WO2019058962A1

WO2019058962A1 - Control system for mobile body and control method for mobile body

Info

Publication number: WO2019058962A1
Application number: PCT/JP2018/032806
Authority: WO
Inventors: 敏史大塚; 成沢　文雄
Original assignee: 日立オートモティブシステムズ株式会社
Priority date: 2017-09-21
Filing date: 2018-09-05
Publication date: 2019-03-28
Also published as: JP6875240B2; JP2019055673A

Abstract

The present invention provides a control system for a mobile body which, in a case where a malfunction has occurred in a part of the control system, can suitably select a control output from among a plurality of control outputs output from a plurality of functions. The present invention comprises: an automatic operation control unit 12 for generating automatic operation control information L4 for ordinary control of the operation of a vehicle 100; a safety control unit 19 for generating safety operation control information L8 for non-ordinary control of the operation of the vehicle 100; and a switching unit 17 for outputting either the automatic operation control information L4 or the safety operation control information L8. In a case where a differential d between the automatic operation control information L4 and the safety operation control information L8 is less than or equal to a prescribed threshold dth (d≤dth), the switching unit 17 outputs the safety operation control information L8.

Description

Mobile body control system and mobile body control method

The present invention relates to a control system of a mobile unit and a control method of the mobile unit.

In recent years, in industrial devices such as vehicles, construction machines, and elevators, the influence of a failure in a control system that controls industrial devices may be serious. Therefore, in this type of industrial equipment, when a failure occurs in some functions of the control system, it may be considered to substitute other functions.
As described above, in a control system of industrial equipment, one capable of replacing a predetermined function with another function is referred to as system multiplexing or redundancy.

When a failure occurs in the multiplexed or redundant control system, or when the failure recovers and returns to the normal function, the mutual transition between the normal function and the alternative function is performed without stopping the control of the industrial equipment. To be performed smoothly within a predetermined switching period is required in terms of the safety of industrial equipment and the quality of functions.

Patent Document 1 discloses, in a control system of a vehicle, a technique for relieving a control step that occurs when a failure is repaired and the system is restored to a normal state.

JP 2017-33236 A

Here, in the automatic driving technology of a vehicle under development in recent years, there may be cases where time-series information (control output) of the future vehicle position (track) is output from two systems of a normal function and an alternative function. is there. In addition, in the control system of this type of vehicle, not only future motion information used in the alternative function, but also operation information when the driver performs an operation during automatic driving (when overriding) or more urgently Emergency information of high vehicles may also be output.

The technology disclosed in Patent Document 1 is a technology that simply compares the information output from each of the normal function and the alternative function, and outputs a plurality of functions when a failure occurs in part of the control system. The control output can not be properly selected from among the plurality of control outputs.

Therefore, the present invention has been made focusing on the above-mentioned problems, and in the case where a failure occurs in a part of the control system of a moving object, control is performed from among a plurality of control outputs output from a plurality of functions. An object of the present invention is to provide a control system capable of appropriately selecting an output.

In order to solve the above-mentioned subject, the 1st control part which generates the 1st control information for usually controlling movement of a mobile, and the 2nd control information which generates the 2nd control information for unusually controlling movement of a mobile. And a switching unit for outputting any one of the first control information and the second control information, and the switching unit is configured such that the difference between the first control information and the second control information is equal to or less than a predetermined threshold value. When it is, it is set as the structure which outputs 2nd control information.

According to the present invention, there is provided a control system capable of appropriately selecting a control output from among a plurality of control outputs output from a plurality of functions when a failure occurs in a part of a control system of a moving object. Can.

It is a block diagram explaining the function of the control system concerning an embodiment. It is a schematic diagram explaining composition of a vehicle carrying a control system. It is a block diagram explaining an apparatus configuration of a control system. It is a block diagram explaining an example of an internal configuration of a control device (ECU). It is a figure explaining the composition of the software module which operates with a processor. It is a functional block diagram explaining the functional composition of the control system whole. It is a figure explaining an example of the functional arrangement to the internal configuration of ECU of a control system. It is a figure explaining an example of vehicle control by a control system. It is a flowchart of the control information switching process in a switching part. It is a functional block diagram explaining the functional composition of the whole control system concerning a modification. It is a figure explaining an example of the control method of the vehicle by a control system. It is a block diagram explaining the functional composition of the whole control system of a 2nd embodiment. It is a block part explaining the structure of a reconfiguration | reconstruction management part. It is a block diagram explaining the structure of a reconfiguration | reconstruction execution part. It is a figure explaining the sequence of the reconstruction process in the control system of 2nd Embodiment. It is a flow chart of control information change processing in a change part of a 2nd embodiment. It is a block diagram explaining the functional composition of the whole control system of a 3rd embodiment. It is a figure explaining an example of vehicle control by a control system of a 3rd embodiment. It is a flowchart of the control information switch process of the switch part of 3rd Embodiment. It is a flow chart of user control change judging processing of a change part of a 4th embodiment.

Control system
Hereinafter, a control system 1 according to an embodiment of the present invention will be described. In the embodiment, a case where the control system 1 is applied to a control system used to control a moving object such as a vehicle 100 will be described as an example.
FIG. 1 is a block diagram for explaining the function of a mobile object control system 1 (hereinafter simply referred to as the control system 1) according to the embodiment.

As shown in FIG. 1, the control system 1 includes an AD1-ECU 2 and a VMC-ECU 3. The AD1-ECU 2 and the VMC-ECU 3 are gateways (hereinafter referred to as GWs (hereinafter referred to as GWs) that connect the respective network links. It is connected via Gateway) 97). Here, AD is used on the assumption of Automated Driving or Autonomous Driving. Also, VMC is used assuming Vehicle Motion Control. Also, the ECU is assumed to be an Electronic Control Unit.

In the embodiment, AD1-ECU2 is a high-level high-performance ECU that performs overall control of the vehicle 100. Connected to the AD 1 -ECU 2 is a detection device 80 for detecting a surrounding condition of the vehicle 100 such as a corner rider 81, a corner radar 82, a front camera 83, a sonar 84 and the like. The AD 1 -ECU 2 generates (calculates) future position information (track) of the vehicle 100 based on the detection result of the surrounding condition of the vehicle 100 by the detection device 80. In the embodiment, the future means a time earlier than the current time.

In addition to the above, the detection device 80 includes a corner rider 85, a front radar 86, and a 360 ° camera 87. The detection devices 80 are selectively connected to the AD1-ECU 2 and the VMC-ECU 3 (CPU 3B described later) via a switch (hereinafter referred to as SW 88), and switching of the switch 88 causes the AD1-ECU 2 and It is connected to one or both of VMC-ECU3.

In the vehicle 100 equipped with the automatic driving system, the AD 1 -ECU 2 performs control for controlling the vehicle 100 based on the surrounding situation detected by the detection device 80 described above and the future position information (track) of the vehicle 100. Generate output. AD1-ECU2 transmits the generated control output to VMC-ECU3.

The VMC-ECU 3 is a lower-level single-function ECU that directly controls an actuator of a drive device (for example, an engine, an accelerator, a brake, a steering, etc.) involved in the motion of the vehicle 100.

The VMC-ECU 3 is connected to a drive device 90 of the vehicle 100 such as the brake 91, the steering 92, the other ECU 93, the EMC 94, and the ATCU 95 via a controller area network (hereinafter referred to as CAN 99). The VMC-ECU 3 controls these drive devices 90 based on the control output from the AD 1 -ECU 2.

The CAN 99 includes communication lines such as CAN FD (CAN With Flexible Data-rate, Ethernet (registered trademark)).

The VMC-ECU 3 is a dual core processor having two CPUs, a central processing unit (CPU) 3A and a CPU 3B provided in parallel with the CPU 3A. In the embodiment, the VMC-ECU 3 exemplifies and describes a dual core processor having the CPU 3A and the CPU 3B in parallel, but the present invention is not limited to this. For example, the VMC-ECU 3 may be a quad core processor having four CPUs in parallel, a hexa core processor having six CPUs in parallel, or a multi-core processor having more CPUs in parallel.

In addition, a memory 33 is provided in the VMC-ECU 3. The memory 33 stores a control program (not shown) used to control the VMC-ECU 3 and various control parameters (not shown).

The CPU 3A controls the drive device 90 (for example, the brake 91, the steering 92, an accelerator (not shown)) and the like involved in the motion of the vehicle 100. The CPU 3A is connected to the AD1-ECU 2 via the GW 97. The CPU 3A is connected to the CPU 3B, and mutually communicates various information processed by the CPU 3A or the CPU 3B with the CPU 3B.

The CPU 3 B is connected to a detection device 80 such as a corner rider 85, a front radar 86, and a 360 ° camera 87, and acquires the surrounding situation from the detection device 80. The CPU 3B transmits the surrounding situation acquired from the detection device 80 to the CPU 3A.

In addition, in at least one of the CPU 3A and the CPU 3B, resources such as an arithmetic device and a memory are prepared, which are capable of installing and executing the degeneration module 96 for degenerating the function of the CPU 3A or CPU 3B.

Here, degeneracy means that the CPU 3A or CPU 3B lowers the performance than the basic function (main function) for controlling the drive device 90, or continues the control while limiting the main function and limiting it, or When a predetermined function of the CPU 3A or the CPU 3B can not be used, it means switching to another function which is a substitute, or its function or configuration.
In the embodiment, control of the vehicle 100 by the main function may be referred to as normal control, and control of the vehicle 100 by the degeneration function may be referred to as non-normal control.

Thus, when the drive device 90 is controlled by either the CPU 3A or the CPU 3B, the VMC-ECU 3 can degenerate the function of the other CPU 3A or CPU 3B based on the degeneration module 96. Therefore, the VMC-ECU 3 can control the drive device 90 such as the brake 91 and the steering 92 by either of the CPU 3A or the CPU 3B by the degeneration function.

The GW 97 is connected to the body 971, the HMI 972, the connection device 973, and the information providing device 974 via a network link or a dedicated line.

The CPU 3A of the VMC-ECU 3 described above constitutes a first control unit of the present invention, and the CPU 3B constitutes a second control unit of the present invention.

Next, the configuration of the vehicle 100 equipped with the control system 1 described above will be described.
FIG. 2 is a schematic view illustrating the configuration of a vehicle 100 equipped with the control system 1.

As shown in FIG. 2, the control system 1 is disposed inside the vehicle 100. Inside the vehicle 100, another vehicle control device configured by a network using a different or the same protocol as the vehicle control device 4 such as the AD1-ECU 2 or the VMC-ECU 3, the communication device 5, and the vehicle control device 4. (ECU: equivalent to ECU 93 in FIG. 1) 6, an external output device 7, an input device 8, a notification device 9, a detection device 80, and a drive device 90 are connected.

The communication device 5 is a device that enables wireless communication between the control system 1 provided inside the vehicle 100 and an external device (not shown) of the vehicle 100. The communication device 5 is, for example, mobile phone communication, wireless LAN (Local Area Network), WAN (Wide Area Network), C2X (Car to X: communication between a vehicle and a vehicle or communication between a vehicle and an infrastructure device on the road) Etc., or communication using GPS (Global Positioning System).

The communication device 5 performs wireless communication with an external device (not shown), acquires the surrounding situation of the vehicle 100 (for example, information on road infrastructure equipment, position information and speed information of other vehicles, map information), and controls the vehicle The ambient situation is transmitted to the device 4 (AD1-ECU 2 described above). Transmission of the surrounding situation to the vehicle control device 4 by the communication device 5 is performed by using a diagnostic terminal (On-board diagnostics: OBD) for the self-diagnosis function of the vehicle provided in the communication device 5, an external storage medium (for example, USB (for example, It is performed via the Universal Serial Bus) memory and SD memory card) terminals.

The external output device 7 is a device for notifying the driver or the like of the motion state or the surrounding condition of the vehicle 100. For example, the external output device 7 is a liquid crystal display, a warning light, or a speaker that outputs acquired information as a video or sound.

The input device 8 is a device for the driver to give the control system 1 an operation instruction regarding the driving of the vehicle 100. For example, the input device 8 is a handle, a foot pedal, various operation buttons, an operation lever, a touch panel, or the like.

The notification device 9 is a device for the control system 1 to notify the outside world of the motion state of the vehicle 100. For example, the notification device 9 is a light (headlight or the like), a lamp (a warning lamp such as a brake lamp, a tail lamp, a fog lamp or a small lamp), an LED, a speaker or the like.

The detection device 80 is a device that acquires the surrounding situation detected by a sensor or the like provided in the vehicle 100. For example, as described above, the detection device 80 may be an on-board camera, a radar, an external sensor such as a lidar (LIDAR) or a sonar (ultrasonic sensor), and a state (motion state, position information, acceleration, wheel state) of the control system 1. It is a dynamic sensor etc. which recognizes rotation speed etc.).

The drive device 90 is a drive device such as an actuator that drives the mechanical and electrical devices that control the motion of the vehicle 100 according to the control of the control system 1. For example, as described above, the drive device 90 is an engine, a transmission, a wheel, a brake 91, a steering 92, an accelerator, or the like.

Next, the device configuration of the control system 1 will be described.
FIG. 3 is a block diagram for explaining an apparatus configuration of the control system 1.

As shown in FIG. 3, in the control system 1, a plurality of VMC-ECUs 3 (hereinafter simply referred to as ECUs 3) for controlling the respective detecting devices 80 and the driving devices 90 are connected to CAN 99 which is an in-vehicle network. There is.

The communication device 5 and other vehicle control systems 6, the respective detection devices 80, and drive devices 90 (actuators) such as the brake 91 are connected to the respective ECUs 3.

Each ECU 3 is also connected to another in-vehicle network (including a dedicated line) other than the CAN 99, and transmits and receives information with the drive device 90 and the like via the other in-vehicle network.

In addition, although CAN99 mentioned above illustrated and demonstrated the case of the bus | bath type which several ECU3 is connected to two bus arrange | positioned inside the vehicle 100, the network topology of CAN99 is limited to this It is not a thing. For example, a star type in which a plurality of ECUs 3 are arranged radially, a link type in which a plurality of ECUs 3 are connected to a bus arranged in a ring, and a mixture type in which each type is mixed Or the like.

The ECU 3 transmits a control output to the drive device 90 based on the information of the detection device 80 and the like acquired via the on-vehicle network such as the CAN 99, and performs control processing such as change of the internal state.

[Control device]
Next, an example of an internal configuration of the ECU 3 (control device) will be described.
FIG. 4 is a block diagram for explaining an example of the internal configuration of the ECU 3.

As shown in FIG. 4, the ECU 3 has a processor 31, an I / O (Input / Output) 32, a timer 33, a ROM (Read Only Memory) 34, and a RAM (Random Access Memory) 35. These are connected by an internal bus 36 used for communication inside the ECU 3.

The processor 31 is a device such as a CPU that has a storage element such as a cash register and executes control. The processor 31 configures the CPU 3A and the CPU 3B described above.

The I / O 32 is a device that transmits and receives information to and from the detection device 80 or the drive device 90 connected to the ECU 3 via the CAN 99 or a dedicated line (not shown).

The timer 33 is a device that manages time and time using a clock function (not shown) that the processor 31 or the like has.

The ROM 34 is a non-volatile storage device that stores a control program for controlling the ECU 3 and various parameters.

The RAM 35 is a volatile storage device that temporarily stores various programs for executing the functions of the ECU 3 and information processed by a processor or the like.

Next, the configuration of the software module operated by the processor 31 described above will be described.
FIG. 5 is a diagram for explaining the configuration of a software module operating on the processor 31. As shown in FIG.

As shown in FIG. 5, the processor 31 includes a control unit 311, a communication management unit 312, a time management unit 313, a data table 314, and a buffer 315.

The control unit 311 performs overall control of the processor 31. Specifically, the control unit 311 executes a predetermined control program and performs processing based on the control program. By the operation of the control unit 311, execution of each function of the control system 1 is performed.

The communication management unit 312 instructs the I / O 32 to transmit and receive information via the internal bus 36.

The time management unit 313 manages the timer 33, acquires information related to time and time, and performs control such as counting of time and time.

The data table 314 stores various information necessary for control of the vehicle 100.

The buffer 315 temporarily stores the information calculated by the control unit 311 and the time management unit 313.

The control unit 311, the communication management unit 312, and the time management unit 313 described above read the information necessary for the operation from the ROM 34 or the RAM 35, or write the information into the ROM 34 or the RAM 35.

[Functional configuration of control system]
Next, the functional configuration of the entire control system 1 will be described.
FIG. 6 is a functional block diagram for explaining the functional configuration of the control system 1 as a whole.

As shown in FIG. 6, the control system 1 switches between the integrated recognition unit 11, the automatic driving control unit 12, the user input unit 13, the output management unit 14, the notification management unit 15, the abnormality detection unit 16, and It has a unit 17, a motion control unit 18, and a safety control unit 19.

The integrated recognition unit 11, the automatic driving control unit 12, the user input unit 13, the output management unit 14, the notification management unit 15, the abnormality detection unit 16, the switching unit 17, and the exercise control unit 18; The safety control unit 19 is disposed in any of the aforementioned ECUs 3.

The integrated recognition unit 11 is connected to the plurality of detection devices 80 and the communication device 5, and acquires the surrounding situation L1 from these devices. The integrated recognition unit 11 integrates the acquired surrounding situation L1 to generate an external world recognition map L2. The integrated recognition unit 11 is connected to the automatic driving control unit 12, and transmits the generated external world recognition map L2 to the automatic driving control unit 12.

The autonomous driving control unit 12 generates autonomous driving control information L4 (such as a trajectory) based on the external world recognition map L2 generated by the integrated recognition unit 11 and the user input information L3 input through the user input unit 13. Generate The automatic driving control unit 12 outputs the generated automatic driving control information L4 to the output management unit 14, the notification management unit 15, the abnormality detection unit 16, and the switching unit 17.

The user input unit 13 generates user input information L3 based on the user input from the input device 8.

The output management unit 14 is connected to the external output device 7. Output management unit 14 outputs output information L6 generated based on automatic operation control information L4 received from automatic operation control unit 12 and abnormality detection information L5 received from abnormality detection unit 16 to external output device 7. .

The notification management unit 15 is connected to the notification device 9 and the communication device 5. The notification management unit 15 outputs notification information L7 generated based on the automatic operation control information L4 received from the automatic operation control unit 12 and the abnormality detection information L5 received from the abnormality detection unit 16 to the notification device 9.

The abnormality detection unit 16 detects an abnormality in the control system 1 based on the automatic operation control information L4 acquired from the automatic operation control unit 12 and control information (not shown) acquired from other devices. The abnormality detection unit 16 is connected to the output management unit 14, the notification management unit 15, the switching unit 17, and the safety control unit 19, and transmits the abnormality detection information L5 to these devices.

The switching unit 17 is connected to the abnormality detection unit 16, the automatic driving control unit 12, the user input unit 13, the safety control unit 19, and the exercise control unit 18. The switching unit 17 controls the automatic driving control unit 12, the user input unit 13, and the safety control unit 19 to output the control output L 10 to the exercise control unit 18 based on the abnormality detection information L 5 acquired from the abnormality detection unit 16. Switch to the information obtained from any of them.

Here, the control output L10 is, for example, a target value of motion control parameters such as acceleration of the vehicle 100 and a yaw rate, control command values to the respective driving devices 90, and continuous values thereof in time series.

The motion control unit 18 is connected to the detection device 80 and the drive device 90, and acquires the control output L10 obtained from the switching unit 17, the surrounding situation L1 of the vehicle 100 obtained from the detection device 80, and the drive device 90 The drive control information L9 generated based on the driving condition (response) of the drive device 90 is transmitted to the plurality of drive devices 90.

The safety control unit 19 is connected to the abnormality detection unit 16, the switching unit 17, and the detection device 80. The safety control unit 19 performs safe driving control information at the time of failure occurrence or the like of the vehicle 100 (control system 1) based on the surrounding situation L1 acquired from the detection device 80 and the abnormality detection information L5 acquired from the abnormality detection unit 16. Output L8 to the switching unit 17.

In the embodiment, the safety control unit 19 includes the degeneration module 96 (see FIG. 1), and by degenerating the motion function of the vehicle 100 by the degeneration function of the degeneration module 96, the vehicle 100 is exercised with the minimum function. It can be done.
Therefore, the safe driving control information L8 generated by the safety control unit 19 is control information for causing the motion control unit 18 to exhibit the degeneration function.

Here, the motion control of the vehicle 100 by the automatic driving control unit 12 may be referred to as normal control, and the motion control of the vehicle 100 by the safety control unit 19 may be referred to as abnormal control.

As described above, when viewed from the switching unit 17, the automatic operation control unit 12 (the ECU 3 in which the automatic operation control unit 12 is disposed) and the safety control unit 19 (the ECU 3 in which the safety control unit 19 is disposed) It is provided in parallel (see FIG. 6).

Therefore, when any failure occurs in the control system 1, for example, when switching from the normal control by the automatic operation control unit 12 to the non-normal control (safety control) by the safety control unit 19, the non-normal control by the safety control unit 19 Control is continuously performed according to the automatic operation control information output from the automatic operation control unit 12 until the preparation of the second control is completed, and the control by the safety control unit 19 is performed at the stage when the preparation of the non-normal control by the safety control unit 19 is completed By shifting, the control can be switched smoothly.

In addition, since the automatic driving control unit 12 and the safety control unit 19 are provided in parallel, the respective control units share functions for causing the vehicle 100 to properly exercise, and thus a predetermined switching period (for example, It is possible to switch within 500 msec) and to perform switching in case of failure quickly and safely.

The control system 1 may include part or all of the communication device 5, the detection device 80, the drive device 90, the external output device 7, the input device 8 or the notification device 9. Further, although the VMC-ECU 3 including the motion control unit 18, the output management unit 14, and the notification management unit 15 has been described as an example having a part of the functions of the control system 1, the VMC-ECU 3 may have all the functions. Good.

As described above, the control system 1 is composed of a plurality of functions, and the function arrangement to the internal configuration of the ECU 3 shown in FIG. 4 may be a plurality of patterns.

As shown in FIG. 7, in the embodiment, each function of the control system 1 is separately provided in the plurality of ECUs 3. In the embodiment, the integrated recognition unit 11 and the automatic driving control unit 12, the abnormality detection unit 16 and the safety control unit 19, the switching unit 17 and the motion control unit 18, and the user input unit 13 are provided as an example in the case of being provided in the ECU 3. And the output management unit 14 and the notification management unit 15 are disposed in separate ECUs 3 provided in parallel.

In addition, the example of a function arrangement | positioning of the control system 1 mentioned above is not limited to this, You may arrange | position a predetermined | prescribed function in another ECU.

[Vehicle control by control system]
Next, an example of control of the vehicle 100 by the control system 1 will be described.
FIG. 8 is a diagram for explaining an example of control of the vehicle 100 by the control system 1.

As shown in FIG. 8, in the following description, the control system 1 (the automatic driving control unit 12) of the own vehicle (vehicle 100) is such that the own vehicle (vehicle 100) travels in the left lane on a road of two lanes on one side. Since the preceding vehicle 101 is ahead, the motion control of the own vehicle will be described by way of example when the trajectory 801 (automatic driving control information L4) of the own vehicle is generated so as to overtake from the right lane.

The trajectory 801 generated by the main function of the autonomous driving control unit 12 is a safety constraint that the vehicle can travel safely (for example, a state where the possibility of collision with another vehicle or an obstacle is low). It is assumed that the motion constraints such as achievable acceleration, deceleration, and yaw rate are satisfied.

As shown in FIG. 8, on the track 801 generated by the automatic driving control unit 12, the position of the vehicle at time t0 (the current time) is (X0, Y0) and the position of the vehicle at t1 is (X1, Y1) The position of the vehicle at time t2 is (X2, Y2). In the trajectory 801, position information (for example, t3 (x3, Y3) to tn (Xn, Yn)) is assumed to be generated similarly.

The automatic driving control unit 12 acquires the current motion state (current speed, current acceleration, current yaw rate) and the like of the current vehicle so that the vehicle moves along the track 801, and the acquired motion Based on the state, the target velocity, the target acceleration, the target yaw rate, etc. of the vehicle are calculated.

In order to achieve the target speed, etc., the automatic driving control unit 12 increases the output of the engine torque, controls the brake to increase the braking force, steers the steering, and makes the wheels uneven. Make braking and acceleration for each wheel.
In addition, when the information which the automatic driving | operation control part 12 produces | generates is not the track | truck 801 of the own vehicle but the control value of the drive device 90, the target exercise is performed by controlling the drive device 90 using this control value. Control can be performed.

[Abnormality detection method in anomaly detection section]
Next, an abnormality detection method in the abnormality detection unit 16 will be described.
In the embodiment, “abnormal” refers to a state different from a state assumed under normal conditions that occurs due to a hardware failure or software failure of the control system 1, an unexpected input, or the like.

Each component device of the control system 1 performs communication via communication such as an in-vehicle network (CAN 99) or a dedicated line. Therefore, in the control system 1, in the case of a normal abnormality, communication can not be performed (the communication processing is an error response, the potential of the signal line is abnormal), an abnormality of the signal value of communication, and the like occur.
These communication abnormalities are errors by abnormality detection code such as abnormality detection in electric circuit (potential detection etc.), periodic survival confirmation (error detection by transmission and reception of heartbeat), cyclic redundancy check (CRC), etc. It is detectable by performing detection.

Further, with regard to the failure of the arithmetic device such as the CPU, the abnormality can be detected by checking the result of the same operation (comparison of the operation result), and the memory failure can be detected when the ROM or RAM is accessed, etc. Can be detected.

The software defect can be detected by the output result being out of the predetermined range (above the threshold or below the threshold), in addition to comparison of checking results of the same operation.

For these abnormalities, there are permanent failures that occur permanently and transient failures that occur transiently. For example, if the output value is generated while being displaced unstably, the possibility of a transient failure is high, and if the output value is fixed at 0 (zero) or 1 value, permanent failure is possible. It can be determined that the sex is high.

The abnormality detection unit 16 of the control system 1 detects an abnormality of the control system 1 by receiving the abnormality information. In addition, another apparatus may detect an abnormality, and the abnormality detection unit 16 may detect abnormality by receiving abnormality information from the other apparatus.

For example, the automatic driving control unit 12 adds, to the automatic driving control information L4, that an abnormality has occurred in any part of the detection device 80, the communication device 5, the integrated recognition unit 11, and the communication between them. The abnormality detection unit 16 detects this abnormality information to detect an abnormality in the control system 1.

The switching unit 17 executes control information switching processing described later based on the abnormality detection result (reception of the abnormality detection information L5) by the abnormality detection unit 16.

[Control information switching process in switching unit]
Next, control information switching processing in the switching unit 17 will be described.
FIG. 9 is a flowchart of control information switching processing in the switching unit 17.
When the abnormality detection unit 16 detects an abnormality, the switching unit 17 executes the following control signal switching process.

First, in step S101, the switching unit 17 controls the automatic operation control information L4 (output of the first control) acquired from the automatic operation control unit 12 and the safe operation control information L8 (second control) acquired from the safety control unit 19. And the output of the) in time series.

In step S102, the switching unit 17 compares the automatic driving control information L4 (output of the first control) with the safe driving control information L8 (output of the second control), and as a result, the difference d has a predetermined prescribed value (predetermined value If it is determined that the value is not less than the threshold dth (step S102: No), the process proceeds to step S103, and the automatic driving control information L4 (output of the first control) is output to the motion control unit 18.

Therefore, when the difference d between the autonomous driving control information L4 and the safe driving control information L8 is larger than the predetermined threshold dth (d> dth), the switching unit 17 performs safety based on control based on the autonomous driving control information L4 of the vehicle 100. When switching to control based on the driving control information L8, the impact (control step) at the switching of the control becomes large, and it is determined that the driver's discomfort increases, and control based on the automatic driving control information L4 is performed as it is. The driver's discomfort due to the switching of the control information can be reduced, and the vehicle 100 can be driven safely and safely.

On the other hand, as a result of comparing the automatic driving control information L4 (output of the first control) with the safe driving control information L8 (output of the second control), the switching unit 17 determines that the difference d has a predetermined prescribed value (predetermined threshold dth). If it is determined that the following is true (step S102: Yes), the process proceeds to step S104, and the safe driving control information L8 (output of the second control) is output to the exercise control unit 18.

Therefore, when the difference d between the automatic driving control information L4 and the safe driving control information L8 is equal to or less than the predetermined threshold dth (d ≦ dth), the switching unit 17 performs the safe driving from the control based on the automatic driving control information L4 of the vehicle 100. Even when switching to control based on control information L8, it is determined that there is less discomfort for the driver when switching, and switching to control based on safe driving control information L8 ensures safety of the vehicle 100 by motion control by the degeneration function. It is possible to perform motion control of the vehicle 100 without giving the driver a sense of discomfort.

Here, in the automatic driving control unit 12, even after abnormality detection by the abnormality detecting unit 16, the automatic driving control is performed for a predetermined period of time until the switching from control by the automatic driving control information L4 to control by the safe driving control information L8 is completed. Since it is necessary to continue the control based on the automatic driving control information L4 generated by the unit 12, the automatic driving control information L4 which has been verified if no abnormality has occurred is held for a predetermined time, and output is performed for a predetermined time.

In the embodiment described above, the case where the automatic driving control information L4 is held by the automatic driving control unit 12 is described as an example, but the present invention is not limited to this. The automatic driving control information L4 is not limited to the automatic driving control It is good also as composition which devices other than part 12 hold.
Hereinafter, a control system 1A in which the automatic driving control information L4 is held by the control information holding unit 40 other than the automatic driving control unit 12 will be described.

[Control information storage unit]
FIG. 10 is a functional block diagram for explaining the functional configuration of the entire control system 1A according to the modification.

The control information holding unit 40 of the control system 1A is connected to the switching unit 17. The control information holding unit 40 acquires the automatic driving control information L4 generated by the automatic driving control unit 12 for a predetermined time via the switching unit 17, and holds the automatic driving control information L4 for the predetermined time.

Specifically, when an abnormality occurs in control system 1A or the like, control information holding unit 40 determines, for a predetermined time, automatic operation control information L4 verified to be able to guarantee safe traveling of vehicle 100 as a minimum. A minute is held, and when an abnormality occurs, the automatic operation control information L4 (hereinafter referred to as holding control information L11) held is output to the switching unit 17.

Thereby, the switching unit 17 outputs the holding control information L11 held by the control information holding unit 40 to the motion control unit 18 when the abnormality detecting unit 16 detects that an abnormality has occurred in the control system 1A. The motion control unit 18 can control the vehicle 100 (drive device 90) based on the holding control information L11. Therefore, since movement control based on the holding control information L11 in which safe traveling is minimum guaranteed is performed, the vehicle 100 can travel safely even when an abnormality occurs.

Here, the holding control information L11 held by the control information holding unit 40 is automatic driving control information up to a predetermined time (future) generated by the automatic driving control unit 12, for example, traveling along the current lane, The information is, for example, information for causing the vehicle 100 to perform control such as deceleration slowly while traveling along the lane, and retraction to the road shoulder and stop.

As described above, when the control information holding unit 40 other than the automatic driving control unit 12 holds the holding control information L11 (automatic driving control information L4), in the control information switching process described in FIG. Processing is performed with the holding control information L11 output from 40 as the output of the first control, and the safe driving control information L8 output from the safety control unit 19 as the output of the second control.

With this configuration, even if a fault occurs in the automatic driving control unit 12 and the output route thereof, the vehicle 100 can maintain a predetermined trajectory by the main function based on the holding control information L11 output from the control information holding unit 40. The automatic traveling along the line 801 can be performed, and the degeneration function based on the safe driving control information L8 output from the safety control unit 19 enables the automatic traveling along the predetermined track 801 with the minimum movement.

The control information holding unit 40 may hold the safe driving control information L8 generated by the safety control unit 19, and holds either or both of the holding control information L11 and the safe driving control information L8. You may do it.
According to this configuration, when any failure occurs in the ECU 3 in which the safety control unit 19 is disposed, the motion of the vehicle 100 is safely controlled using the safe driving control information L8 held by the control information holding unit 40. be able to.

[Control output comparison method]
Next, an example of a control method of the vehicle 100 by the control system 1A having the control information holding unit 40 will be described.
FIG. 11 is a diagram for explaining an example of a control method of the vehicle 100 by the control system 1A.

In FIG. 11, the trajectory of the main function based on the output of the first control (for example, the holding control information L11) is the trajectory 1001, and the trajectory of the degeneration function based on the output of the second control (for example, the safe operation control information L8) is It is a trajectory 1002. Each of the trajectory 1001 based on the main function and the trajectory 1002 based on the degeneracy function has position information of the own vehicle (vehicle 100) up to a predetermined time point (future) in time series.

In the embodiment, the time t0 represents the current time, and the position based on the holding control information L11 at the time t1 from the current time t0 to the predetermined time ahead and the position based on the safe driving control information L8 are They are (xa0, ya0) and (xb0, yb0), (xa1, ya1) and (xb1, yb1), (xa2, ya2) and (xb2, yb2), respectively.

At the current time t0, (xa0, ya0) and (xb0, yb0) become equal. Then, assuming that the vehicle has moved to the positions (xa1, ya1) and (xb1, yb1) at time t1, the difference d of the position in this case can be expressed by Equation 1 below.

For example, in the switching unit 17, the difference between the position (xa1, ya1) based on the holding control information L11 at time t1 and the position (xb1, yb1) based on the safe driving control information L8 is constant. If it is determined that the threshold dth (for example, 0.5 m) or more of the vehicle is exceeded, it is determined that the motion control of the vehicle accompanying switching from the holding control information L11 to the safe driving control information L8 becomes large. 2) The control based on the holding control information L11 (the output of the first control) is performed without switching to the control based on the output of (2) control.

That is, when the difference d is larger than the predetermined threshold value dth, the vehicle 100 does not advance to the trajectory 1002 based on the safe driving control information L8 (degeneration function) even if there is some abnormality in the control system 1, It will travel on the track 1001 based on the information L11 (main function).

Then, the difference d is compared with the predetermined threshold dth at a predetermined cycle, and when the difference d becomes equal to or less than the threshold dth, the process proceeds to the trajectory 1002 based on the safe driving control information L8 (degeneration function) . In the embodiment, the vehicle 100 travels on the trajectory 1002 based on the degeneration function when the difference d becomes equal to or less than the threshold dth after the vehicle 100 proceeds to the trajectory 1001 based on the main function and enters the right lane (for example, right Slow down while traveling along the lane etc.)

In the embodiment described above, the comparison is made with the absolute distance at time t1, but for example, determination is made only by the positional relationship in the x-axis (traveling direction of the vehicle 100) or y-axis direction (perpendicular to traveling direction of the vehicle 100). You may For example, by determining only the position of the vehicle 100 in the x-axis direction, it is possible to determine that the output value deviates only when the position of the vehicle 100 on the lane is different.
Further, by determining only the position of the vehicle 100 in the y-axis direction, it is possible to determine that the control output value deviates only when the acceleration / deceleration largely differs.

In the embodiment described above, in the control system 1 (1A), the switching unit 17 exemplifies the case where the switching output of the control output is determined based on the difference d based on the position information of the vehicle 100. For example, the switching unit 17 may make the determination based on the speed information and the acceleration information. By comparing the respective information, for example, by using the output of the first control (the automatic operation control information L4 or the holding control information L11) only when the speed information largely deviates, a large speed change (vertical direction, It is possible to suppress the occurrence of the lateral direction or the rotational direction). Similarly, by using the output of the first control (the automatic driving control information L4 or the holding control information L11) only when the acceleration information largely deviates, the large acceleration change (longitudinal direction, lateral direction, or absolute value) It can suppress that it occurs.

In the control system 1 (1A) described above, when the comparison determination is made based on the speed or acceleration of the vehicle 100, the case where the signs of the respective X component, Y component or angular velocity direction are different may be used as the threshold. If the velocity or acceleration X component, Y component, or sign of the angular velocity direction is different, this generally means that the motion control of the vehicle 100 is significantly different, and it is effective to use this as the determination, and the determination is easy It becomes.

In the control system 1 (1A), for example, the speed change of the vehicle 100 is large and the motion control of the vehicle 100 becomes unstable (for example, spin, slip) as a method of setting a threshold other than the above. An estimated limit value of movement may be set as a threshold. Thereby, the safety of the motion control of the vehicle 100 can be reliably ensured.

Moreover, although the switching method like a switch was demonstrated as an output method of the switching part 17 here, you may switch an output gradually according to time information, for example. For example, when switching from the output of the first control (the automatic driving control information L4 or the holding control information L11) to the output of the second control (the safe driving control information L8), an intermediate value (average value etc.) And then switch to the output of the second control. By doing this, it becomes possible to suppress large fluctuations at the time of switching of the control output.

Also, the respective time information need not exactly match, and for example, the middle value between time t0 and t1 may be averaged and taken (for example, (xa0 + xa1) / 2) and compared . Even when there is a gap in the generated time information or a shortage in the track information, the determination can be appropriately performed.

In addition, when the output of the first control is, for example, the holding control information L11, as a result of comparing the holding control information L11 with the output of the second control (safety driving control information L8) in time series, When it is determined that the difference such as the position or the speed does not fall below the predetermined value within the held holding control information L11, the time when the difference becomes the minimum value within the range of the holding control information L11 Switching of the control output (switching to the safe driving control information L8) is performed. As a result, in the control system 1A, switching of the control output can be performed at the time when the influence on the motion control becomes the smallest within the range of the holding control information L11, and the driver's discomfort can be minimized.

Further, as a result of the abnormality detection by the abnormality detection unit 16 described above, when the abnormality detection unit 16 determines that the abnormality is a transient, a time (for example, partial time) which is expected to recover from the transient abnormality If it is within the required time required for restart, the result of the judgment by the judgment method of the control output mentioned above, even if the difference is less than the predetermined value, the switching is not performed and the output of the first control (automatic operation control information The processing may be continued based on L4 or the holding control information L11). This can prevent unnecessary switching in the case of a transient abnormality.

Furthermore, when switching to the output of the second control (safety operation control information L8) due to a transient abnormality or the like, and then switching again to the original first control output (the automatic operation control information L4 or the holding control information L11) Similarly, the output of the second control (safety operation control information L8) is output from the first control (automatic operation) by switching to the original control output by performing the determination by the control output determination method similar to that described above. The stability of the motion control when switching to the control information L4 or the holding control information L11) can be secured.

In the embodiment described above, the control system 1 (1A) has been described by exemplifying the case where there is one safety control unit 19. However, even if a plurality of safety control units 19 are provided in parallel in a multiplex system or the like. Good. For example, the control system has two safety control units, that is, the safety control unit 19A and the safety control unit 19B, and when a failure occurs in the main function, the safety control unit 19A is used according to the priority and the safety control unit The reliability can be improved by further switching to the safety control unit 19B when an abnormality occurs in 19A.

When configured in this way, for example, the determination of the control output comparison method described above is performed for the output of the first control and the control output of the safety control unit 19A (safety operation control information L8A) that is the output of the second control. As a result, when the difference does not fall below the predetermined value, the control output described above for the output of the first control and the control output (safety operation control information L8B) of the safety control unit 19B which is the output of the second control When the difference is less than or equal to a predetermined value as a result of the determination by the comparison method of the above, the control output can be used.

This makes it possible to select an output having a smaller difference in motion control and higher safety in terms of motion control from among a plurality of control outputs in a multiplex system in consideration of safety.
Therefore, when switching the control output of the automatic driving, the output when the result of the motion control by the automatic driving control information fluctuates largely in time series is suppressed, and from the viewpoint of the motion control etc., different control such as degeneration system etc. safely It can be switched to output.

As described above, in the embodiment,
(1) The automatic driving control unit 12 (first control unit) that generates automatic driving control information L4 (first control information) for normally controlling the motion of the vehicle 100 (moving object), and the motion of the vehicle 100 A safety control unit 19 (second control unit) that generates safe driving control information L8 (second control information) for non-ordinary control and one of automatic driving control information L4 and safe driving control information L8 is output. The switching unit 17 has the safe driving control information L8 when the difference d between the automatic driving control information L4 and the safe driving control information L8 is equal to or less than a predetermined threshold dth (d ≦ dth). It was set as the structure to output.

If comprised in this way, the switching part 17 will output the safe driving control information L8 for abnormal control, when the difference d of the automatic driving control information L4 and the safe driving control information L8 is small enough. Therefore, for example, when a failure occurs in a part of the control system 1 of the vehicle 100, the switching unit 17 outputs a plurality of control outputs (a plurality of functions (automatic driving control unit 12, safety control unit 19)) From the automatic driving control information L4 and the safe driving control information L8), it is possible to select a control output that can further maintain the safety.

Further, when the difference d between the automatic driving control information L4 and the safe driving control information L8 is sufficiently small, the switching unit 17 outputs the safe driving control information L8, so the motion of the vehicle 100 can be converted to the safe driving control information L8. Even based on the control, the motion of the vehicle 100 can be controlled safely and safely without giving the driver a sense of incongruity such as an impact at the time of switching.

(2) Further, the automatic driving control information L4 and the safe driving control information L8 include time information (for example, t0, t1, t2, ..., tn) with time, and the switching unit 17 uses the same time information ((2) For example, when the difference d between the automatic driving control information L4 and the safe driving control information L8 at t1) (for example, the difference between distance, speed, acceleration, and yaw rate) is less than or equal to a predetermined threshold dth (d ≦ dth), safety The operation control information L8 is output.

With this configuration, the switching unit 17 can make the determination based on the same reference by judging based on the difference between the automatic driving control information L4 and the safe driving control information L8 at the same time, and the automatic driving control information L4 and the safe driving can be determined. It is possible to appropriately determine which of the control information L8 is to be output.

(3) Further, the threshold dth used to determine the difference d by the switching unit 17 is the reverse (plus or minus) sign of the difference d or the limit value of the motion of the vehicle 100 (for example, the vehicle 100 spins or slips) Limit value of the exercise to be

With this configuration, even if the threshold dth is the reverse of the sign of the difference d or the limit value of the motion of the vehicle 100, the difference d between the automatic driving control information L4 by the switching unit 17 and the safe driving control information L8 and the threshold dth As a result of appropriately performing the comparison of the above, it is possible to reduce the uncomfortable feeling such as the impact at the time of switching to the driver while maintaining the safety of the motion of the vehicle 100.

(4) Further, the switching unit 17 is configured to output the safe driving control information L8 after the time information in which the difference d becomes the smallest when all the differences d acquired over time are not less than or equal to the predetermined threshold dth. did.

According to this configuration, the switching unit 17 outputs the safe driving control information L8 when the difference d becomes the minimum even when the difference d does not become equal to or smaller than the predetermined threshold dth. Can be reliably performed based on the safe driving control information L8.

(5) In addition, the safety control unit 19B (third control unit) that generates safe driving control information L8B (third control information) for controlling the movement of the vehicle 100 is included, and the switching unit 17 holds Difference between information L11 (first control information) and safe driving control information L8A (second control information), difference between holding control information L11 (first control information) and safe driving control information L8B (third control information) And the safe driving control information L8A or the safe driving control information 8B of which the difference with the holding control information L11 is smaller.

According to this configuration, when the safety control unit 19 (predetermined control unit) is multiplexed, motion control of the vehicle 100 can be performed based on the control output of the safety control unit 19 which minimizes the difference. As a result, it is possible to further reduce the impact (switching step) at the time of switching the control while multiplexing the control units to improve the safety, and as a result, it is possible to further reduce the sense of discomfort to the driver.

Second Embodiment
In the embodiment described above, the control system 1 (1A) exemplifies the case where the control output to the motion control unit 18 is generated by the automatic operation control unit 12 or the safety control unit 19; Is not limited to this. For example, the original control program for moving the vehicle 100 of any control unit with the main function may be replaced (replaced) with an alternative program for moving with the degeneration function.

In the following second embodiment, a control program possessed by the safety control unit 19 will be described by exemplifying a case where it is replaced (replaced) with an alternative program. In this case, the safety control unit 19 generates a control output that causes the vehicle 100 to move with the degeneracy function according to the replaced alternative program.

FIG. 12 is a block diagram for explaining the functional configuration of the entire control system 1B according to the second embodiment.
FIG. 13 is a block diagram for explaining the functional configuration of the reconfiguration management unit 41. As shown in FIG.
FIG. 14 is a block diagram for explaining the functional configuration of the reconfiguration execution unit 42. As shown in FIG.

As shown in FIG. 12, in addition to the configuration of the control system 1A of the above-described embodiment, the control system 1B includes a reconfiguration management unit 41 and a reconfiguration execution unit 42, and the reconfiguration execution unit 42 It differs from the control system 1A of the embodiment described above in that the control program is replaced with an alternative program (reconfiguration) when a failure occurs in the control system 1B.
In the second embodiment, the motion control of the vehicle 100 with the degeneracy function based on the reconstructed alternative program corresponds to the non-ordinary control.

In the embodiment, the reconfiguration management unit 41 and the reconfiguration execution unit 42 are arranged in different ECUs 3 (see FIG. 7). For example, the reconfiguration management unit 41 is disposed in the same ECU 3 as the integrated recognition unit 11 and the automatic driving control unit 12 (see FIG. 7), and the reconfiguration execution unit 42 is the same as the switching unit 17 and the motion control unit 18 It is arrange | positioned at ECU3 (refer FIG. 7).

Thereby, for example, when some failure occurs in the ECU 3 in which the automatic operation control unit 12 is disposed, the reconfiguration management unit 41 arranges the alternative program in the ECU 3 in which the reconfiguration execution unit 42 is disposed. In the ECU 3 in which no failure occurs (the ECU 3 in which the reconfiguration execution unit 42 is disposed), execution of the alternative program by the reconfiguration execution unit 42 becomes possible.

The reconfiguration management unit 41 is connected to the abnormality detection unit 16, and prepares an alternative program (a program for realizing the degeneration function) based on the abnormality detection information L5 detected by the abnormality detection unit 16.

As shown in FIG. 13, the reconfiguration management unit 41 has a control state monitoring unit 411, a control state determination unit 412, an information notification unit 413, an alternative program acquisition unit 414, an alternative program transmission unit 415, and an abnormality. And a control determination unit 416.

The control state monitoring unit 411 acquires the current control state of the vehicle 100 from the automatic driving control unit 12 or the like, and transmits the acquired control state of the vehicle 100 to the control state determination unit 412.

Based on the control state of the vehicle 100 acquired from the control state monitoring unit 411, the control state determination unit 412 determines a policy of reconfiguration as to which alternative program is to be arranged in which control unit (ECU 3).

The information notification unit 413 notifies one or both of the output management unit 14 and the notification management unit 15 of the information related to the reconfiguration determined by the control state determination unit 412.

The alternative program acquisition unit 414 is a storage area (cloud network, ROM, HDD) of different places via any ECU 3 in which the reconfiguration management unit 41 is arranged, an in-vehicle network such as CAN 99 or the communication device 5 etc. , RAM, etc.).

The alternative program transmission unit 415 transmits the alternative program acquired by the alternative program acquisition unit 414 to the reconfiguration execution unit 42.

When a certain abnormality occurs in the control system 1B, the abnormality control determination unit 416 determines the control output according to an abnormality control determination method described later.

Next, as shown in FIG. 14, the reconfiguration execution unit 42 includes an alternative program reception unit 421, an alternative program allocation unit 422, an arrangement completion notification unit 423, a reconfiguration instruction reception unit 424, and an alternative program execution unit. And 425.

The alternative program reception unit 421 receives the alternative program transmitted from the alternative program transmission unit 415 of the reconfiguration management unit 41.

The alternative program placement unit 422 places the received alternative program in a predetermined storage area (ROM, RAM, etc.) of any one of the ECUs 3 in which the reconfiguration execution unit 42 is placed.

The arrangement completion notifying unit 423 notifies the reconfiguration management unit 41 that the arrangement of the alternative program to the predetermined storage area by the alternative program arranging unit 422 is completed.

The reconfiguration instruction reception unit 424 receives a reception instruction or an execution instruction of the alternative program from the reconfiguration management unit 41.

The alternative program execution unit 425 executes an alternative program arranged in a predetermined storage area.

The respective units in the above-mentioned reconfiguration management unit 41 and reconfiguration execution unit 42 communicate with each other to exchange necessary information and instructions. The allocation of functions between the reconfiguration management unit 41 and the reconfiguration execution unit 42 is not limited to the above embodiment, and, for example, acquisition of an alternative program is not directly performed by the reconfiguration management unit 41 but by the reconfiguration execution unit 42 directly. It may be executed. In that case, the processing of transmitting and receiving the alternative program by the reconfiguration management unit 41 becomes unnecessary, and the processing load can be reduced.

[Vehicle control status]
Next, the vehicle control state will be described.
The vehicle control state indicates a control state of the control system 1B of the vehicle 100. For example, ON / OFF of the automatic operation state (when OFF, the driver operates and the system assists or the system does not control), travel on a general road or a highway, ON / OFF during automatic parking, travel Speed (low speed, medium speed, high speed), driver's condition (operable or difficult to drive), situations where automatic driving is difficult such as weather (strong rain, fog, back light, roads not on the map, etc.), etc. are shown.

In the control system 1B, the ECU 3 requiring an alternative function or the ECU 3 capable of performing an alternative function is changed according to the vehicle control state. For example, when automatic parking is not performed, resources such as CPU, ROM, and RAM, which are necessary for realizing the function, are temporarily unnecessary, and an alternative program is arranged in that area. . Further, in another example, the general road is allocated to resources of the integrated recognition unit 11 and the automatic operation control unit 12 which are not used during automatic driving.

By changing the alternative program and the placement ECU according to the vehicle control state and / or the required safety level, it is possible to execute the optimum alternative control in accordance with the vehicle control state.

[Reconfiguration processing sequence]
Next, the sequence of the reconfiguration process in the control system 1B in the second embodiment described above will be described.
FIG. 15 is a diagram for explaining the sequence of the reconfiguration process in the control system 1B in the second embodiment described above.

In the second embodiment, the ECU 3A (for example, equivalent to the CPU 3A shown in FIG. 1) performs a reconfiguration instruction by the alternative program, a reconfiguration management unit 41, and a control unit where a failure occurs (eg: automatic operation control unit 12) will be described as an example.
Further, the ECU 3B (for example, corresponding to the CPU 3B shown in FIG. 1) has a reconfiguration execution unit 42 that executes the alternative program reconfigured by the reconfiguration management unit 41, and the ECU 3B and ECU 3C that execute alternative control are normally The case where control is received from the ECU 3A will be described as an example.

In traveling of the vehicle 100 at the normal time, the ECU 3A outputs a control output for executing the normal control to the ECU 3C (S1301). The ECU 3B also outputs a control output for executing the normal control to the ECU 3C at normal times (S1302).

After that, when the vehicle 100 continues traveling and the alternative program is changed such that the vehicle control state is changed, here, the automatic driving control unit 12 of the ECU 3A determines that, and instructs the reconfiguration management unit 41 A change of the vehicle control state is notified (S1303).

In the ECU 3A, the reconfiguration management unit 41 notified of itself acquires the alternative program by itself. Alternatively, the reconfiguration management unit 41 instructs the other ECU 3B, 3C or storage (HDD or the like) to output a substitute program (S1304).

In this case, the acquisition destination of the alternative program by the reconfiguration management unit 41 is any ECU inside the control system 1B of the vehicle 100, or storage (HDD etc.), or the outside of the control system 1B via the communication device 5 or GW97. Acquire from the device. Alternatively, it is held in advance in an ECU that requests functional substitution, such as in the ECU 3A.

The ECU 3A that has acquired the alternative program (S1305) transmits the alternative program acquired by the reconfiguration management unit 41 to the ECU 3B that performs functional substitution at the time of failure (S1306). The ECU 3B having received the alternative program arranges the alternative program by the reconstruction execution unit 42. In addition, the ECU 3B notifies the completion of the placement when receiving all the substitute programs and completing the placement (S1307). The ECU 3A continues the control at the normal time while managing the reconfiguration (S1308).

Thereafter, when a failure occurs in the ECU 3A (S1309), for example, the failure detection unit 16 of the control system 1 detects the failure and notifies the ECU 3B of the occurrence of the failure. Alternatively, the ECU 3B detects an abnormality in response to the interruption of communication (S1310).

The ECU 3B recognizing the failure starts the execution of the alternative program held by the reconfiguration execution unit 42 (S1311). At that time, the control is taken over, and control (unusual control) based on the alternative program is performed from the ECU 3B to the ECU 3C (S1312). In this way, alternative functions are implemented.

On the other hand, if the vehicle control state is changed before the failure occurs (S1313), the reconstruction management unit 41 receives a notification from the automatic driving control unit 12 or the like as described above, and the alternative program is not necessary for the ECU 3B. A state change notification including the information of (1) is issued (S1314).

The ECU 3B discards the alternative program held by the reconfiguration execution unit 42 in response to receiving the state change notification (S1315). Thereafter, as necessary, the ECU 3B performs control at normal times based on a normal control program (S1316).

Thus, the alternative program for alternative processing is arranged in advance in the ECU 3B according to the vehicle control state, and when a failure occurs, the program is switched to the alternative program.

These reconfigurations are implemented, for example, for the reconfiguration of the safety control unit 19. Thus, for example, in the control flow by the switching unit 17 in FIG. 9, the output of the first control is the automatic driving control information L4, and the output of the second control is the safe driving control information L8 of the safety control unit 19 that has been reconfigured. Thereby, the switching from the automatic driving control information L1 to the safe driving control information L8 of the safety control unit 19 can be switched at the time when the difference of the motion information becomes small, and the safety can be improved.

[Control information switching process in switching unit]
Next, control information switching processing of the switching unit 17 according to the second embodiment will be described.
FIG. 16 is a flowchart of control information switching processing of the switching unit 17 according to the second embodiment.

In the control information switching process of the switching unit 17 according to the second embodiment, the control information switching process described above has a reconfiguration completion determining process (step S1401) for determining whether or not the reconfiguration is completed. This is mainly different from the processing (see FIG. 6).

In step S1401, after the switching unit 17 of the control system 1B acquires the notification of abnormality detection from the abnormality detection unit 16, whether or not reconfiguration (replacement of the alternative program by the reconfiguration management unit 41) is completed or not If it is determined that the reconfiguration is not completed (step S1401: NO), the process proceeds to step S1405, and the reconfigured control output can not be used, and therefore the retention control information acquired from the control information retention unit 40 L11 is output to the motion control unit 18.

If the switching unit 17 determines that the reconfiguration is completed (Yes at Step S1401), the process proceeds to Step S1402, and the reconfigured control output acquired from the reconfiguration execution unit 42 and the acquired control information storage unit 40 The comparison with the holding control information L11 is performed, and in step S1403, it is determined whether the difference d of the comparison result is less than or equal to a predetermined specified value (threshold dth).

If the switching unit 17 determines that the difference d is equal to or less than the predetermined threshold dth (step S1403: YES), the process proceeds to step S1404 and the reconfigured control output (for controlling the motion of the vehicle 100 with the degeneration function) When it is determined that the safe driving control information L8) is output to the motion control unit 18 and the difference d is not less than the predetermined threshold dth (step S1403: No), the process proceeds to step S1405 and the holding control information L11 is transferred to the motion control unit 18 Output to

As described above, in the second embodiment,
(5) The reconstruction management unit 41 having an alternative program for controlling the motion of the vehicle 100, and the reconstruction execution unit 42 (the reconstruction management unit 41 and the reconstruction execution unit 42 are combined to reconstruct the present invention And the safety control unit 19 controls the vehicle 100 based on an alternative program that the reconstruction execution unit 42 has, instead of the control program that exhibits the main function.

With such a configuration, safety control unit 19 can control vehicle 100 with an alternative program that exhibits a degeneracy function instead of the control program that exhibits a normal main function. Even when a failure (failure) occurs, the safety control of the vehicle 100 can be appropriately performed based on the alternative program.

(6) Further, the switching unit 17 is ready to generate the safety control information L8 (control output) using the alternative program instead of the control program that exerts the normal main function by the safety control unit 19 If not, the holding control information L11 held by the control information holding unit 40 is output.

With this configuration, the switching unit 17 can appropriately perform the control of the vehicle 100 without stopping the control even before the preparation of the control by the alternative program is completed.

Third Embodiment
In the control system described above, it may be determined whether or not the vehicle 100 is in an emergency state, and the control information switching process by the switching unit 17 may be executed based on the determination result.

Next, a control system 1C according to a third embodiment will be described.
FIG. 17 is a block diagram for explaining the functional configuration of the entire control system 1C according to the third embodiment.
FIG. 18 is a diagram for explaining an example of vehicle control by the control system 1C of the third embodiment.

The control system 1C differs from the control system 1B described above in that the control system 1C further includes an emergency control unit 43 that determines an emergency state of the vehicle 100 in addition to the configuration of the control system 1B described above.

The emergency control unit 43 is connected to a plurality of detection devices 80, and determines whether the vehicle 100 is in an emergency state based on the surrounding situation L1 of the vehicle 100 detected by the detection devices 80. When the emergency control unit 43 determines that the vehicle 100 is in the emergency state, the emergency control information L12 for avoiding the emergency state of the vehicle 100 (for example, control to decelerate the vehicle 100 toward the road shoulder and stop it at the road shoulder) Information) is output to the switching unit 17.

In the embodiment, the emergency control unit 43 acquires relative information from the surrounding situation L1 of the vehicle 100 detected by the 360 ° camera 87, the sonar 84 or the like, and based on the relative information, whether the vehicle 100 is in an emergency state or not judge.

Here, relative information is information that can be acquired from the external world recognition information, particularly from the detection device 80, and can be calculated from the relative position and relative velocity between the surrounding object and the vehicle, relative acceleration, and their values. Is any combination of information.

An example of the relative information is shown in FIG. Here, an example in which the preceding vehicle 101 is recognized by the detection device 80 is shown.

In (a) of FIG. 18, the preceding vehicle 101 exists in the front, the distance is la as the relative position, the angle with the horizontal right direction of the own vehicle (vehicle 100) as 0 degree is θa, and the relative velocity is dva Do.

The relative speed indicates the speed at which the own vehicle (vehicle 100) and the preceding vehicle 101 (object) approach or leave. In FIG. 18A, since the direction from the host vehicle (vehicle 100) to the leading vehicle 101 and the traveling direction of both are the same, it can be represented by the difference between the speeds of the leading vehicle 101 and the host vehicle.

In (b) of FIG. 18, when the direction from the host vehicle to the leading vehicle 101 and the traveling direction of both are not the same, the respective speeds are projected onto a straight line from the host vehicle to the leading vehicle 101 and the difference is calculated. By doing this, the relative velocity dvb can be determined. Here, when the relative speed is positive, it indicates that the preceding vehicle 101 is moving away from the host vehicle, and when the relative speed is negative, it indicates that the preceding vehicle 101 is approaching the host vehicle. Although not shown, the relative acceleration is a time change of the relative velocity, so it can be calculated from the change of the observed velocity.

The method of expressing the relative position may be expressed by a coordinate system with the vehicle at the origin as well as the relative distance and angle. For example, in FIG. 18, the vehicle can be represented by (rxa, rxy), with the vehicle as the origin, y-coordinate in the front-rear direction of the vehicle, positive in the forward direction, and x-coordinate in the left-right direction with the right.

Emergency control
Next, an example of emergency control based on relative information will be described.
The emergency control unit 43 of the control system 1C creates drive control information based on the state of the host vehicle (vehicle 100) acquired from the detection device 80.

As shown in FIG. 18, when there is an object (preceding vehicle 101) ahead of the own vehicle (vehicle 100) and the relative position (distance) in the relative information falls below a certain value, the vehicle decelerates with respect to the own vehicle Take control. Therefore, the emergency control unit 43 determines the relative information and the state of the vehicle acquired from the detection device 80, and outputs drive control information for performing deceleration to the switching unit 17.

When the relative position between the host vehicle and the preceding vehicle 101 exceeds a certain value, drive control information for controlling acceleration is output to the host vehicle in the same manner. Thus, the emergency control unit 23 controls acceleration or deceleration so that the relative position of the preceding vehicle 101 ahead does not exceed a predetermined amount or falls below a predetermined amount.

Even when the preceding vehicle 101 exists behind the own vehicle, the emergency control unit 43 similarly performs control so that the relative position does not exceed a predetermined amount or falls below a predetermined amount.

Also, the determination may be performed based on not only the relative position but also the relative velocity and the relative acceleration.
For example, if there is a preceding vehicle 101 ahead and there is a high possibility of approaching the vehicle due to relative speed or relative acceleration even if the relative position is the same, deceleration control is performed.

The equation for calculating the risk value for the above judgment can be expressed by the following equation 2 with the risk value R, the relative distance dl, the relative velocity dv, and the relative acceleration da. Here, A, B and C are constants.

In the calculation using the risk value R, acceleration or deceleration is controlled so that the risk value R does not exceed a certain amount, as in the determination based on the relative position. As described above, by performing determination using relative velocity and relative acceleration, it is possible to suppress the occurrence of a situation (such as the preceding vehicle 101 approaching the host vehicle) having a higher risk even at the same relative position, and secure safety. Can. The control based on the relative information can be performed by the determination by the emergency control unit 23 described above and the control of acceleration / deceleration.

In addition, when another vehicle is present simultaneously at the front and back, control is performed so that the relative position is separated from the near one. For example, deceleration is controlled when another vehicle ahead is closer, or acceleration is controlled when another vehicle behind is closer.
Further, not only in the front-rear direction but also in the left-right direction, it is recognized from the relative position, and steering is performed in the direction in which other vehicles are not present, for example, control to avoid a collision in the front-rear direction. The target yaw rate for that purpose also includes the drive control information, and the emergency control unit 43 outputs the switching unit 17.

<Control Information Switching Process of Switching Unit Including Emergency Control>
Next, control information switching processing of the switching unit 17 according to the third embodiment will be described.
FIG. 19 is a flowchart of control information switching processing of the switching unit 17 according to the third embodiment.

In step S1701, the switching unit 17 of the control system 1C determines whether or not the emergency control information L12 (control output) from the emergency control unit 43 is received, and receives the emergency control information L12 from the emergency control unit 43. If it is determined (step S1701: YES), the process proceeds to step S1706, and the emergency control information L12 received from the emergency control unit 43 is output to the exercise control unit 18.

If the switching unit 17 determines that the received control output is not the emergency control information L12 from the emergency control unit 43 (step S1701: No), the process proceeds to step S1702, and the same as in the first embodiment. , The first control output and the second control output are compared.

Then, in step S1703, the switching unit 17 determines whether the difference d of the comparison result in step S1702 is less than or equal to a predetermined specified value (threshold dth), and is equal to or less than the predetermined specified value (threshold dth). (Step S1703: Yes), the process proceeds to step S1705, and the output of the second control (for example, safe driving control information L8) is output to the motion control unit 18.

On the other hand, when the switching unit 17 determines that the difference d is not less than or equal to the predetermined specified value (threshold dth) (step S1703: No), the impact at the switching of the control is increased as it is, and the switching of the control can not be performed. In step S1704, the output of the first control (for example, the holding control information L11) is output to the motion control unit 18.

As described above, even in the case of comparing and judging the output of the motion control at the time of switching the control output, the control should be preferentially implemented when a highly urgent process is required, such as a change in surrounding conditions. Can.

In the embodiment described above, the safety control unit 19 and the emergency control unit 43 are illustrated as different functional blocks, but they may be the same functional block, for example, the control output of the safety control unit 19. And information indicating that it is emergency control may be added. With this configuration, it is possible to reduce functional blocks and facilitate determination.

As described above, in the third embodiment,
(7) The emergency control unit 43 that performs emergency control of the vehicle 100 is provided, and when the switching unit 17 acquires the emergency control information L12 generated by the emergency control unit 43, the automatic control generated by the automatic operation control unit 12 Instead of the operation control information L4, the safe operation control information L8 generated by the safety control unit 19, or the holding control information L11 held by the control information holding unit 40, the emergency control information L12 is preferentially output. .

In this configuration, when the vehicle 100 is in an emergency state, the switching unit 17 outputs emergency control information L12 for avoiding the emergency state of the vehicle 100 instead of the other control information. The emergency state of the vehicle 100 can be avoided quickly and reliably based on the control information L12.

Fourth Embodiment
Next, an example of switching (overriding) the control by the user from the control based on the automatic driving control information of the above-described embodiment or the control based on the relative information will be described.

The user input unit 13 according to the fourth embodiment uses the input device 8 to start the driving operation of the user (for example, stepping on a pedal, operating a steering, pushing an automatic driving end button, etc.) Detection, and notifies the switching unit 17 of this. The switching unit 17 receives the notification of the start operation of the driving operation by the user, and performs user control switching determination processing described later.

[User control switching judgment processing]
Next, user control switching determination processing of the switching unit 17 according to the fourth embodiment will be described.
FIG. 20 is a flowchart of user control switching determination processing of the switching unit 17 according to the fourth embodiment.

In step S1801, the switching unit 17 outputs the control output (for example, the holding control information L11) by the control system as in the control information switching process (step S101) in the switching unit 17 of the first embodiment described above, The control output (for example, user operation input) by user operation is compared.
In the embodiment, the control output by the control system corresponds to the output of the first control, and the control output by the user operation corresponds to the output of the second control.

In step S1802, the switching unit 17 determines whether the difference d of the comparison result in step S1801 is less than or equal to a predetermined specified value (threshold dth), and is equal to or less than the predetermined specified value (threshold dth) When it is determined that (step S1802: Yes), the control can be switched safely, so the process proceeds to step S1804 and the control output by the user operation is output to the exercise control unit 18.

On the other hand, when the switching unit 17 determines that the difference d of the comparison result in step S1801 is not less than or equal to the predetermined specified value (threshold dth) (step S1802: No), the shock at the time of switching the control remains unchanged. As a result, since the control can not be switched safely, the process proceeds to step S1803, and the control output by the control system is output to the motion control unit 18 without switching to the user operation.

As described above, when there is a user operation input and control is switched, control is not switched when there is a significant difference between motion control by the time-series operation by the control system of the vehicle 100 and the user operation. It is possible to switch control safely, avoiding an unsafe motion control state.

Also in the control system of the fourth embodiment described above, as in the control system of the third embodiment, when there is an input for emergency control, as shown in FIG. Priority is given to the output of emergency control over the output or the output of the second control. With this configuration, it is possible to implement emergency control prior to the output of the first control or user operation for dangerous situations.

As described above, in the control system 1 of the vehicle 100, when switching the control output of the automatic driving, the output in the case where the result of the motion control by the automatic driving control information fluctuates largely in time series is suppressed. From the viewpoint, it is possible to switch to a different control output such as a degeneration system safely.

In particular, when switching from the holding control information L11 to the output of the safe driving control information L8, the control can be switched safely by comparing in time series.

Further, even in the case of the control output in which the safety control output is reconfigured, the control can be switched safely.

In addition, when there is an emergency control output as a safety control output, it is possible to respond to the emergency control output and switch the control safely in accordance with a change in the surrounding environment.

Furthermore, even when there is a driver's operation input, it is possible to switch within a stable range of motion control, such as when a failure occurs.

As described above, in the fourth embodiment,
(8) The safe driving control information L8 is configured to be operation control information by user operation.

With such a configuration, when the switching unit 17 receives operation control information by user operation during automatic driving of the vehicle 100 based on the automatic driving control information L4 (when it is overridden), the automatic driving control information L4 and the user operation are Since the operation control information by the user operation is output when the difference d with the operation control information by the user is equal to or less than the predetermined threshold value dth, the switching to the user operation at the time of overriding can be smoothly performed.

As mentioned above, although an example of an embodiment of the present invention was explained, all the embodiments mentioned above may be combined and any two or more embodiments may be combined arbitrarily.

Moreover, although the case where the control system 1 was applied to the vehicle 100 was illustrated and demonstrated in embodiment mentioned above, it is not limited to the vehicle 100, For example, the control system 1 mentioned above is a construction machine, an escalator, The present invention can be suitably applied to all types of mobile objects such as elevators, railways, ships, aircraft, and drone.
In particular, in the case of a manned mobile body (for example, a construction machine, an escalator, an elevator, a railway, a ship, or an aircraft), the control switching is not performed when the shock at the control switching becomes large, and the specified value or less Since the control switching is performed only in the case of the above, it is possible to reduce the sense of discomfort when switching the control between the driver and the occupant, and it is possible to drive safely and safely.

Further, the present invention is not limited to the one provided with all the configurations of the above-described embodiment, and a part of the configuration of the above-described embodiment is replaced with the configuration of the other embodiments. Alternatively, the configuration of the above-described embodiment may be replaced with the configuration of another embodiment.

Further, some configurations of the embodiment described above may be added to, deleted from, or replaced with configurations of other embodiments.

1: control system 11: integrated recognition unit 12: automatic operation control unit 13: user input unit 14: output management unit 15: notification management unit 16: abnormality detection unit 17: switching unit 18: exercise Control unit, 19: Safety control unit, 2: AD1-ECU, 3: VMC-ECU, 31: CPU, 32: CPU, 33: Memory, 4: GW, 40: Control information holding unit, 41: Reconfiguration management unit , 42: reconfiguration execution unit, 43: emergency control unit, 5: communication device, 6: other vehicle control system, 7: external output device, 8: input device, 9: notification device, 80: detection device, 81, 85: corner rider, 82: corner radar, 83: front camera, 84: sonar, 86: front radar, 87: 360 ° camera, 90: drive device, 91: brake, 92: steering, 93: ECU, 94: EMC, 9 : ATCU, 971: Body, 972: HMI, 973: connection device, 974: information providing apparatus

Claims

A first control unit that generates first control information for usually controlling the movement of the moving body;
A second control unit that generates second control information for unusually controlling the movement of the moving body;
And a switching unit configured to output one of the first control information and the second control information.
The switching unit is
The control system of the mobile which outputs said 2nd control information, when the difference of said 1st control information and said 2nd control information is below a predetermined threshold.
The first control information and the second control information include time information over time.
The mobile unit control according to claim 1, wherein the switching unit outputs the second control information when a difference between the first control information and the second control information in the same time information is equal to or less than a predetermined threshold. system.
It has a reconstruction unit having an alternative program for controlling the movement of the moving body,
At least one of the first control unit and the second control unit is replaced with the main function program for controlling the first control unit and the second control unit, the reconstruction unit The control system of the mobile according to claim 2, wherein the mobile is controlled by using the alternative program that the computer has.
Among the first control information generated by the first control unit and the second control information generated by the second control unit, there is provided a control information holding unit for holding at least one of the control information. And
The switching unit is
The difference between the control information held by the control information holding unit and the control information generated by at least one of the first control unit and the second control unit based on the alternative program is predetermined The control system according to claim 3, wherein the control information generated based on the alternative program is output if the threshold value is less than or equal to a threshold value of.
In the switching unit, at least one of the first control unit and the second control unit prepares to generate the substitute control information using the substitute program instead of the main function program. 5. The control system of a mobile unit according to claim 4, wherein the control information held by the control information holding unit is output when the control information is not completed.
It has an emergency control unit that performs emergency control of the mobile unit,
When the switching unit acquires the emergency control information generated by the emergency control unit, the first control information generated by the first control unit and the second control information generated by the second control unit The control system according to claim 5, wherein the emergency control information is preferentially output instead of the control information held by the control information holding unit.
The control system according to claim 4, wherein the threshold used to determine the difference by the switching unit is a reversal of a sign of the difference or a limit value of the movement of the moving body.
The movement according to claim 2, wherein the switching unit outputs the second control information after time information in which the difference is the smallest, when all of the differences acquired over time are not less than or equal to the predetermined threshold. Body control system.
It has a third control unit that generates third control information for controlling the movement of the moving body,
The switching unit is
Comparing a difference between the first control information and the second control information with a difference between the first control information and the third control information;
The control system of a mobile according to claim 8, which outputs the second control information or the third control information of which the difference with the first control information is smaller.
The control system of a mobile according to claim 1, wherein the second control information is operation control information by user operation.
A control information acquisition step of acquiring first control information for usually controlling movement of the moving body, and second control information for unusually controlling movement of the moving body;
A difference calculating step of calculating a difference between the first control information and the second control information at the same time;
And a control information output step of outputting the second control information when the difference between the first control information and the second control information is equal to or less than a predetermined threshold value.