unit 30a of the automatic driving control device 30 can obtain information about other vehicles in the vicinity (e.g., driving direction, driving speed, position, etc.) via the vehicle-to-vehicle communication unit 32. Conversely, information about the vehicle itself 1 can also be transmitted to other vehicles.

The control unit 30a can also learn the relative relationship between the vehicle and other vehicles by acquiring the positions and driving conditions of other vehicles through vehicle-to-vehicle communication. For example, it can detect the relative distance and relative speed between the vehicle and other vehicles.

In addition, information related to the driving mode can be transmitted and received via vehicle-to-vehicle communication. The control unit 30a can also transmit and receive information regarding whether the driving mode is set to the highly automated mode or the basic mode, and the level of automated driving in the set driving mode.

The road-to-vehicle communication unit 33 is a communication module for receiving various information wirelessly transmitted from a road communication device 81 (see FIG. 4) installed on the road (ground side). The various information received by the road-to-vehicle communication unit 33 is input to the automatic driving control device 30.

The road communication device 81 is connected to a server (not shown), receives various information from the server, and wirelessly transmits the information within a predetermined surrounding area. The server collects various types of road traffic information, such as various types of infrastructure information (e.g., traffic light information, road regulation information, and other types of information related to the road) and information on the presence of other vehicles and pedestrians. The server transmits individual road information related to each road communication device 81 based on the collected road traffic information. The individual road information is information for vehicles traveling within the communication area of the road communication device 81, and includes various types of road traffic information within the communication area and various types of concurrent traffic information ahead of the area (in the direction of travel). Each road communication device 81 wirelessly transmits the individual road information transmitted from the server within a predetermined communication area.

The control unit 30a of the automatic driving control device 30 can acquire various road traffic information related to the surroundings of the vehicle and the road in the traveling direction via the road-vehicle communication unit 33. Information that the control unit 30a can acquire via the road-vehicle communication unit 33 includes section information related to driving sections where caution is required when driving, such as accident-prone areas, school zones, areas where animals are lurking, etc. (hereinafter also referred to as "cautionary sections"). By linking the acquired section information with the route guidance function, the control unit 30a can recognize the relative relationship between the cautionary section and the vehicle 1, such as whether the vehicle 1 is traveling in the cautionary section indicated by the section information, and how much further it will travel before entering the cautionary section. Information related to other sections or points other than the cautionary section may be acquired as section information.

Each roadside communication device 81 illustrated in FIG. 4 is equipped with a camera 82. Each camera 82 captures images of the road and transmits the captured image data to a server via a network.

The server can obtain road traffic information around each camera 82 from the image data transmitted from that camera. Specifically, the server can recognize the shape of the road, the lanes, and the status of the traffic lights from the image data. The server can also recognize the driving status and license plate number of a vehicle that is currently in motion. The server can also determine whether or not a vehicle in the image data is driving normally based on the image data. For example, if a vehicle passes through a traffic light that is red without stopping, it can be determined that the vehicle is not driving normally.

Vehicle 1 can also transmit various information related to the state of vehicle 1 via road-to-vehicle communication unit 33. The transmitted information from vehicle 1 is received by roadside communication device 81 and collected in a server. The server can individually recognize and manage the states of multiple vehicles, including vehicle 1, and can also notify a specific vehicle of the state of other vehicles as necessary. Therefore, for example, it is possible to know information such as what level the autonomous driving level is set to in other vehicles around the vehicle, in other words, to what extent the automatic control functions are operating in other surrounding vehicles.

The pedestrian-to-vehicle communication unit 34 is a communication module for wireless communication with a communication terminal (e.g., a mobile phone or smartphone) carried by a pedestrian on the ground. If the communication terminal carried by the pedestrian is configured to be able to wirelessly transmit terminal position information indicating the position of the communication terminal (i.e. the pedestrian's position), the pedestrian-to-pedestrian communication unit 34 can receive the terminal position information transmitted from the communication terminal. The terminal position information received by the pedestrian-to-pedestrian communication unit 34 is input to the automatic driving control device 30. The automatic driving control device 30 can also inform the pedestrian of the position information of the vehicle 1, etc., by wirelessly transmitting various information such as the position information of the vehicle 1 from the pedestrian-to-pedestrian communication unit 34 to the pedestrian's communication terminal.

The control unit 30a of the automatic driving control device 30 can know the position and movement of pedestrians based on the terminal position information received via the pedestrian-to-vehicle communication unit 34. The presence or absence and movement of pedestrians can be detected by the above-mentioned cameras and radar devices, but in addition, the presence or absence of pedestrians and their jumping out can also be detected from the information obtained via the pedestrian-to-vehicle communication unit 34.

The LTE communication unit 35 is a communication module for realizing wireless communication by LTE, which is a well-known mobile phone communication standard. The control unit 30a can obtain various information necessary for autonomous driving of the vehicle 1 and update existing information (e.g., update map data) via the LTE communication unit 35 (i.e., by LTE wireless communication). Note that it is not essential to obtain or update such various information by LTE wireless communication, and other wireless communication may be used.

The vehicle 1 also includes, as components connected to the automatic driving control device 30, an operation unit 36, a display unit 37, a speaker 38, an automatic driving switch 41, a level setting operation unit 42, an emergency stop lever 43, and a release reset switch 44, as shown in FIG. 2.

The operation unit 36 is an input interface for accepting various input operations for the vehicle 1 by the occupants of the vehicle 1, including the driver. The display unit 37 is an output interface for visually providing various information to the occupants of the vehicle 1, including the driver. Various information, including map information in the route guidance function, is also displayed on the display unit 37. The speaker 38 outputs audio based on various audio signals output from the automatic driving control device 30.

The autonomous driving switch 41 is a switch for setting the driving mode of the vehicle 1 to the highly automated mode. In order for the driver of the vehicle 1 to set the driving mode to the highly automated mode and perform autonomous driving, the driver must switch the autonomous driving switch 41 to the on side. On the other hand, when the autonomous driving switch 41 is switched to the off side, the driving mode is set to the basic mode.

The emergency stop lever 43 is an operating means for forcibly canceling autonomous driving when the autonomous driving level of the vehicle 1 is level 1 or higher (i.e., forcibly switching the autonomous driving level to level 0), and is provided in a specified location inside the vehicle cabin (e.g., on the ceiling). When the emergency stop lever 43 is operated while the autonomous driving level of the vehicle 1 is set to level 1 or higher, autonomous driving is forcibly canceled. If the driver recognizes that a fraudulent factor such as a computer virus or unauthorized operation has occurred, or that the automatic control function is not working properly, the driver can forcibly cancel autonomous driving by operating the emergency stop lever 43, and drive the vehicle 1 under the driver's own driving operations.

The level setting operation unit 42 is a user interface for accepting an operation by the driver to set the autonomous driving level (details will be described later).
The release reset switch 44 is a switch for resetting the released state after autonomous driving is forcibly released and the autonomous driving level is forcibly set to level 0. In this embodiment, as described below, when the autonomous driving level is set to level 1 or higher, if a predetermined event requiring release that should release the autonomous driving occurs, the autonomous driving is forcibly released. Specifically, an autonomous driving release flag, described below, is set.

When automatic driving is forcibly released, the released state is maintained in principle (the set state of the automatic driving release flag is maintained), but the released state can be reset (the automatic driving release flag is reset) by pressing the release reset switch 44. When the released state is reset, the driving mode is set to a mode corresponding to the operation state of the automatic driving switch, and the automatic driving level is set to a level corresponding to the set driving mode (the level set by the level setting operation unit 42).

The vehicle 1 also includes a driving control unit 46, a brake control unit 47, and a steering control unit 48 as components connected to the automatic driving control device 30, as shown in FIG. 2.

The driving control unit 46 controls the driving of the vehicle 1 by controlling the engine and transmission (not shown) based on various information such as the amount of depression of the accelerator pedal (not shown), the operating position of the shift lever (not shown), the vehicle speed, and the engine speed.

On the other hand, when the automatic driving level is set to level 1 or higher, that is, when any of the seven types of automatic control functions is executed, the automatic driving control device 30 outputs control information necessary to realize the automatic control function to be executed to the driving control unit 46. In this case, the driving control unit 46 automatically controls the engine and the transmission in accordance with the control information from the automatic driving control device 30 even if the accelerator pedal is not depressed. Note that the vehicle 1 of this embodiment is equipped with an engine as a driving source for driving, but the automatic driving control device of the present disclosure can also be applied to a vehicle equipped with a driving source for driving other than an engine (e.g., an electric motor). In that case, the driving control unit 46 shown in FIG. 2 has the function of controlling the driving source for driving of the vehicle. In addition, when a driving source for driving other than an engine is included, the above-mentioned engine room temperature sensor 22 and engine room sound sensor 23 may be installed for the purpose of detecting the temperature and sound of the driving source for driving or its surroundings, respectively.

The brake control unit 47 controls a brake device (not shown) based on the amount of depression of the brake pedal (not shown). On the other hand, when the autonomous driving level is set to level 1 or higher, that is, when any of the seven types of autonomous control functions is executed, the autonomous driving control device 30 outputs control information required to realize the autonomous control function to be executed to the driving control unit 46. In this case, the brake control unit 47 automatically controls the brake device according to the control information from the autonomous driving control device 30, even if the brake pedal is not depressed.

The steering control unit 48 has two main functions. One is a so-called electric power steering function. In other words, it assists the driver in operating the steering wheel 10 by using a motor. The other is an automatic steering function that automatically steers the steering wheels (e.g., the front wheels) of the vehicle 1 without the driver's operation. The steering of the steering wheels is basically performed by the driver operating the steering wheel 10, but when at least any of the seven types of automatic control functions described above, except for automatic start/stop control and following distance control, is executed, the steering control unit 48 automatically controls the steering of the steering wheels by controlling the motor according to control information from the automatic driving control device 30, even if the driver is not operating the steering wheel 10.

(3) Description of Autonomous Driving Function In the vehicle 1 of this embodiment, the automatic driving control device 30 can acquire and detect various pieces of information necessary to realize the above-described automatic driving function.

Information that can be used to realize the autonomous driving function includes, first, information such as the vehicle's position and speed (vehicle information). The vehicle's position can be obtained by calculation based on GPS information. The vehicle's speed can be obtained by calculation based on a vehicle speed signal from a vehicle speed sensor (not shown), a detection signal from the steering amount sensor 20, a yaw rate signal from a yaw rate sensor (not shown), and the like. The vehicle's speed can also be calculated from the rate of change of the vehicle's position.

Information that can be used to realize an autonomous driving function also includes information about surrounding objects, specifically, information about the relative positions, distances, and speeds of various objects (including people and animals) around the vehicle, such as vehicles ahead, behind, to the side, oncoming vehicles, vehicles crossing the intersection ahead, pedestrians, bicycles, road structures and fixed installations, and obstacles.

Information about these surrounding objects can be obtained based on the image capture data from each of the cameras 2 to 5 and the detection results from each of the radar devices 11 to 14. Various technologies for recognizing surrounding objects based on image capture data and the detection results from radar devices have been proposed and put to practical use, so a description of them will be omitted here.

Information about surrounding objects can also be obtained by vehicle-to-vehicle communication, road-to-vehicle communication, and pedestrian-to-vehicle communication. For example, by performing vehicle-to-vehicle communication with surrounding vehicles, it is possible to recognize not only surrounding vehicles that are visible to the vehicle itself, but also the positions and movements of surrounding vehicles that are in blind spots and cannot be seen directly from the vehicle itself. As described above, road-to-vehicle communication can obtain information about the presence of surrounding vehicles and pedestrians. As described above, pedestrian-to-vehicle communication can know the positions and movements of pedestrians based on terminal position information received via pedestrian-to-vehicle communication unit 34.

By using one or more of vehicle-to-vehicle communication, road-to-vehicle communication, and pedestrian-to-vehicle communication, it is possible to, for example, obtain information on oncoming vehicles during normal driving (especially on curves) or when turning right in order to prevent head-on collisions with oncoming vehicles, obtain information on motorcycles on the left side or rear in order to prevent motorcycles from being hit when turning left, obtain information on vehicles on the side (rear side) when changing lanes, obtain information on vehicles ahead in order to prevent or suppress rear-end collisions, obtain information on other vehicles traveling on the side of the intersection in order to prevent head-on collisions at intersections, and obtain information on pedestrians, etc. in order to prevent collisions with pedestrians, etc.

Information that can be used to realize autonomous driving functions also includes information about various road markings painted directly on the road, such as lane markings (including parking markings), pedestrian crossings, and stop lines. Information about road markings includes the position and content of the markings. This information about road markings can be obtained based on the image data captured by each of the cameras 2 to 6. Various technologies for recognizing road markings from image data have been proposed and put to practical use, so a description of these will be omitted here.

Information about road signs in the direction of travel can also be obtained through road-to-vehicle communication. Although the vehicle 1 of this embodiment is not equipped with a laser radar, it is also possible to obtain information about various road signs.

In addition, information that can be used to realize the autonomous driving function also includes information on traffic lights, railroad crossings, signs (including billboards), intersections, junctions/diverging points, sidewalks, obstacles, dangerous areas, and other above-ground structures (collectively referred to as "infrastructure-related information" below). In addition to the presence and location of the various objects mentioned above, infrastructure-related information also includes information on the color of traffic lights, the operating status of railroad crossings, and the display content of signs, billboards, etc. Infrastructure-related information can also be recognized and acquired based on the photographic data of each of the cameras 2 to 6, and can also be acquired through road-to-vehicle communication. Various types of infrastructure information can also be acquired from the route guidance function described above, which is based on GPS information and map data, etc.

In addition, regulation information can also be used to realize autonomous driving functions. For example, if there are driving restrictions in place in the direction of travel due to construction, accidents, natural disasters, etc., this regulation information can be obtained through road-to-vehicle communication.

Among the various types of information necessary for realizing the autonomous driving function (the realization of the seven types of autonomous control functions described above in this embodiment), such as the information on surrounding objects, information on road signs, infrastructure-related information, and regulatory information, information relating to the surroundings of vehicle 1 in particular corresponds to an example of surrounding information in the present disclosure.

The automatic driving control device 30 can realize automatic driving by acquiring the various information described above and controlling the driving control unit 46, the brake control unit 47, the steering control unit 48, and other necessary in-vehicle devices based on that information. Specifically, it can execute the seven types of automatic control functions described above. As described above, the seven types of automatic control functions in this embodiment are automatic start/stop control, lane keeping control, vehicle distance control, lane change control, right/left turn control, collision prevention control, and parking control.

Automatic start/stop control is a control that automatically stops the vehicle 1 when a condition for stopping is met while traveling, and automatically starts the vehicle 1 when the condition for stopping is lifted after stopping. This control is performed using information about the vehicle itself, as well as information about surrounding objects obtained from the cameras 2-5 and the radar sensors 11-14, and infrastructure-related information and regulation information obtained through road-to-vehicle communication. With this automatic start/stop control, for example, if the traffic light at an intersection is green, the vehicle continues to travel and stops if the light is red or yellow; if a railroad crossing is recognized ahead and a barrier is down, the vehicle stops; and if the barrier is not down, the vehicle stops once and then starts again. In addition, the vehicle also stops automatically if an obstacle is recognized ahead.

Lane keeping control is a control system that automatically steers the steering wheels so that the vehicle travels along the lane without deviating from the lane markings. This control is performed in cooperation with the route guidance function, using information on the vehicle itself, as well as information on road markings (especially lane markings) obtained from the cameras 2-5 and the radar sensors 11-14.

Inter-vehicle distance control is a control that controls the speed to maintain a constant distance between the vehicle and other vehicles when there are other vehicles traveling ahead of the vehicle, and drives the vehicle at a set speed when there are no other vehicles ahead. This control is performed using information about the vehicle itself, as well as information about surrounding objects (especially the vehicle ahead) obtained mainly from each of the cameras 2-5 and each of the radar sensors 11-14.

Lane change control is a control that, when a lane change (steering to change lanes) is necessary, detects other vehicles in the adjacent lane to which the lane is to be changed, and automatically changes lanes while controlling the driving force, braking force, and steering to avoid colliding with other vehicles depending on the presence, position, and speed of other vehicles. This control is performed using information about the vehicle itself, as well as information about surrounding objects (particularly other vehicles in adjacent lanes), information about lane dividing lines, and information about other vehicles (vehicles traveling in adjacent lanes) obtained from each of the cameras 2-5 and each of the radar sensors 11-14, as well as information about lane dividing lines, and information about other vehicles obtained through vehicle-to-vehicle communication.

Right/left turn control is a control that allows the vehicle to automatically turn right or left when it becomes necessary to turn right or left without colliding with oncoming vehicles, vehicles traveling at an intersection, other vehicles around the vehicle, pedestrians, etc. This control is performed using information about the vehicle itself, as well as information about surrounding objects obtained from the cameras 2-5 and radar sensors 11-14, information about other vehicles obtained through vehicle-to-vehicle communication, and information about pedestrians, etc. obtained through pedestrian-to-vehicle communication.

Collision prevention control is a control that automatically steers, brakes, stops, etc. the vehicle to avoid colliding with an obstacle that is present on the road in the vehicle's travel direction. It is performed using information about surrounding objects obtained from each of the cameras 2 to 5 and each of the radar sensors 11 to 14, infrastructure-related information and regulation information obtained through road-to-vehicle communication, etc.

Parking control is a control that, when a specific target parking position (for example, within a parking space in a specific parking lot) is set as the destination, calculates a driving trajectory to the target parking position and controls the vehicle's driving force, braking force, and steering along that driving trajectory to automatically park the vehicle.

The driver or the like can set which of the seven types of control functions will be executed, i.e., the autonomous driving level, at his/her discretion. Specifically, as shown in FIG. 3A, the autonomous driving level can be set at will in both the highly automated mode and the basic mode. However, in the basic mode, level 7 cannot be set, and any of levels 0 to 6 can be set. On the other hand, in the highly automated mode, level 0 cannot be set, and any of levels 1 to 7 can be set. Furthermore, the basic mode level can be set within a range lower than the highly automated mode level. Conversely, the highly automated mode level can be set within a range higher than the basic mode level.

In this embodiment, as shown in FIG. 3A, at level 1, control A (e.g., lane keeping control) is executed. At level 2, control B (e.g., vehicle distance control) is executed in addition to control A. At level 3, control C (e.g., automatic start/stop control) is executed in addition to controls A and B. At level 4, control D (e.g., collision prevention control) is executed in addition to controls A, B, and C. At level 5, control E (e.g., lane change control) is executed in addition to controls A, B, C, and D. At level 6, control F (e.g., right/left turn control) is executed in addition to controls A, B, C, D, and E. At level 7, control G (e.g., parking control) is executed in addition to controls A, B, C, D, E, and F. In other words, the number of automatic control functions executed increases as the level increases, and at level 7, the vehicle is fully automated.

The level setting for each driving mode can be performed by operating the level setting operation unit 42 provided near the driver's seat for each driving mode individually. In this embodiment, the autonomous driving level of the basic mode is set to level 0 by default, and the autonomous driving level of the highly automated mode is set to level 1 by default. The currently set autonomous driving level can be changed arbitrarily for each driving mode. For example, if the basic mode is set to level 0, the highly automated mode can be changed arbitrarily between levels 1 to 7. For example, if the basic mode is set to level 1, the highly automated mode can be changed arbitrarily between levels 2 to 7. For example, if the highly automated mode is set to level 4, the basic mode can be changed arbitrarily between levels 0 to 3.

Note that which automatic control function is executed at which level is not limited to the example shown in FIG. 3A. For example, it is not necessary that the number of automatic control functions executed increases by one each time the level increases by one. Which automatic control function is executed at which level may be determined as appropriate.

In addition, while assuming that the number of automatic control functions executed increases by one each time the level increases by one, as shown in FIG. 3A, the contents of Control A to Control G may be set by the driver or other person as desired, as shown in FIG. 3B.

In the vehicle 1 of this embodiment, when the automatic driving switch 41 is turned off, the driving mode is set to the basic mode. On the other hand, when the automatic driving switch 41 is turned on, the driving mode becomes the highly automated mode under certain conditions. Note that when lane change control, right/left turn control, and parking control are set, it is necessary to set a destination (target parking position in the case of parking control). Specifically, the route guidance function is started and the destination is input via the touch panel. When a destination is set, automatic driving is basically performed along the calculated route to the destination while checking the position of the vehicle in cooperation with the route guidance function.

Various control examples in the highly automated mode when the automated driving level of the highly automated mode is set to level 7 will be described with reference to FIG. 4. Each of the vehicles 61 to 67 shown in FIG. 4 has the same configuration as the vehicle 1 shown in FIG. 1 and FIG. 2. A vehicle traveling within the communication area of the road communication device 81 can receive individual road information from the road communication device 81. At least four of the vehicles in FIG. 4 (61, 65, 66, 67) can receive individual road information from at least two road communication devices 81a, 81b in their vicinity. Specifically, they can obtain information on the traffic light 71 ahead, information on the oncoming vehicle 62, information on pedestrians 76, etc.

In addition, at least the vehicle 63 can receive individual road information from at least the roadside communication device 81c in its vicinity. Specifically, it can obtain information such as the presence of a stop sign 73 (i.e., that the vehicle should stop), and that another vehicle 64 is approaching from the right.

In addition, at least vehicle 64 can receive individual road information from at least the roadside communication device 81d in its vicinity. Specifically, it can obtain information such as that another vehicle 63 is approaching from the left side.

In addition, at least the vehicle 62 can receive individual road information from at least the roadside communication device 81e in its vicinity. Specifically, it can obtain information such as information about the traffic light 72 ahead, the presence of an oncoming vehicle 61 about to turn right, the presence of a pedestrian crossing in the direction of the left turn, and the presence of a pedestrian 76 at the crossing.

Each vehicle 61-66 can also obtain various information from its own cameras 2-6 and radar devices 11-14, and can also obtain various information through vehicle-to-vehicle communication and pedestrian-to-vehicle communication. For example, vehicle 65 can detect the vehicle 67 ahead and the vehicle 66 on the right side using the camera and radar device, and can thus drive while maintaining an appropriate distance from the vehicle 67 ahead, and when a lane change is necessary, can change lanes at an appropriate time while taking into account the positional relationship with the vehicle 66 on the right side. Vehicle 65 can also detect a pedestrian 77 running out using the camera and radar device, and in that case can perform appropriate deceleration control to avoid colliding with the pedestrian 77 while taking into account the distance from the vehicle 65 behind.

As a result, each vehicle 61-66 can automatically drive appropriately along the route to the destination using various information, such as various information obtained by the vehicle itself and various information obtained from the road. Specifically, each vehicle 61-66 can automatically drive appropriately along the route, avoiding contact with other vehicles, pedestrians, and other road structures, and obeying traffic signals and traffic regulations, mainly by automatically controlling the driving control unit 46, the brake control unit 47, and the steering control unit 48.

(4) Autonomous driving level setting process Next, the autonomous driving level setting process executed by the control unit 30a of the autonomous driving control device 30 will be described with reference to Fig. 5. The autonomous driving level setting process in Fig. 5 is a process for switching the driving mode of the vehicle 1 to either the highly automated mode or the basic mode, and forcibly setting the autonomous driving level to level 0 if it is determined that the autonomous driving should be cancelled when the autonomous driving level is level 1 or higher.

When the control unit 30a is started by turning on a power switch (e.g., an ignition switch) (not shown) of the vehicle 1, the control unit 30a reads the program for the autonomous driving level setting process shown in FIG. 5 from the memory 30b and executes it repeatedly at a predetermined control period.

When the control unit 30a starts the autonomous driving level setting process in Fig. 5, it determines in S10 whether or not the autonomous driving cancellation flag is set. The autonomous driving cancellation flag is a flag that is set when it is determined that the autonomous driving should be cancelled, and specifically, it is set in S119 in Fig. 6, which will be described later.

If the autonomous driving cancellation flag is set (S10: YES), the autonomous driving level is set to level 0 in S70. That is, regardless of whether the driving mode is set to the highly automated mode or the basic mode, the autonomous driving level is forcibly set to level 0, and none of the seven types of automatic control functions described above are executed. Then, in S80, a specified error notification is issued to notify the occupants of vehicle 1 that autonomous driving has been forcibly cancelled, and the autonomous driving level setting process is terminated.

While this automatic driving cancellation flag is set, none of the seven types of automatic control functions are activated, so the driver must perform all driving operations corresponding to the seven types of automatic control functions (driving operations that can be performed automatically by each automatic control function). As mentioned above, the automatic driving cancellation flag can be reset by pressing the cancellation reset switch 44.

If the automatic driving cancellation flag is not set in S10 (S10: NO), it is determined in S20 whether the emergency stop flag is set. The emergency stop flag is a flag that is set when it is determined that the vehicle 1 should be stopped urgently, and specifically, it is a flag that is set in S120 in FIG. 6, which will be described later.

If the emergency stop flag is set (S20: YES), emergency stop processing is executed in S90. The emergency stop processing is processing for stopping the vehicle 1 as quickly as possible while maintaining safety. The specific processing content of the emergency stop processing may be determined appropriately so as to stop the vehicle as quickly as possible while maintaining safety. For example, one possible processing content is to decelerate the vehicle 1 and pull over to the shoulder of the road to stop it while monitoring with each camera and each radar device to avoid contact with objects outside the vehicle (including other vehicles, pedestrians, etc.).

If the emergency stop flag is not set in S20 (S20: NO), then in S30 it is determined whether the automatic driving switch 41 is on. If the automatic driving switch 41 is on (S30: YES), then in S40 the driving mode is set to the highly automated mode, and the process proceeds to S60. If the automatic driving switch 41 is off (S30: NO), then in S50 the driving mode is set to the basic mode, and the process proceeds to S60.

When the driving mode is set to the highly automated mode in S40, the control unit 30a executes an automatic control function based on the automated driving level set as the highly automated mode in S55. For example, when level 6 is set as the highly automated mode, six types of automatic control functions, control A to F (see FIG. 3A), are executed. Also, when level 7 is set as the highly automated mode, all seven types of automatic control functions, control A to G, are executed to achieve fully automated driving. Also, the execution of the automatic control function in S55 is performed based on various information acquired as necessary, including the aforementioned surrounding information.

When the driving mode is set to the basic mode in S50, the control unit 30a executes the automatic control function based on the automatic driving level set as the basic mode in S50. For example, when level 1 is set as the basic mode, the automatic control function of control A (see FIG. 3A) is executed. In this case, the automatic control function is also executed based on various information acquired as necessary, including the above-mentioned surrounding information. However, when level 0 is set as the basic mode, none of the automatic control functions are executed.

In S60, an autonomous driving cancellation confirmation process is executed. This autonomous driving cancellation confirmation process has two main purposes. One is to determine whether or not it is necessary to forcibly set the autonomous driving level to level 0 when the autonomous driving level is set to level 1 or higher, and to set an autonomous driving cancellation flag if it is necessary to forcibly set it to level 0. The other is to determine whether or not it is necessary to make an emergency stop of vehicle 1 when the autonomous driving level is set to level 1 or higher, and to set an emergency stop flag if it is necessary to make an emergency stop.

Details of the automatic driving cancellation confirmation process of S60 are as shown in FIG. 6. When the control unit 30a proceeds to the automatic driving cancellation confirmation process of S60, as shown in FIG. 6, in S111, it determines whether the automatic driving level set in the current driving mode is level 1 or higher. If the automatic driving level is not level 1 or higher (i.e., level 0) (S111: NO), it ends the automatic driving cancellation confirmation process of FIG. 6, thereby ending the automatic driving level setting process of FIG. 5.

If the autonomous driving level set in the current driving mode is 1 or higher (S111: YES), a system monitoring process is executed in S112. The system monitoring process in S112 is a process for monitoring the operating state of the vehicle 1 (including the execution state of the automatic control function) and determining whether a predetermined event (a deactivation event) has occurred that requires the autonomous driving level to be forcibly switched to level 0. The details of the system monitoring process in S112 will be described later with reference to FIG. 7.

In S113, the inside/outside behavior monitoring process is executed. The inside/outside behavior monitoring process in S113 is a process for monitoring the behavior of vehicle occupants in the cabin of vehicle 1, the behavior of pedestrians and other vehicles outside vehicle 1, and the like, to determine whether a cancellation event has occurred that requires the autonomous driving level to be forcibly switched to level 0. The details of the inside/outside behavior monitoring process in S113 will be described later in detail with reference to FIG. 8.

In S114, an environmental monitoring process is executed. The environmental monitoring process in S114 is a process for monitoring the environment around the vehicle 1 and determining whether a cancellation event has occurred that requires the autonomous driving level to be forcibly switched to level 0. The details of the environmental monitoring process in S114 will be described later with reference to FIG. 9.

In S115, a self-diagnosis process is executed. The self-diagnosis process in S115 is a process for self-diagnosing whether the execution state of the automatic control function by the control unit 30a itself is normal or not by comparing it with the past execution result. The details of the self-diagnosis process in S115 will be described later with reference to FIG. 10B.

In S116, it is determined whether or not a cancellation-required event has occurred in any of the processes from S112 to S115. If it is not determined that a cancellation-required event has occurred (S116: NO), the automatic driving cancellation confirmation process in FIG. 6 is terminated. If it is determined that a cancellation-required event has occurred in any of the processes from S112 to S115 (S116: YES), in S117, an automatic driving cancellation advance notice is given to the occupants of the vehicle 1. This notice is a notice to notify the occupants in advance of the occurrence of a cancellation-required event that requires the automatic driving to be cancelled, in order to cancel the automatic driving, based on the occurrence of a cancellation-required event that requires the automatic driving to be cancelled. This notice may be given by various methods that can make the occupants of the vehicle 1 recognize that a cancellation-required event has occurred and the automatic driving should be cancelled. As a specific notice method, for example, a predetermined message may be issued by voice, a visual message may be sent to the occupants using the display unit 37, or the seat may be vibrated.

In S118, it is determined whether the automatic driving can be cancelled. In other words, this determination is a process for determining whether the driver can perform the driving operation by himself when the driving operation that was performed automatically until then is no longer performed automatically due to the cancellation of the automatic driving. The basis for determining whether the automatic driving can be cancelled may be determined appropriately. For example, the determination may be made based on whether a specific cancellation permission operation is performed by the driver based on the state and behavior of the driver. The cancellation permission operation is an operation that indicates that the driver is in a state where he or she can perform the driving operation by himself or herself. The cancellation permission operation also includes a stationary state in which the driver is stationary in a specific state. As the cancellation permission operation, for example, at least one of a plurality of operations and states, such as the driver holding the steering wheel 10 with at least one hand, the driver holding the steering wheel 10 with both hands, the driver's eyes being open, the driver's gaze being directed toward the front of the vehicle, and the driver's behavior being normal (for example, a state that is determined to be positive in the determination process of S204 described later), may be set. The control unit 30a may determine whether the release permission operation is being performed, for example, based on image data from the indoor camera 6.

If it is determined that the autonomous driving can be cancelled (S118: YES), the autonomous driving cancellation flag is set in S119. As a result, when the judgment process of S10 in FIG. 5 is next executed, a positive judgment is made and the process proceeds to S70, where the autonomous driving level is forcibly set to level 0.

If it is determined in S118 that the automatic driving cannot be cancelled (S118: NO), the emergency stop flag is set in S120. As a result, when the determination process of S20 in FIG. 5 is next executed, a positive determination is made and the process proceeds to S90, where the emergency stop process is executed.

Next, the system monitoring process of S112 in the autonomous driving cancellation confirmation process of FIG. 6 will be specifically explained using FIG. 7. When the process proceeds to the system monitoring process of S112, as shown in FIG. 7, in S161, it is determined whether the distance to the other vehicle is normal. The distance to the other vehicle can be detected based on the detection results of other vehicles around the vehicle by each of the cameras 2-5 and each of the radar devices 11-14. It can also be detected based on the position information of other vehicles and the vehicle's position information obtained via vehicle-to-vehicle communication.

Whether the distance to another vehicle is normal or not may be determined, for example, by setting a distance threshold and judging that the distance to another vehicle is normal if it is equal to or greater than that threshold. In this case, the threshold may be set individually depending on the position of the other vehicle relative to the vehicle (for example, whether it is in front of, behind, or to the side of the vehicle). Of course, whether the distance to another vehicle is normal or not may be determined in a manner other than the above example.

If the distance to the other vehicle is not normal (S161: NO), proceed to S169. If the distance to the other vehicle is not normal, the risk of a collision with the other vehicle increases. This may be caused by the automatic control function not working properly. Therefore, if the distance to the other vehicle is not normal, it is determined in S169 that a cancellation-requiring event has occurred in order to forcibly cancel automatic driving and leave driving operation of vehicle 1 to the driver himself. In other words, an abnormal distance to the other vehicle is one of the cancellation-requiring events.

If the distance to the other vehicle is normal (S161: YES), in S162, it is determined whether the relative speed to the other vehicle is normal. As with the distance to the other vehicle, the relative speed to the other vehicle can be detected based on the detection results of other vehicles around the vehicle by each of the cameras 2-5 and each of the radar devices 11-14.

Whether the relative speed with respect to another vehicle is normal or not may be determined, for example, by setting a threshold value for the relative speed, and judging that the relative speed with respect to another vehicle is normal if it is equal to or less than that threshold. In this case, the threshold value may be set individually depending on the position of the other vehicle relative to the vehicle (for example, whether it is in front of, behind, or to the side of the vehicle). Of course, whether the relative speed with respect to another vehicle is normal or not may be determined by a method other than the above example.

If the relative speed with respect to the other vehicle is not normal (S162: NO), proceed to S169. If the relative speed with respect to the other vehicle is not normal, there is a possibility of a collision with the other vehicle. It may also be that the vehicle is not following the flow of traffic around it. One possible cause for this is that the automatic control function is not operating normally. Therefore, if the relative speed with respect to the other vehicle is not normal, it is determined in S169 that an event requiring cancellation has occurred in order to forcibly cancel automatic driving and leave driving operation of vehicle 1 to the driver himself. In other words, an abnormal relative speed with respect to the other vehicle is one type of event requiring cancellation.

If the relative speed with respect to the other vehicle is normal (S162: YES), in S163, it is determined whether the suspension behavior is normal. The suspension behavior can be detected based on the detection results of the suspension sensor 25.

To determine whether the suspension behavior is normal, for example, a threshold value may be set for the amount of expansion/contraction of the suspension, and if the amount of expansion/contraction is equal to or less than the threshold, the suspension behavior may be determined to be normal. Alternatively, a threshold value may be set for the rate of change of the amount of expansion/contraction, and if the rate of change of the amount of expansion/contraction is equal to or less than the threshold, the suspension behavior may be determined to be normal. If multiple suspension sensors 25 are provided, the overall determination may be made based on the detection results from the multiple suspension sensors 25, and may be determined as appropriate. For example, if the amount of expansion/contraction of any one of the multiple suspension sensors 25 exceeds a threshold, the suspension behavior may be determined to be abnormal.

If the suspension behavior is not normal (S163: NO), proceed to S169. If the suspension behavior is not normal, it is possible that the automatic control function is not operating normally. In other words, if the automatic control function is not operating normally, unstable behavior such as sudden starts, sudden stops, and sharp turns may occur, which may cause the suspension to expand and contract significantly. Therefore, if the suspension behavior is not normal, it is determined in S169 that a cancellation-required event has occurred in order to forcibly cancel automatic driving and leave driving operation of vehicle 1 to the driver himself. In other words, abnormal suspension behavior is one of the cancellation-required events.

If the suspension behavior is normal (S163: YES), in S164, it is determined whether the engine room is normal. Specifically, it is determined whether the condition inside the engine room is such that the temperature inside the engine room is normal and no abnormal noise is occurring. The temperature inside the engine room can be detected based on the detection result of the engine room temperature sensor 22, and the sound generated from the engine room can be detected based on the detection result of the engine room sound sensor 23.

Whether the engine room is normal or not may be determined, for example, by setting a temperature threshold for the temperature in the engine room and a volume threshold for the sound in the engine room, and determining that the engine room is normal if the temperature in the engine room is below the temperature threshold and the sound in the engine room is below the volume threshold. The sound quality of the engine room sound may be analyzed, and if sound quality equivalent to that which may occur when an abnormality occurs is detected, the engine room may be determined to be abnormal.

If the engine room is not normal (S164: NO), proceed to S169. If the engine room is not normal, it is possible that the automatic control function is not working properly. That is, if the automatic control function is not working properly, the automatic driving control device 30 is unable to control the driving control unit 46 properly, which may result in the driving control unit 46 being unable to control the engine, transmission, etc. properly. Therefore, if the engine room is not normal, it is determined in S169 that a cancellation-requiring event has occurred in order to forcibly cancel the automatic driving and leave driving operation of the vehicle 1 to the driver himself. In other words, an engine room that is not normal is one of the cancellation-requiring events.

If the engine room is normal (S164: YES), in S165 it is determined whether or not an abnormal current is occurring. Abnormal current here refers to the above-mentioned overcurrent (for example, an excessive current that can occur during a lightning strike). The determination of whether or not an abnormal current is occurring can be made based on the detection result of the current sensor 19. For example, a threshold value may be set for the current to be detected, and if the detected current is equal to or greater than this threshold, it may be determined that an abnormal current has occurred.

If an abnormal current is occurring (S165: YES), proceed to S169. If an abnormal current is occurring, the automatic control function may not operate normally due to the abnormal current. Therefore, if an abnormal current occurs, it is determined in S169 that a deactivation event has occurred in order to forcibly deactivate automatic driving and leave driving operation of the vehicle 1 to the driver himself. In other words, the occurrence of an abnormal current due to various factors such as a lightning strike is one type of deactivation event.

If no abnormal current is occurring (S165: NO), in S166, it is determined whether or not a tire has been punctured. Whether or not a tire has been punctured can be detected based on the detection result of the tire pressure sensor 24.

To determine whether a tire has a puncture, for example, a threshold value may be set for the air pressure, and if the air pressure of any one of the four tires is below the threshold value, it may be determined that a puncture has occurred.

If a flat tire has occurred (S166: YES), the process proceeds to S169. If a flat tire has occurred, the flat tire may cause the automatic control function to be unable to control the vehicle 1 normally. Therefore, if a flat tire has occurred, a determination is made in S169 that a cancellation-requiring event has occurred in order to forcibly cancel the automatic driving and leave driving operation of the vehicle 1 to the driver himself. In other words, a flat tire is one of the cancellation-requiring events.

If no tire puncture has occurred (S166: NO), in S167, it is determined whether or not slippage has occurred. Whether or not slippage has occurred can be detected based on the detection results of the wheel speed sensors 18 of each wheel. For example, the detection results of each wheel speed sensor 18 may be compared, and if the difference between the highest and lowest wheel speeds is equal to or greater than a predetermined threshold value, it may be determined that slippage has occurred.

If slippage occurs (S167: YES), proceed to S169. If slippage occurs, there is a possibility that the automatic control function will not be able to control vehicle 1 normally due to the slippage. Therefore, if slippage occurs, in order to forcibly cancel automatic driving and leave driving operation of vehicle 1 to the driver himself, it is determined in S169 that a cancellation-requiring event has occurred. In other words, the occurrence of slippage is one of the cancellation-requiring events.

If slippage is not occurring (S167: NO), in S168, it is determined whether the steering state is normal. The steering state can be detected based on the detection result of the steering amount sensor 20. For example, a threshold value may be set for the steering amount based on the neutral position, and the steering state may be determined to be normal if the steering amount from the neutral position is equal to or less than the threshold. Also, for example, a threshold value may be set for the rate of change in the steering amount, and the steering state may be determined to be normal if the rate of change in the steering amount is equal to or less than the threshold.

If the steering state is not normal (S163: NO), proceed to S169. If the steering state is not normal, it is possible that the automatic control function is not working properly. Therefore, if the steering state is not normal, it is determined in S169 that a cancellation-requiring event has occurred in order to forcibly cancel automatic driving and leave driving operation of the vehicle 1 to the driver himself. In other words, an abnormal steering state is one of the cancellation-requiring events.

If the steering state is normal (S168: YES), the system monitoring process in FIG. 7 (i.e., the process of S112 in FIG. 6) ends.
Next, the interior/exterior behavior monitoring process of S113 in the autonomous driving cancellation confirmation process of Fig. 6 will be specifically described with reference to Fig. 8. When the process proceeds to the interior/exterior behavior monitoring process of S113, as shown in Fig. 8, it is determined in S201 whether or not contact with a specific contact part in the vehicle interior by an occupant of the vehicle 1 has been detected. The presence or absence of contact with the specific contact part in the vehicle interior can be determined based on the detection result of the interior contact sensor 21.

If contact with a specific contact area inside the vehicle is detected (S201: YES), proceed to S210. The instruction manual for the vehicle 1 of this embodiment explains that if the driver feels that there is something abnormal or uneasy about the operation state of the automatic control function, the driver can forcibly cancel the automatic driving by touching a specific contact area inside the vehicle or by operating the emergency stop lever 43. Therefore, the detection of contact with a specific contact area inside the vehicle can be judged to mean that an occupant of the vehicle 1 has expressed an intention to forcibly cancel the automatic driving.

Therefore, if contact with a specific contact part inside the vehicle is detected, it is determined in S210 that a cancellation-requiring event has occurred in order to forcibly cancel the automated driving and leave driving operation of the vehicle 1 to the driver himself/herself. In other words, the detection of contact with a specific contact part inside the vehicle is one of the cancellation-requiring events.

If no contact with a specific contact area inside the vehicle is detected (S201: NO), in S202, it is determined whether the emergency stop lever 43 has been operated. If the emergency stop lever 43 has been operated (S202: YES), the process proceeds to S210. When the emergency stop lever 43 has been operated, it can be determined that an occupant of the vehicle 1 has expressed an intention to forcibly cancel the automatic driving.

Therefore, when the emergency stop lever 43 is operated, it is determined in S210 that a cancellation-requiring event has occurred in order to forcibly cancel the automated driving and leave driving operation of the vehicle 1 to the driver himself. In other words, the operation of the emergency stop lever 43 is one of the cancellation-requiring events.

If the emergency stop lever 43 has not been operated (S202: NO), in S203, it is determined whether or not an external impact has been detected. As described above, an external impact here includes a large impact such as a collision with another vehicle, and a small impact such as an external person such as a pedestrian hitting the vehicle 1.

The presence or absence of an external impact can be determined based on the detection result of the impact sensor 27. When an external impact is detected (S203: YES), the process proceeds to S210. The detection of an external impact may mean that damage has occurred to the vehicle 1, making it impossible for the vehicle 1 to run normally. In addition, it is possible that an automatic control function of the vehicle 1 has stopped functioning normally, causing the vehicle 1 to behave abnormally, or that a person outside the vehicle has noticed that something has happened to the driver of the vehicle 1, and so the person outside the vehicle has hit the vehicle 1 to alert the occupants of the vehicle 1.

Therefore, if an external impact is detected, it is determined in S210 that a deactivation event has occurred in order to forcibly deactivate the automated driving and leave driving operation of the vehicle 1 to the driver himself. In other words, the detection of an external impact is one type of deactivation event.

If no external impact is detected (S203: NO), in S204, it is determined whether the driver's behavior is normal. The driver's behavior can be recognized by analyzing the data captured by the interior camera 6. For example, if the driver continues to look away from the vehicle for a certain period of time or more, if the driver's eyes are closed for a certain period of time or more, or if the driver has an expression of surprise, worry, or fear, it can be determined that the driver's behavior is abnormal. Of course, it is also possible to determine whether the driver's behavior is normal or not based on other criteria.

If it is determined that the driver's behavior is not normal (S204: YES), proceed to S210. If it is determined that the driver's behavior is not normal, it may be possible that something unusual has happened to the driver, or that the automatic control function of the vehicle 1 is not working properly, etc.

Therefore, if it is determined that the driver's behavior is not normal, the automated driving is forcibly cancelled and the driver is given control over driving the vehicle 1, or in order to bring the vehicle 1 to an emergency stop, it is determined in S210 that a cancellation-requiring event has occurred. In other words, the driver's behavior being determined to be abnormal is one type of cancellation-requiring event.

If the driver's behavior is judged to be normal (S204: NO), in S205 it is judged whether or not the pedestrian is looking at the vehicle. As mentioned above, whether or not the pedestrian is looking at the vehicle can be judged by analyzing the image data from each of the cameras 2 to 5.

If pedestrians are looking at the vehicle (S205: YES), S208 determines whether a predetermined number of pedestrians or more are looking at the vehicle (i.e., whether the vehicle is attracting a lot of attention from pedestrians). If the number of pedestrians looking at the vehicle is less than the predetermined number (i.e., the vehicle is not attracting a lot of attention) (S208: NO), the process proceeds to S209.

In S209, it is determined whether the behavior of a pedestrian who is looking at the vehicle is normal. The criteria for determining whether the behavior of a pedestrian who is looking at the vehicle is normal may be determined as appropriate. For example, if the pedestrian has a specific facial expression or behavior such as surprise, worry, or fear, the pedestrian's behavior may be determined to be abnormal.

If it is determined in S208 that a certain number of pedestrians or more are looking at the vehicle (S208: YES), and if it is determined in S209 that the behavior of the pedestrians looking at the vehicle is not normal (S209: NO), the process proceeds to S210.

The fact that many pedestrians are focusing their gazes on the vehicle itself may indicate that the automatic control function of vehicle 1 is not functioning properly, causing vehicle 1 to behave abnormally, or that something unusual is happening to the driver of vehicle 1. Even if the number of pedestrians looking at the vehicle itself is small, if the pedestrians' behavior is abnormal, it may indicate that the automatic control function of vehicle 1 is not functioning properly, causing vehicle 1 to behave abnormally, or that something unusual is happening to the driver of vehicle 1.

Therefore, if the gazes of many pedestrians are concentrated at the same time, or if the pedestrians who are looking at the vehicle behave abnormally, the system determines in S210 that an event requiring cancellation has occurred, so that the system can either forcibly cancel the automated driving and leave vehicle 1 operation to the driver himself, or perform an emergency stop of vehicle 1. In other words, the gazes of many pedestrians are concentrated at the same time, or the behavior of the pedestrians who are looking at the vehicle are abnormal, both of which are types of events requiring cancellation.

If pedestrians are not looking at the vehicle (S205: NO), or if pedestrians are looking at the vehicle but the number of pedestrians is small and their behavior is normal (S209: YES), the process proceeds to S206.

In S206, it is determined whether or not another vehicle (mainly an oncoming vehicle or a vehicle behind) has flashed its light. Whether or not another vehicle has flashed its light can be determined mainly by analyzing the image data captured by the front camera 2 and the rear camera 3. If another vehicle has flashed its light (S206: YES), the process proceeds to S210.

When another vehicle flashes its light, it is possible that the automatic control function of vehicle 1 has stopped working properly, causing vehicle 1 to behave abnormally, and that the driver of the other vehicle has noticed this abnormal behavior and alerted the driver. Therefore, when another vehicle flashes its light, it is determined in S210 that an event requiring deactivation has occurred, so that the automatic driving can be forcibly deactivated and vehicle 1 can be left in the driver's hands, or vehicle 1 can be brought to an emergency stop. In other words, being flashed by another vehicle is one type of event requiring deactivation.

If the other vehicle has not honked its horn (S206: NO), the process proceeds to S207 to determine whether the other vehicle has honked its horn. Whether the other vehicle has honked its horn can be determined mainly based on the detection results of the external sound sensor 26. If the other vehicle has honked its horn (S207: YES), the process proceeds to S210.

When another vehicle honks its horn, it is possible that the automatic control function of vehicle 1 has stopped working properly, causing vehicle 1 to behave abnormally, and that the driver of the other vehicle has noticed this abnormal behavior and alerted the driver. Therefore, when another vehicle honks its horn, it is determined in S210 that an event requiring deactivation has occurred, so that the automatic driving is forcibly deactivated and vehicle 1 is left to the driver to drive, or vehicle 1 is brought to an emergency stop. In other words, when another vehicle honks its horn, this is one type of event requiring deactivation.

Next, the environmental monitoring process of S114 in the automatic driving cancellation confirmation process of FIG. 6 will be specifically described with reference to FIG. 9. When proceeding to the environmental monitoring process of S114, as shown in FIG. 9, in S251, it is determined whether the weather around the vehicle 1 is in a heavy rain state. The heavy rain state can be determined based on the detection signal from the rainfall sensor 17, for example, by setting a threshold value for the amount of detection and comparing it with the threshold value. Of course, heavy rain state may be determined by other methods. For example, the amount of rain may be analyzed from the image data captured by each of the cameras 2 to 5 to determine the heavy rain state.

If it is determined that the rain is heavy (S251: YES), the process proceeds to S256. If it is not determined that the rain is heavy (S251: NO), the process proceeds to S252.
In S252, it is determined whether or not the weather around the vehicle 1 is in a heavy snow condition. The determination of whether or not the weather is in a heavy snow condition may be made, for example, by analyzing the amount of snowfall from the photographic data of each of the cameras 2 to 5. Of course, the determination of whether or not the weather is in a heavy snow condition may be made by other methods.

If it is determined that the snow is heavy (S252: YES), the process proceeds to S256. If it is not determined that the snow is heavy (S252: NO), the process proceeds to S253.
In S253, it is determined whether or not the area around the vehicle 1 is in a dense fog state. The determination of whether or not the area is in a dense fog state may be performed in the same manner as the method of determining whether or not the area is in a heavy snow state, for example, by analyzing the fog generation state from the photographic data of each of the cameras 2 to 5. Of course, the determination of whether or not the area is in a dense fog state may be performed in other ways.

If it is determined that the vehicle is in a dense fog state (S253: YES), the process proceeds to S256. If it is not determined that the vehicle is in a dense fog state (S253: NO), the process proceeds to S254.
When it is determined that the weather is heavy rain, heavy snow, or thick fog (hereinafter collectively referred to as "bad weather"), visibility ahead of the vehicle is poor, and the automatic control function may not operate normally. Therefore, in the case of bad weather, it is determined in S256 that a cancellation event has occurred in order to forcibly cancel the automatic driving and leave driving operation of the vehicle 1 to the driver himself. In other words, bad weather is one of the cancellation events.

In S254, it is determined whether the vehicle 1 is traveling through a caution section. In this embodiment, caution sections include at least accident-prone areas, school zones, areas where animals are likely to appear, etc., as described above. The determination of whether the vehicle 1 is traveling through a caution section can be made based on section information obtained via road-to-vehicle communication. Alternatively, if the image data captured by the front camera 2 includes signs or road signs indicating the caution section, the determination can also be made based on that.

If it is determined that vehicle 1 is traveling in a caution section (S254: YES), proceed to S256. When vehicle 1 is traveling in a caution section, it may be preferable for the driver to pay attention to the direction of travel and perform driving operations himself/herself, rather than relying on the automatic control function. Therefore, when vehicle 1 is traveling in a caution section, it is determined in S256 that an event requiring cancellation has occurred in order to forcibly cancel automatic driving and leave driving operations of vehicle 1 to the driver himself/herself. In other words, vehicle 1 traveling in a caution section is one type of event requiring cancellation.

If vehicle 1 is not traveling in a caution section (S254: NO), proceed to S255. In S255, it is determined whether the average autonomous driving level of other surrounding vehicles (hereinafter referred to as the "surrounding average level") is below a predetermined level (e.g., level 1 or lower). If the surrounding average level is higher than the predetermined level (S255: NO), the environment monitoring process is terminated. On the other hand, if the surrounding average level is below the predetermined level (S255: YES), proceed to S256.

The surrounding average level can be derived by acquiring the autonomous driving level set for each of the other vehicles traveling around the vehicle and calculating the average of each acquired autonomous driving level. The autonomous driving levels of other vehicles around the vehicle can be acquired directly through vehicle-to-vehicle communication, or indirectly through road-to-vehicle communication.

When the surrounding average level is below a specified level, it means that many of the other surrounding vehicles are keeping their autonomous driving level low. This means that it is highly likely that the drivers of many of the other vehicles are driving through their own operations without relying on the automatic control function. If many of the surrounding drivers are driving without relying on the automatic control function, it is likely that the area in which you are currently traveling is one in which, for some reason, it is preferable for the driver to drive through their own operations rather than through the automatic driving function.

Therefore, when the surrounding average level is equal to or lower than a predetermined level, it is determined in S256 that an event requiring cancellation has occurred in order to forcibly cancel the automated driving and leave the driver to drive the vehicle 1. In other words, the surrounding average level being equal to or lower than a predetermined level is one of the events requiring cancellation.

Next, we will explain the self-diagnosis process of S115 in the automatic driving cancellation confirmation process in Figure 6. However, before explaining the self-diagnosis process, we will first explain the driving history recording process shown in Figure 10A.

The driving history recording process in FIG. 10A is a process for storing various specific control operations (however, control operations that are performed automatically by the automatic control function) performed while the vehicle 1 is driving as history, linked to the location where the specific control operation was performed. The type and number of specific control operations to be stored as history may be determined appropriately. For example, an operation of temporarily stopping while driving, an operation of decelerating even when there are no other vehicles ahead, etc. may be determined as specific control operations.

If the automatic control function is working properly, vehicle 1 should automatically stop where there is a stop road sign or stop line. It should also slow down for safety before a pedestrian crossing even if there is no vehicle ahead. On the other hand, if the automatic control function is not working properly, the vehicle may pass through a stop road sign without stopping, or pass through a pedestrian crossing without slowing down. In other words, if the automatic control function is not working properly, the vehicle may drive differently than before, even when driving through the same place it has driven through before.

In this embodiment, the past driving history is linked to the location and stored, and the next time the vehicle travels through the same place, it is compared with the past operating conditions. If the vehicle performs driving operations differently from the past (for example, the vehicle stopped temporarily in the past but simply passed through this time), it is determined that the automatic control function is not working properly and that automatic driving should be canceled.

When the control unit 30a starts operation, it executes the driving history recording process of FIG. 10A in parallel with the autonomous driving level setting process of FIG. 5. When the control unit 30a starts the driving history recording process of FIG. 10A, it determines in S301 whether the vehicle 1 has traveled a certain distance. It continues the determination in S301 until the certain distance has been traveled. If the certain distance has been traveled (S301: YES), it proceeds to S302.

In S302, the specific control operation performed in the driving section of the fixed distance is stored as specific control information together with the position information where the specific control operation was performed. If a specific control operation at the same position has already been stored, the stored content is updated. After storing the specific control information performed in the driving section of the fixed distance, the process returns to S301. In this way, each time a fixed distance is traveled, the specific control information storage process is performed for the driving section of the fixed distance.

Next, the self-diagnosis process of S115 in FIG. 6 will be described with reference to FIG. 10B. When the self-diagnosis process of S115 is started, as shown in FIG. 10B, in S351, it is determined whether the current traveling position is a position that has been traveled in the past. This determination can be made by comparing the current position based on GPS information with the position information linked to the specific control information stored in memory 30b.

If the current driving position is not linked to any of the specific control information stored in memory 30b, the current driving position is deemed to have not been traveled to in the past (S351: NO), and the self-diagnosis process ends. If the current driving position matches or is close to position information linked to any of the specific control information stored in memory 30b, the current driving position is deemed to have been traveled to in the past (S351: YES), and the process proceeds to S352.

In S352, past specific control information corresponding to the current driving position is read from memory 30b. In other words, it is confirmed whether or not any specific control operation has been performed in the past at the current driving location. In S353, it is determined whether or not the current driving state is different from the past. More specifically, it is determined whether or not a specific control operation that was performed in the past at the same location has been performed this time. If the driving state is different from the past, that is, if a specific control operation that was performed in the past at the same location was not performed this time (S353: YES), proceed to S354 and determine that a release-required event has occurred. If the driving state is not different from the past, that is, if a specific control operation that was performed in the past at the same location was performed this time (S353: NO), the self-diagnosis process ends.

(5) Effects of the First Embodiment According to the vehicle 1 of the present embodiment described above, when the autonomous driving level is level 1 or higher (i.e., when the automatic control function is operating), it is determined whether or not a cancellation event that requires cancellation of the autonomous driving has occurred (S112 to S115 in FIG. 6). If a cancellation event occurs, the autonomous driving level is forcibly set to level 0. In other words, if a cancellation event occurs, regardless of the setting state of the driving mode, the operation of all automatic control functions is stopped and driving operation of the vehicle 1 is left to the driver.

Therefore, if an event requiring release occurs, the driver can drive the vehicle 1 by operating the vehicle himself. This makes it possible to prevent unstable operation of the vehicle 1 caused by malfunction of the automatic control function, etc.

In addition, in this embodiment, a large number of events are assumed that may be considered as events requiring release, and a determination is made for each event one by one.
Specifically, as shown in S161 of Fig. 7, the distance to another vehicle is judged, and if the distance to the other vehicle is not normal, the automatic driving is forcibly cancelled. Therefore, even if the vehicle 1 is about to collide with another vehicle due to a malfunction of the automatic control function, the driver can avoid this by operating the vehicle himself.

Also, as shown in S162 of FIG. 7, the relative speed with other vehicles is judged, and if the relative speed with other vehicles is not normal, automatic driving is forcibly cancelled. Therefore, even if vehicle 1 is on the verge of colliding with another vehicle due to a malfunction of the automatic control function or the like, this can be avoided by the driver's own driving operation. Also, even if the driving speed of vehicle 1 is different from the speed of many surrounding vehicles due to a malfunction of the automatic control function or the like, and is not following the flow of surrounding traffic, this can be avoided by the driver's own driving operation.

In addition, as shown in S163 of FIG. 7, the behavior of the suspension is judged, and if the behavior is not normal, the automatic driving is forcibly cancelled. Therefore, even if the vehicle 1 starts to exhibit abnormal behavior due to a malfunction of the automatic control function, etc., it is possible for the driver to avoid this by operating the vehicle himself.

Also, as shown in S164 of FIG. 7, the condition of the engine room (temperature and sound) is judged, and if it is not normal, the automatic driving is forcibly cancelled. Therefore, if an abnormality occurs in the engine room due to a malfunction of the automatic control function, the driver can minimize the impact by operating the vehicle himself.

7, the automatic driving is forcibly cancelled when an abnormal current is generated in the electric wiring in the vehicle 1 (however, in the electric wiring where the current sensor 19 is provided), so that even if an excessive current flows due to a lightning strike or the like, it is possible to prevent the automatic control function from malfunctioning and the running state of the vehicle 1 from becoming unstable.

In addition, as shown in S166 and S167 of FIG. 7, if a tire goes flat or a slip occurs, the automatic driving is forcibly cancelled. Therefore, if the reliability of driving under the automatic control function is reduced due to a tire going flat or a slip, the driver can operate the vehicle 1 appropriately by his/her own driving operation (for example, slowly decelerate to a stop, or smoothly recover from a slip state).

In addition, as shown in S168 of FIG. 7, if the steering state of the steering wheels is not normal, the automatic driving is forcibly cancelled. Therefore, even if the steering wheels of the vehicle 1 start to exhibit abnormal behaviour due to a malfunction of the automatic control function, etc., the driver can avoid this by operating the vehicle himself.

As shown in S201 and S202 of FIG. 8, when contact with a specific contact part inside the vehicle by an occupant is detected, or when an emergency stop lever is operated by an occupant, the autonomous driving is forcibly cancelled. Therefore, when a situation arises in which the autonomous driving should be cancelled, such as when the behavior of the vehicle 1 becomes unstable, the driver can quickly cancel the autonomous driving of his/her own will.

In addition, as shown in S203 of FIG. 8, if an external impact is detected, the automatic driving is forcibly cancelled. Therefore, even if there is a risk that the automatic control function will not operate normally due to an external impact, the driver can operate the vehicle 1 appropriately through his/her own driving operations.

In addition, as shown in S204 of FIG. 8, if the driver's behavior is not normal (for example, if the driver has a look of surprise or fear), the automatic driving is forcibly cancelled. Therefore, even if the driving state of the vehicle 1 becomes unstable to the extent that the driver shows a look of surprise or fear due to a malfunction of the automatic control function, the driver can quickly avoid this by operating the vehicle himself.

As shown in S205, S206, and S207 of FIG. 8, if a pedestrian attracts the gaze of the vehicle, if a pedestrian looking at the vehicle behaves abnormally (for example, pointing at the vehicle with a surprised expression), or if another vehicle honks the horn or flashes its lights, the automatic driving is forcibly cancelled. This is because such actions taken by pedestrians or other vehicles against the vehicle may indicate that the vehicle's driving condition is unstable, and a malfunction of the automatic control function may be the cause.

In addition, as shown in S251 to S253 in FIG. 9, the automatic driving is forcibly cancelled in bad weather such as heavy rain, heavy snow, and dense fog. Therefore, even if the automatic control function does not operate normally due to bad weather and the running of the vehicle 1 may become unstable, the automatic driving is forcibly cancelled, so that the driver can drive the vehicle 1 appropriately by operating the vehicle himself.

In addition, as shown in S254 of FIG. 9, when the vehicle 1 is traveling in a caution section, the automatic driving is forcibly cancelled. This allows the driver to drive the vehicle appropriately through the caution section by operating the vehicle himself, without relying on the automatic control function.

10B, when the vehicle travels again in a place where it has traveled before, if a specific control operation that was performed in the past is not performed this time, the automatic control function is deemed not to be operating normally, and the automatic driving is forcibly cancelled. This makes it possible to prevent problems that may occur due to malfunctions of the automatic control function.

In addition, in this embodiment, when an event requiring cancellation occurs, the autonomous driving is not cancelled unconditionally, but the occupant is notified that the autonomous driving is cancelled (S117 in FIG. 6). Then, when it is confirmed that the autonomous driving can be cancelled, such as when there is a predetermined reaction from the occupant (YES in S118 in FIG. 6), the autonomous driving is cancelled. Therefore, the autonomous driving can be cancelled smoothly and appropriately, allowing the driver to take over driving operations.

On the other hand, if the occupant does not respond as required even after being notified that automatic driving is being cancelled (NO in S118), the vehicle 1 is automatically brought to an emergency stop. Therefore, if the driver falls asleep or faints, for example, and it becomes difficult for the driver to drive the vehicle 1, the vehicle 1 can be stopped quickly and appropriately, preventing the occurrence of an unexpected incident.

The control unit 30a corresponds to an example of a surrounding information acquisition unit, a driving mode setting unit, an automatic control unit, a cancellation required event determination unit, a notification unit, and a cancellation permission determination unit. The processes of S40 and S50 in FIG. 5 correspond to an example of a process of the driving mode setting unit. The process of S55 in FIG. 5 corresponds to an example of a process of the surrounding information acquisition unit. The processes of S55 in FIG. 5 and S118 to S120 in FIG. 6 correspond to an example of a process of the automatic control unit. The process of S120 in FIG. 6 corresponds to an example of an automatic stop process among the processes of the automatic control unit. The processes of S112, S113, S114, and S115 in FIG. 6 correspond to an example of a process of the cancellation required event determination unit. The process of S117 in FIG. 6 corresponds to an example of a process of the notification unit, and the process of S118 in FIG. 6 corresponds to an example of a process of the cancellation permission determination unit.

[Second embodiment]
The electrical configuration of the vehicle of the second embodiment is shown in Fig. 11. In Fig. 11, the same components as those of the vehicle 1 of the first embodiment are denoted by the same reference numerals as those of the first embodiment, and detailed description thereof will be omitted.

As shown in FIG. 11, the vehicle of the second embodiment includes an automatic driving control device 101 and a monitoring device 102. Except for the automatic driving control device 101 having a function for performing data communication with the monitoring device 102 via a network 100, the automatic driving control device 101 has basically the same configuration as the automatic driving control device 101 of the first embodiment and operates in the same manner. That is, the control unit 101a of the automatic driving control device 101 executes the automatic driving level setting process (see FIG. 5) in accordance with various programs stored in the memory 101b, similar to the vehicle 1 of the first embodiment. It also executes an automatic control function based on the set automatic driving level.

In FIG. 11, the cameras 2-6, the radar devices 11-14, and the sensors 16-27 in the vehicle 1 of the first embodiment shown in FIG. 2 are collectively illustrated as a detection means group 111. Also, in FIG. 11, the communication units 31-35 in the vehicle 1 of the first embodiment shown in FIG. 2 are collectively illustrated as a communication means group 112.

The autonomous driving control device 101 of this embodiment further transmits the execution state of the automatic control function corresponding to the autonomous driving level (the result of the control calculation) as one piece of control information to the monitoring device 102 via the network 100 periodically. In addition, if a cancellation event occurs as a result of the autonomous driving level setting process, the autonomous driving control device 101 transmits at least that fact (the fact that a cancellation event has occurred) as one piece of control information to the monitoring device 102 via the network 100 periodically.

The monitoring device 102 is provided to monitor whether various controls by the automatic driving control device 101 are operating normally. That is, the monitoring device 102 basically has the same configuration as the automatic driving control device 101, and like the automatic driving control device 101, the control unit 102a executes control calculations for the automatic control functions based on the set automatic driving level.

In other words, the monitoring device 102 does not actually execute the automatic control function, but performs the control calculations for the automatic control function in the same manner as the automatic driving control device 101. In other words, both the automatic driving control device 101 and the monitoring device 102 execute the control calculations necessary to realize the automatic control function according to the set automatic driving level.

Therefore, assuming that the monitoring device is operating normally, and if the automatic driving control device 101 is normal, the results of the control calculations of both should be the same. On the other hand, if an abnormality occurs in the automatic driving control device 101 and the automatic control function does not operate normally, the results of the control calculations of both may be different (the calculation result of the automatic driving control device 101 may be abnormal).

Therefore, the monitoring device 102 compares its own control calculation result with the control calculation result by the automatic driving control device 101, and if the two do not match, it forcibly cancels the automatic control function by the automatic driving control device 101. Specifically, the control unit 102a of the monitoring device 102 executes the control state monitoring process shown in FIG. 12.

When the control unit 102a of the monitoring device 102 starts the control state monitoring process of FIG. 12, in S501, it executes a calculation process of the automatic control function corresponding to the set automatic driving level. In S502, it acquires the calculation result of the control calculation of the automatic control function in the automatic driving control device 101 from the automatic driving control device 101 via the network 100.

In S503, the result of the calculation performed by the automatic driving control device 101 in S501 is compared with the result of the calculation performed by the automatic driving control device 101 in S502 to determine whether or not the two match. If the two do not match (S503: NO), it is determined that the result of the calculation performed by the automatic driving control device 101 is not normal, and in S508, a forced release process is executed to forcibly release the automatic control function performed by the automatic driving control device 101.

There are various possible specifics for the forced release process of S508. For example, the monitoring device 102 may instruct the travel drive control unit 46, the brake control unit 47, and the steering control unit 48 to ignore control commands from the automatic driving control device 101, so that each of these control units 46 to 48 operates independently of the automatic driving control device 101 (i.e., automatic driving is released).

For example, the automatic driving control device 101 may be forced to cancel automatic driving by transmitting, via the network 100, determination information indicating that the calculation results do not match.

In addition, for example, switches for connecting and disconnecting the electrical connection between the automatic driving control device 101 and the driving control unit 46, between the automatic driving control device 101 and the brake control unit 47, and between the automatic driving control device 101 and the steering control unit 48 may be provided. Then, by turning off at least one of the switches (i.e., disconnecting the electrical connection), it may be possible to prevent control from the automatic driving control device 101.

In addition, one possible reason why the calculation results by the automatic driving control device 101 are not normal is that the automatic driving control device 101 is being illegally accessed from outside. For this reason, a switch for connecting/disconnecting the electrical connection between the communication means group 112 and the automatic driving control device 101 may be provided between the communication means group 112 and the automatic driving control device 101, and by turning off this switch (i.e., disconnecting the electrical connection), physical access from outside may be prevented.

If the calculation results match in S503 (S503: YES), then in S504 it is determined whether or not a cancellation-requiring event has occurred. Specifically, the occurrence of a cancellation-requiring event is determined by performing processes identical to those in S112 to S115 in the automatic driving cancellation confirmation process of the first embodiment shown in FIG. 6.

In S505, it is determined whether or not a cancellation-requiring event has occurred based on the determination result in S504. If a cancellation-requiring event has not occurred (S505: NO), the control state monitoring process is terminated. If a cancellation-requiring event has occurred (S505: YES), in S506, the determination result of the presence or absence of a cancellation-requiring event in the automatic driving control device 101 is obtained from the automatic driving control device 101 via the network 100.

In S507, based on the result obtained in S506, it is determined whether or not the automatic driving control device 101 has also determined that a cancellation-requiring event has occurred. If the automatic driving control device 101 has also determined that a cancellation-requiring event has occurred, it is determined that the automatic driving control device 101 is operating normally, and the control state monitoring process is terminated. On the other hand, if the automatic driving control device 101 has not determined that a cancellation-requiring event has occurred, it is determined that the automatic driving control device 101 is not operating normally for some reason, and the process proceeds to S508, where the forced release process is executed as described above.

The vehicle of the second embodiment described above provides the following effects in addition to the effects of the first embodiment. That is, in the second embodiment, a monitoring device 102 is provided in addition to the automatic driving control device 101. The monitoring device 102 also performs control calculations similar to those of the automatic driving control device 101, and compares the calculation results with those of the automatic driving control device 101, and determines whether the automatic driving control device 101 is operating normally depending on whether the two match.

In other words, two independent computers are made to execute the same control calculations, and by checking whether the results of the two calculations match, it is possible to determine whether the operation of one of the computers (here the automatic driving control device 101) is normal or not.

If the two calculation results do not match, the monitoring device 102 executes a forced cancellation process (S508 in FIG. 12) to forcibly cancel the autonomous driving. Note that, like the first embodiment, the autonomous driving control device 101 cancels the autonomous driving itself when a cancellation event occurs. In the second embodiment, the monitoring device 102 also performs a forced cancellation process to cancel the autonomous driving. Therefore, when a situation arises in which autonomous driving should be cancelled, it is possible to more reliably cancel the autonomous driving.

[Other embodiments]
Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above embodiments and may take various forms.

(1) The specific examples of events requiring cancellation shown in each of the above embodiments are merely examples. It is also possible to determine whether other events that are considered to require cancellation of autonomous driving have occurred, and to cancel autonomous driving if they have occurred.

For example, in the first embodiment, an example was shown in which autonomous driving was cancelled when the driver behaved abnormally, but autonomous driving may also be cancelled based on the behaviour of passengers other than the driver.

In addition, the system may be configured to determine whether or not autonomous driving should be deactivated based on what the occupants (including the driver) say, rather than on their behavior. For example, if someone says, "There's an ambulance coming up behind me!", the system may deactivate autonomous driving and leave driving to the driver. In other words, the system may be configured to deactivate autonomous driving in response to specific words or sentences.

The infrastructure may also monitor the vehicle's driving condition, and if the driving condition is unstable (i.e., if there is a possibility that the automatic control function is not operating normally), notify the vehicle of this via road-to-vehicle communication or the like. Then, if the vehicle receives the notification from the infrastructure, it may forcibly cancel the automatic driving.

(2) In the above embodiment, the autonomous driving level is forcibly set to level 0 if any deactivation event occurs when the autonomous driving level is level 1 or higher. However, the autonomous driving level may be set to 0 if an event requiring deactivation occurs when the autonomous driving level is equal to or higher than a predetermined level n that is higher than level 1 (i.e., ignored if the level is less than n). Alternatively, if an event requiring deactivation occurs when the driving mode is in the highly automated mode, the autonomous driving level may be forcibly set to level 0, and if the driving mode is in the basic mode, the basic mode setting may be maintained even if an event requiring deactivation occurs.

In addition, it is not necessary to set the autonomous driving level to level 0 when a deactivation event occurs, and the autonomous driving level may be lowered to at least a level lower than the current autonomous driving level. For example, if a deactivation event occurs while in the highly automated mode, the mode may be switched to the basic mode.

(3) The cameras and radar devices necessary to realize autonomous driving may be installed anywhere in the vehicle 1, and any number of them may be installed. The installation locations and number of cameras and radar devices may be determined appropriately so as to realize the desired automatic control function. In addition, the on-board equipment necessary to realize autonomous driving is not limited to the various equipment shown in Figures 1 and 2.

(4) In addition, the function of one component in the above embodiments may be distributed among multiple components, or the functions of multiple components may be integrated into one component. At least a part of the configuration of the above embodiments may be replaced with a known configuration having a similar function. A part of the configuration of the above embodiments may be omitted. At least a part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments. Any aspect included in the technical idea identified only by the wording described in the claims is an embodiment of the present disclosure.

[Technical Concepts Graspable from the Embodiments]
At least the following technical ideas can be understood from the various embodiments described above in detail.
(A) An automatic driving control device mounted on a vehicle,
a surrounding information acquisition unit that acquires surrounding information that is information about the surroundings of the vehicle;
A driving mode setting unit sets a driving mode of the vehicle to either a highly automated mode in which at least a part of a plurality of types of driving operations required for driving the vehicle is automatically executed based on the surrounding information, or a basic mode in which the types of automatic driving operations, which are the driving operations to be automatically executed, are fewer than those in the highly automated mode or are zero;
an automatic control unit that executes the automatic driving operation set in the driving mode based on the driving mode set by the driving mode setting unit;
a cancellation-required event determination unit that, when the driving mode is set to a driving mode having at least one of the automatic driving operations to be executed, determines whether or not a predetermined cancellation-required event has occurred that requires cancellation of at least one of the automatic driving operations set in the driving mode;
Equipped with
When the operation mode is set to an operation mode having at least one of the automatic operation operations to be executed, if the cancellation-required event determination unit determines that the cancellation-required event has occurred, the automatic control unit stops the execution of at least one of the set automatic operation operations.
Automatic driving control device.

In the automatic driving control device configured as above, when the driving mode is set to the highly automated mode, the cancellation event determination unit not only determines whether or not a cancellation event has occurred, but also when the driving mode is set to the basic mode, if the basic mode is set to execute at least one of multiple types of automatic driving operations, the cancellation event determination unit determines whether or not a cancellation event has occurred.

In other words, regardless of the type of operation mode that is set, if any one of multiple types of automatic driving operations is set to be executed, the cancellation required event determination unit determines whether a cancellation required event has occurred. Then, if it is determined that a cancellation required event has occurred, at least one of the automatic driving operations to be executed is stopped.

An event requiring deactivation is an event that may occur because the currently running autonomous driving operation is not being performed normally, or an event in which the autonomous driving operation is currently being performed normally but the occurrence of the event may cause a disruption to the execution of the autonomous driving operation.

One or more cancellation-requiring events may be set in advance. When multiple cancellation-requiring events are set, the cancellation-requiring event determination unit may determine whether or not each of the multiple cancellation-requiring events has occurred, or may determine whether or not some of the multiple cancellation-requiring events have occurred. In the latter case, it may be determined as appropriate which of the multiple cancellation-requiring events are to be the subject of determination. For example, at least one of a cancellation-requiring event that occurs when an automatic driving operation that is set to be executed in the current driving mode is no longer executed normally, and a cancellation-requiring event that may interfere with the automatic driving operation may be included in the determination target.

In addition, the timing at which the release-required event determination unit determines whether or not a release-required event has occurred may be determined as appropriate, other than the above. For example, depending on the number and type of automatic driving operations set to be executed in the current driving mode, it may be determined whether or not the release-required event determination unit should determine whether or not a release-required event has occurred, and if so, at what specific timing the determination should be made.
(B) In the above (A),
The automatic driving control device is set such that the event requiring deactivation is at least one of the following operating states: at least one operating state that may occur when the automatic driving operation set as the target for execution may not be executed normally; and at least one operating state in which the automatic driving operation set as the target for execution may not be executed normally.

In this way, by appropriately setting the vehicle's operating state in which the autonomous driving operation is not being performed normally (or may not be performed normally) as an event that requires cancellation, it is possible to appropriately determine whether or not the autonomous driving operation currently being performed should be stopped.
(C) In the above (A) or (B),
An automatic driving control device in which the event requiring deactivation is set to at least one of the following: an occupant of the vehicle exhibiting a specific first behavior, a person around the vehicle exhibiting a specific second behavior, and another vehicle around the vehicle performing a specific third action.

If an ongoing autonomous driving operation is no longer performed normally, the effect is reflected in the operating state of the vehicle, which may cause the vehicle occupants to exhibit specific behaviors (e.g., expressions of surprise or anxiety), people around the vehicle to exhibit specific behaviors (e.g., many people focusing their gazes on the vehicle or pointing their fingers at it), or other vehicles (more specifically, occupants of other vehicles) to perform specific actions toward the vehicle (e.g., honking the horn or flashing their lights). Therefore, by setting at least one of the first behavior, the second behavior, and the third behavior as a cancellation-requiring event, it is possible to appropriately determine whether or not the ongoing autonomous driving operation should be stopped.
(D) In any one of (A) to (C) above,
An automatic driving control device, wherein the event requiring cancellation is set to be a specific environment set in advance around the vehicle.

A specific environment refers to an environment in which the autonomous driving operation currently being performed may not be performed normally, or an environment in which one or more specific autonomous driving operations should not be performed. Examples of this include bad weather such as heavy rain or thick fog. Another example would be when the vehicle is traveling in an area where it is considered preferable to leave driving operations to the driver's own discretion rather than autonomous driving, such as a school zone or an area with a high incidence of accidents.

By setting the presence of a vehicle in such a specific environment as an event requiring deactivation, it is possible to appropriately determine whether or not the autonomous driving operation currently being performed should be stopped.

1...vehicle, 2...front camera, 3...rear camera, 4...left side camera, 5...right side camera, 6...interior camera, 9...front window, 10...steering wheel, 11...front radar device, 12...rear radar device, 13...left side radar device, 14...right side radar device, 16...sun radiation sensor, 17...rainfall sensor, 18...wheel speed sensor, 19...current sensor, 20...steering amount sensor, 21...interior contact sensor, 22...engine room temperature sensor, 23...engine room sound sensor, 24...tire pressure sensor, 25...suspension sensor, 26...exterior sound sensor, 27...impact sensor, 30, 101...auto Automatic driving control device, 30a, 101a, 102a...control unit, 30b, 101b, 102b...memory, 31...GPS communication unit, 32...vehicle-to-vehicle communication unit, 33...road-to-vehicle communication unit, 34...pedestrian-to-vehicle communication unit, 35...LTE communication unit, 36...operation unit, 37...display unit, 38...speaker, 41...automatic driving switch, 42...level setting operation unit, 43...emergency stop lever, 44...release reset switch, 46...travel drive control unit, 47...brake control unit, 48...steering control unit, 81...road communication device, 82...camera, 100...network, 102...monitoring device, 111...detection means group, 112...communication means group.

Claims (11)

An automatic driving control device mounted on a vehicle,
A surrounding information acquisition unit configured to acquire surrounding information that is information about the surroundings of the vehicle;
An automatic control unit configured to perform an automatic driving operation that automatically performs a driving operation required for driving the vehicle based on the surrounding information;
A cancellation-required event determination unit configured to determine whether or not a predetermined cancellation-required event has occurred that should cancel at least one of the automatic driving operations;
an information transmission unit that transmits information to a monitoring device via a network when the event requiring release occurs;
a driver state determination unit that determines whether or not the driver is capable of performing the driving operations that have been performed automatically up until that point;
Equipped with
the automatic control unit is configured to execute a predetermined automatic stop process for stopping the traveling of the vehicle when the required-to-cancel event determination unit determines that the required-to-cancel event has occurred and the driver state determination unit determines that the driver is unable to perform the driving operation that had been performed automatically up until that point;
The event requiring release is any one of the following: an abnormal distance between the vehicle and another vehicle, an abnormal relative speed between the vehicle and another vehicle, an abnormal behavior of the suspension of the vehicle, an abnormal condition of the engine room of the vehicle, an abnormal current flowing through the vehicle, a flat tire of the vehicle, the vehicle skidding, an abnormal steering state of the vehicle, contact with a specific contact part inside the vehicle, operation of an emergency stop lever provided in the vehicle, detection of an external impact to the vehicle, the vehicle attracting the gaze of a pedestrian, abnormal behavior of a pedestrian looking at the vehicle, a horn being honked by another vehicle, flashing of the vehicle's lights by another vehicle, bad weather, when the vehicle travels again in a place where it has traveled before, the vehicle performs a driving behavior different from its past driving behavior in the place, and the contents of the conversation of the occupant of the vehicle include a specific phrase or sentence.
Automatic driving control device. The automatic driving control device according to claim 1,
The vehicle driver may further include a notification unit that notifies an occupant of the vehicle when the event requiring release occurs.
Automatic driving control device. The automatic driving control device according to claim 1 or 2 ,
A monitoring unit configured to monitor the presence or absence of a fraudulent factor by using a program capable of detecting the fraudulent factor, which is an external fraudulent operation, a computer virus, fraudulent software, or fraudulent data;
a fraud response unit that executes a fraud response process when the fraud factor occurs;
Further comprising:
Automatic driving control device. The automatic driving control device according to any one of claims 1 to 3 ,
Further comprising a location information storage unit configured to store location information of the vehicle.
Automatic driving control device. The automatic driving control device according to any one of claims 1 to 4 ,
The vehicle further includes an automatic driving operation canceling unit that cancels the automatic driving operation when an emergency stop lever provided in the vehicle is operated or when a specific contact portion in the vehicle is contacted.
Automatic driving control device. The automatic driving control device according to claim 5 ,
Further comprising a reset unit that resets the state in which the automatic driving operation is canceled when a release reset switch provided in the vehicle is operated.
Automatic driving control device. The automatic driving control device according to any one of claims 1 to 6 ,
The surrounding information is information about a traffic light, a railroad crossing, a sign, an intersection, a junction/diverging point, a sidewalk, an obstacle, a dangerous part, a ground structure, or a regulation.
Automatic driving control device. The automatic driving control device according to any one of claims 1 to 7 ,
Further comprising an infrastructure canceling unit that cancels the automatic driving operation when a notification is received from the infrastructure side.
Automatic driving control device. An automatic driving control device mounted on a vehicle,
A surrounding information acquisition unit configured to acquire surrounding information that is information about the surroundings of the vehicle;
An automatic control unit configured to perform an automatic driving operation that automatically performs a driving operation required for driving the vehicle based on the surrounding information;
A cancellation-required event determination unit configured to determine whether or not a predetermined cancellation-required event has occurred that should cancel at least one of the automatic driving operations;
an information transmission unit that transmits information to a monitoring device via a network when the event requiring release occurs;
a driver state determination unit that determines whether or not the driver is capable of performing the driving operations that have been performed automatically up until that point;
a driving history canceling unit that cancels the automatic driving operation when the vehicle drives again in a place where the vehicle has driven in the past and performs a driving operation different from the past driving operation in the place ;
Equipped with
The automatic control unit is configured to execute a predetermined automatic stop process for stopping the traveling of the vehicle when the required-to-cancel event determination unit determines that the required-to-cancel event has occurred and the driver state determination unit determines that the driver is unable to perform the driving operation that has been performed automatically up until that point.
Automatic driving control device. An automatic driving control device mounted on a vehicle,
A surrounding information acquisition unit configured to acquire surrounding information that is information about the surroundings of the vehicle;
An automatic control unit configured to perform an automatic driving operation that automatically performs a driving operation required for driving the vehicle based on the surrounding information;
A monitoring unit configured to monitor the presence or absence of a fraudulent factor by using a program capable of detecting the fraudulent factor, which is an external fraudulent operation, a computer virus, fraudulent software, or fraudulent data;
a fraud response unit that forcibly stops the vehicle when the fraud factor occurs;
an information transmission unit that transmits information to a monitoring device via a network when a predetermined cancellation event occurs that requires cancellation of at least one of the automatic driving operations;
a driving history canceling unit that cancels the automatic driving operation when the vehicle drives again in a place where the vehicle has driven in the past and performs a driving operation different from the past driving operation in the place ;
Equipped with
Automatic driving control device. A vehicle equipped with the automatic driving control device according to any one of claims 1 to 10 .